Under the HIPAA and HITECH Regulations (US) is it required for a system to record an audit trail for every time a user accesses any PHI(Protected Health Information)?

As I understand it, an audit trail of user logins is required, as well as any time a user adds, edits, or deletes PHI. Does simply viewing / accessing PHI need to be logged as well?

  • 1
    The Audit Protocol mentions ..regularly review records of information system activity, such as audit logs, access reports,... I don't know how any auditor could confirm that you are complying with the regulation if you don't log access to PHI. – ColleenV Jul 7 '15 at 23:12

Simply viewing must be logged.

45 CFR 170.210(b) Record actions related to electronic health information. The date, time, patient identification, and user identification must be recorded when electronic health information is created, modified, accessed, or deleted; and an indication of which action(s) occurred and by whom must also be recorded.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.