Domain J: Documentation & Evidence Retention
Six-year retention and an evidence trail an auditor can actually follow.
Every item here is already part of the current, final HIPAA Security Rule. Items marked NPRM: would become Required are currently Addressable, OCR’s pending 2025 proposed rule would eliminate that flexibility and make them mandatory if finalized (not yet in effect).
All required policies and procedures reduced to writing
45 C.F.R. §164.316(a) · Source: www.ecfr.gov/current/title-45/section-164.316
All actions, activities, and assessments the rule requires to be documented, are in fact documented
45 C.F.R. §164.316(b)(1) · Source: www.ecfr.gov/current/title-45/section-164.316
Documentation retained six years from creation date or last-effective date, whichever is later
45 C.F.R. §164.316(b)(2)(i) · Source: www.ecfr.gov/current/title-45/section-164.316
Documentation periodically reviewed and updated for environmental or operational changes
45 C.F.R. §164.316(b)(2)(iii) · Source: www.ecfr.gov/current/title-45/section-164.316