Skip to Main Content Skip to Footer Toggle Navigation Menu

14.20 Retention of PHI Documentation

14.20.1 POLICY STATEMENT

The Health Plan shall maintain all protected health information (PHI) documentation for a period of at least six (6) years from the date of its creation, or the date on which the document was last in effect, whichever is later.

14.20.2 POLICY INTERPRETATION AND IMPLEMENTATION

Retention of PHI DocumentsCertain documents classified as “privacy related documents” must be maintained for a period of at least six (6) years from the date of creation, or the date on which the document was last in effect, whichever is later:
  
Privacy Related Documents“Privacy related documents” include:Documentation that identifies the:Name, telephone number and address of the Health Plan’s HIPAA Privacy Officer;Name, title, telephone number and address of the individual responsible for receiving complaints;Name, title, telephone number and address of the individual responsible for obtaining and processing access, use, and disclosure of PHI requests;Name, title, telephone number and address of the individual responsible for receiving and processing amendment of PHI requests;Attempts to obtain consent when consent could not be obtained and the reason(s) why such consent could not be obtained;Method by which PHI will be de-identified;Sanctions imposed against Health Plan employees, business associates, or others who violate Health Plan policy/HIPAA regulations;All signed authorizations, consents, and agreed to restrictions;Copies of all notices of privacy practices (NPPs) including any revisions to such NPPs;Accounting of disclosures logs;Any privacy complaints received and their dispositions; andCopies of all HIPAA related policies and procedures.
  
Adding/Deleting DocumentationDocuments may be added or deleted from the above listing as may become necessary by law or as may be established by Health Plan practice or policy.
  
Identifying/Storage of PHI DocumentsThe HIPAA Privacy Officer is responsible for identification and storage of privacy related records, electronic files, etc., for purposes of complying with this policy.
  
Record RetentionA copy of all HIPAA covered information and any revisions shall be maintained for a period of at least six (6) years. Such retention may be in printed or electronic format, or both.
  
Privacy OfficerThe Privacy Officer is responsible for the development and implementation of the HIPAA policies and procedures. The Privacy Officer is also the contact person for any questions or complaints regarding HIPAA. Questions or concerns about HIPAA rights should be directed to the Privacy Officer during regular business office hours Monday through Friday, except holidays, at (651) 696-6280.
  
ViolationsViolations of this policy will be subject to discipline.