Re: Tape backup strategy and HIPAA Security Rule

[Al Barsa <barsa@xxxxxxxxxxxxxxxxxxx>]

Gerry,

It's my understanding that you have to be logging to a journal, not a
database file.  I am not familiar with the retention, however it would not
make sense to have any other retention other than your data retention.  The
logging is worthless without the data.

Al

Al Barsa, Jr.
Barsa Consulting Group, LLC

400>390

"i" comes before "p", "x" and "z"
e gads

Our system's had more names than Elizabeth Taylor!

914-251-1234
914-251-9406 fax

http://www.barsaconsulting.com
http://www.taatool.com
http://www.as400connection.com



                                                                           
             GKern@toledoclini                                             
             c.com                                                         
             Sent by:                                                   To 
             midrange-l-bounce         midrange-l@xxxxxxxxxxxx             
             s@xxxxxxxxxxxx                                             cc 
                                                                           
                                                                   Subject 
             04/01/2005 09:09          Tape backup strategy and HIPAA      
             AM                        Security Rule                       
                                                                           
                                                                           
             Please respond to                                             
             Midrange Systems                                              
                 Technical                                                 
                Discussion                                                 
             <midrange-l@midra                                             
                 nge.com>                                                  
                                                                           
                                                                           




I have trigger programs on my iSeries systems that are used to maintain a
log (file) of user access to all my HIPAA sensitive data. To my
understanding, according to the HIPAA Security rule, I have to keep these
logs and have them available for up to six years. Is that correct? If so
should I be doing dual backups in the event that a tape becomes unusable
over this six year period?

Regards, Jerry

Gerald Kern
IBM Certified AS/400 RPG IV Developer & RPG IV Programmer
MIS Project Leader, Lotus Notes/Domino Administrator
The Toledo Clinic, Inc.
4235 Secor Road
Toledo, OH 43623-4299
Phone 419-479-5535
gkern@xxxxxxxxxxxxxxxx

*****
This email message, including any attachments, is for the sole use of the
intended recipient(s) and may contain confidential and privileged
information. Any unauthorized review, use, disclosure or distribution is
prohibited. If you are not the intended recipient, please contact the
sender by reply email and destroy all copies of the original message.--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.