united-states health
Log Viewing Specific Patient PHI?
<p>Under the HIPAA and HITECH Regulations (US) is it required for a system to record an audit trail for every time a user accesses any PHI(Protected Health Information)?</p>

<p>As I understand it, an audit trail of user logins is required, as well as any time a user adds, edits, or deletes PHI. Does simply viewing / accessing PHI need to be logged as well?</p>

<p>Simply viewing must be logged.</p>

<p>45 CFR 170.210(b) <em>Record actions related to electronic health information. The date, time, patient identification, and user identification must be recorded when electronic health information is created, modified, <strong>accessed</strong>, or deleted; and an indication of which action(s) occurred and by whom must also be recorded.</em></p>
