Re: Tape backup strategy and HIPAA Security Rule

Al,

This log gives me the capability to determine who accessed a specific 
patient record, and when and how (which program was used) to access it. 
This, to my understanding, is where the six year retention applies.

For example, two years from now, under litigation, we could be requested 
to identify all access to a patient's records during a specific time 
frame. Using this log file I can query it and determine who, what, when, 
how etc.

As for logging to the journal, that is the documentation aspect of this 
evil law, which says we must regularly document our review IS activities 
in terms of logins, file access, access level modifications and security 
incidents. 

Regards, Jerry

Gerald Kern
IBM Certified AS/400 RPG IV Developer & RPG IV Programmer
MIS Project Leader, Lotus Notes/Domino Administrator
The Toledo Clinic, Inc.
4235 Secor Road
Toledo, OH 43623-4299
Phone 419-479-5535
gkern@xxxxxxxxxxxxxxxx

*****
This email message, including any attachments, is for the sole use of the 
intended recipient(s) and may contain confidential and privileged information. 
Any unauthorized review, use, disclosure or distribution is prohibited. If you 
are not the intended recipient, please contact the sender by reply email and 
destroy all copies of the original message.