Standard 5.6: Record Storage, Security, & Retrieval

Whether records are on paper or electronic, there are various safeguards and measures to maintain the security and integrity of personal health information, including:

Physical safeguards

• Securing paper records and electronic devices in locked spaces
• Ensuring screens displaying personal health information are not viewable by individuals without authorization
• Securely disposing paper files, e.g., micro-cut shredding

Electronic safeguards

• Firewalls, encryption, virus protection, system security updates
• User ID and password protection
• Automated backups at reasonable intervals, recovery tests
• Record integrity and audit capability to capture:
  • Date, time, and author of each entry, including changes that preserve the original entry
  • Who has viewed the record, and when
  • Log of data exports and exchanges with other systems
• Alternate record-keeping method in case of system failure

• Secure deletion of client records once retention period has ended

Administrative safeguards

• Need-to-know access
• Confidentiality agreements with anyone who can view personal health information
• Privacy training
• Log to track when files are to be disposed

Registrants also make reasonable efforts to maintain the security of client records during transmission or disclosure (for example, by using mail or courier with tracking or encrypted electronic transmission).

Registrants need to ensure that any electronic record-keeping system they use allows them to meet their record-keeping obligations. These obligations include, but are not limited to, the ability to retrieve, transfer, amend,[1] and securely destroy records.

[1] The system must also maintain the original entry.