HIPAA Documentation Retention Guidelines_Draft_032002HIPAA Documentation Retention Guidelines_Draft_032002HIPAA Documentation Retention Guidelines_Draft_032002
Due Diligence Guidelines for
DHHS Divisions, Offices, Institutions & Facilities
HIPAA Documentation RetentionDue Diligence Guidelines for
DHHS Areas Impacted by HIPAADivisions, Offices, Institutions, & Facilities
DRAFT
Prepared By
NC DHHS HIPAA Program Management Office
March 2107, 2002
This Page Was Intentionally Left Blank
2
March 21, 2002 - 1 -Page
HIPAA Documentation Retention Guidelines_Draft_032002HIPAA Documentation Retention Guidelines_Draft_032002HIPAA Documentation Retention Guidelines_Draft_032002
Due Diligence Guidelines for
DHHS Divisions, Offices, Institutions & Facilities
This page was intentionally left blank.
Disclaimer
Disclaimer
Information contained in this document represents the NC DHHS HIPAA Program Management Office (PMO) staff’s views and interpretations of HIPAA and its accompanying regulations as published in the Federal Register as of the release date of this document. Any conclusions or recommendations contained herein are based on these interpretations. This information is subject to change and should be used only for the purpose intended by the NC DHHS HIPAA PMO. Unless otherwise noted on an individual document, the NC DHHS HIPAA PMO grants permission to copy and distribute files, documents, and information for non-commercial use, provided the items are copied and distributed without alteration. If you believe that information obtained from this document is inaccurate or out-of-date, please notify the DHHS HIPAA PMO via email at “POC email address here”..
Change History
Version Date / Version DescriptionV1 -– November 13, 2001March 20, 2002 / Original draft document
Change History
Version and Date / HistoryV 1March 7, 2002 / PMO Document Template v 1
V 2
Table of Contents
Table of Contents
Table of Contents......
1.Purpose......
2.Applicability......
3.Documentation Guidelines......
4.Document Creation, Organization & Version Control......
5.Filing Methods......
6.Data Backup and Security
7.Disposition and Retention.
Due Diligence Guideline
1.0Purpose...... 1
2.0 Applicability…………...………………………………………………………………………………..…..1
3.0 Documentation Guidelines...... 2
4.0 Document Table…….………………………………………………………………………….…………...2
5.0 Filing Methods ……………………………….………………………………………………………….…4
6.0Version Control…..…….………………………………………………………………………………..….4
7.0Retention and Disposition…………………………….………………………………………………….…4
Appendix A …………………...……………………………………………….…………………………………………..A.1
Appendix B……………………………………………………………………………………………….…….…...……..B.1
2
March 21, 2002 - 1 -Page
HIPAA Documentation Retention Guidelines_Draft_032002HIPAA Documentation Retention Guidelines_Draft_032002HIPAA Documentation Retention Guidelines_Draft_032002
Due Diligence Guidelines for
DHHS Divisions, Offices, Institutions & Facilities
1.Due Diligence Guidelines for DHHS areas impacted by HIPAA
2.1. Purpose.
The purpose of this document is to provide guidance for DHHS divisions, offices, and state owned/operated local entities [hereinafter called “DHHS entities”] in retaining the appropriate documentation to show they have taken all of the steps that can reasonably be expected to identify and comply with HIPAA requirements. This process is often loosely referred to as “due diligence”.
These guidelines should be followed by all DHHS entities. The guidelines may change once the HIPAA Enforcement regulation is released; however, these guidelines will remain in effect until such time as the Enforcement regulation is available and DHHS guidelines have been updated.
The Department of Health and Human Services is required to demonstrate due diligence in preparing for the Health Insurance Portability and Accountability Act. "Due diligence" is a legal term referring to the measures (efforts) that would ordinarily be exercised by a reasonable, prudent person under the particular circumstances. Managers and employees at all levels of the organization, who are involved in the DHHS’s HIPAA activities,must should make every reasonable effort to demonstrate due diligence in carrying out their responsibilities. ensure that normal HIPAA compliant business operations and services are implemented and maintained during and after the HIPAA compliance effort. For DHHS, this “reasonable effort” will include the ability to In this case, due diligence is indicated by all efforts and activities undertaken by officials to confirm that everything that which reasonably could be done was done to ensure that HIPAA compliance issues were identified, corrected, tested, and validated. .
