Hi Jennifer,
A patient requested access to the audit access logs for everyone who had access to their chart. Am I required to provide those?
Thanks,
Dr. N
Answer:
While patients have the right to access their medical records, including information about who has accessed them, there are exceptions. The critical consideration here is whether the audit logs are part of the patient's designated record set (DRS).
See https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/index.html
The DRS typically includes medical and billing records used to make decisions about the patient's care. Audit logs are not used to make decisions about patient care, and, therefore, you would not have to provide. Be aware that a patient asking for an access log clearly has a concern, and may be motivated to make a complaint to the Office for Civil Rights for a HIPAA related offense. Should that happen, the Office for Civil Rights will likely investigate and request access to all of your policies and procedures related to access rights. Be ready to provide! If you aren't ready to provide and require assistance, let us know.
