Documentation recording disclosures of PHI (PHI Disclosure Tracking Log) should be retained for a period of six years. Records involved in any open investigation, audit or litigation should not be destroyed/disposed of. If notification is received that any of the above situations have occurred or there is the potential for such, the record retentions shall be suspended for these records until such time as the situation has been resolved. Divisions with federal regulations that supercede HIPAA should include retention information in their divisional procedures.
Destruction/disposal of protected health information will be carried out in accordance with federal and state law and divisional policies. This may include any record of client health information, regardless of medium or characteristic that can be retrieved at any time. This includes all original client records, documents, papers, letters, billing statements, x-rays, films, cards, photographs, sound and video recordings, microfilm, magnetic tape, electronic media, and other information recording media, regardless of physical form or characteristic, that are generated and/or received in connection with transacting client care or business.
Records scheduled for destruction/disposal should be secured against unauthorized or inappropriate access until the destruction/disposal of client health information is complete. A contract between DSS and a business associate should provide that, upon termination of the contract, the business associate will return or destroy/dispose of all patient health information. If such return or destruction/disposal is not feasible, the contract must limit the use and disclosure of the information to the purposes that prevent its return or destruction/disposal.
Health information media should be destroyed/disposed of using a method that ensures the health information cannot be recovered or reconstructed. Appropriate methods for destroying/disposing of media are outlined in Appendix N.