Furthermore, itIt is absolutely necessary that for everyone to understand that it is a priority for the DHHS’s first and foremost priority to take every precaution necessary to prepare for HIPAA compliance and to ensure that normal HIPAA compliant business operations and services are implemented and maintained during and after the HIPAA compliance effort. This includes Independent Verification and Validation (IV&V) for all covered functions and systems.
Due diligence is also demonstraDemonstratteteedcompliance activities and decisions by thorough written and/or electronic documentation. that includes verifying the processes used for all HIPAA related activities and efforts. This includes documentation that may result from independent verification and validation (IV&V) processes for covered functions and systems. Records of actions taken, processes used, inventories, and decisions conclusions reached concerning HIPAA activities will be a critical factor in the event of anticipated HIPAA compliance audits. Having implemented the processes and methods correctly, sustaining HIPAA compliance should be easier. Ongoing due diligence efforts will be required to maintain HIPAA compliance.
Furthermore, this plan will remain as a standard until determined differently. These guidelines are to be followed by DHHS entities that are affected by HIPAA, whether directly affected as a covered health care component of DHHS or indirectly affected. ; tThese requirements may change when the HIPAA Enforcement rRegulations are is released; however, these guidelines will remain in effect until such time as the Enforcement regulation is available and DHHS guidelines have been updated.
The purpose of this document is not specifically to address how information can and should be shared with the public, but rather how HIPAA documentation should be treated within DHHS and individual areas of DHHS. DHHS entities may refer to the Department of Cultural Resources web site at to review the Public Records Law. Generally, DHHS employees should remember that all records are public records, regardless of the medium, and documentation must be made available to the public unless exempted by law. The Public Records Laws Relating To Confidential Records Held by North Carolina ( ) describes exceptions to the general Public Record Law. For example, “a public agency does not have to disclose security features of electronic data processing systems, information technology systems, telecommunications networks, or electronic security systems, including hardware or software processes, configurations, software, and codes G.S. §132-6.1(c).” DHHS employees should work through their normal operational channels to discover how to handle public requests if there is uncertainty about if/how HIPAA related information requested by the general public or media should be shared.
Talk about Public Records Law. The Public Records Laws Relating To Confidential Records Held by North Carolina specifically states that “a public agency does not have to disclose security features of electronic data processing systems, information technology systems, telecommunications networks, or electronic security systems, including hardware or software processes, configurations, software, and codes G.S. §132-6.1(c).”.
3.2.Applicability.
This document will applyThese guidelines apply to all DHHS divisions, offices, institutions, and facilities.Health Care Components and the Business Associates of DHHS or the DHHS divisions. Components or Divisions that were determined as “non-covered” will need to retain all the documentation associated with this decision, which will state why the “non-covered” determination was made.
4.3.DocumentationGuidelines.
The level in which due diligence must be tracked will depend on whether a DHHS area has been determined to be: a) a covered health care component, b) an internal business associate of a DHHS covered health care component, or c) a business associate of an external covered entity [all will hereinafter be referred to as “Impacted”].
If a determination has already been made that your areaa DHHS entity is not impacted by HIPAA [hereinafter called “Non-impacted”], then you must retain all information from the DHHS HIPAA PMO or other sources should be retained if it that states this conclusion and the reasons that conclusion was reached. Similarly, if it is determined that an area of DHHSa DHHS entity is Impacted, then that areaentity shouldmust retain all information from the DHHS HIPAA PMO or other source that states this conclusion, the reasons that conclusion was reached, and all key documentation that could be used to verify how compliance was reached and /or why a certain approach was used to achieve compliance. It is anticipated that non-impacted areas of DHHS will have minimal HIPAA related documentation to retain while impacted areas will have more significant amounts of HIPAA related documentation to retain.
Impacted and Non-impacted areas should use tThe following is a list of major documentsof general guidelines to ascertainas a guideline forthe the types of documents that should be maintained in each site’s HIPAA file to demonstrate due diligence“reasonable effort”. This list is to be used as a general guide. DHHS areas should exercise professional judgment in retaining a, and additional related documents should be included, even if not listed in the table. For HIPAA records, common sense and sound judgement should be used to determine what to keep however,
General Guidelines
You should keep all dDocumentation should be retained if itthat meets anyone or more of the following general criteria:
- the rule of thumb is "if in doubt, do NOT throw it out."It was sent to youa DHHS entity by the DHHS HIPAA OfficePMO and is specific to yourthat area within DHHS entity.
- It states a specific strategy or approach used or chosen by a specific DHHS entity to comply with HIPAA.
- It provides support for the rationale used by a specific DHHS entity to make decisions.
- It is written documentation that shows/proves a specific DHHS entity’s compliance with HIPAA.
- It is a contract created or amended with a third party performing a function covered under HIPAA.
- Anyone in your organizationSomeone in the specific DHHS entity signed it and it meets one or more of the aboveremaining criteria (e.g., sign-off document).
It is not clear whether or not the document should be kept.
The list looks complete to me however, number 4 could be expanded to include cost-benefit evaluation data and documentation demonstrating the formal evaluation of decisions and alternatives.
Categories and Examples of Documentation To Keep
The next few pages contains a table that describes some of the categories of HIPAA related documentation that shouldmay need to be kept. The detail in this table is not inclusiveis not meant to imply that all of the documentation referenced should be kept. All documentation and data should be measured first against the general guidelines above to ascertain whether it is key documentation. The table below describes some of the documents that could be considered key documentation if it also serves the purpose of documenting HIPAA related decisions or your rationale for decisions made by a DHHS entity, but will serve as an example of documentation that should be kept by individual areas within DHHS.
Please be aware that HIPAA documentation can include records that have been created or received during the past few years, as well as those that all offices will create in the future.
2
March 21, 2002 - 1 -Page
HIPAA Documentation Retention Guidelines_Draft_032002HIPAA Documentation Retention Guidelines_Draft_032002HIPAA Documentation Retention Guidelines_Draft_032002
Due Diligence Guidelines for
DHHS Divisions, Offices, Institutions & Facilities
Document Table
Document Category / Type of Record / Example (current and future)- Communications
instructions, decisions, impact, letters, memos, important presentations not related to training, state government, local agencies, PMO, contact list (including mailing addresses)meeting minutes
- Deliverables
- Work Products
- Guidelines
- Inventoriesy/Assessments
- Plans
- Project Tracking DcoumentsDocuments
- Reference Documents
- ApprovalsSign-off and Authorizations
Document Category / Type of Record / Example (current and future)
- Specific Requirements
- Legal Documentation
- Vendor web sites and certification verificationsVendor Contract Information
- Certifications
to confirm compliance with HIPAA standards / EDI Transaction Certifications, Security Certifications
- HIPAA Web Sites
- Training Records- This is important to verify staff participation in Security and Privacy Awareness training.
2
March 21, 2002 - 1 -Page
HIPAA Documentation Retention Guidelines_Draft_032002HIPAA Documentation Retention Guidelines_Draft_032002HIPAA Documentation Retention Guidelines_Draft_032002
Due Diligence Guidelines for
DHHS Divisions, Offices, Institutions & Facilities
5.4.Document Creation, Organization & 4.0 Version Control.
The following guidelines should be usedare recommended to properly create, store and control multiple versions of HIPAA related documents:
- A central point(s) of contact (POC) should be identified in each division and/or individual health care component for management of files and/or LAN directories related to HIPAA. This will typically be the designated HIPAA coordinator. Only the identified POC should create new folders and communicateion any changes to the HIPAA team or other affected personnel.
- Each document created should clearly represent the document title, the author, and the area of DHHS authoring the document.
- Final documents should be password protected such that the document owner(s) can modify the document, but everyone else opens it as a read only document. This will prevent documents that are critical in complying with HIPAA from being inadvertently changed by unauthorized personnel. This action can be accomplished from the Tools Menu (then “Protect Document” or “Protection”) from most Microsoft desktop publishing tools.
1.Final form documents and DRAFT documents regardless of the format (electronic or hard copy) should follow specific criteria regarding version control.