⚕ HIPAA 101

• Privacy Rule
• Security Rule
• Transactions Rule
• Identifiers Rule
• Enforcement Rule
• Breach Notification Rule
• Final Omnibus Rule

• Training Software
• Risk Management Software
• Data Security Software
• EHR Software

• HIPAA PHI Lifecycle
• HIPAA Hosting
• HIPAA State Laws
• HIPAA Glossary

HIPAA vs State Medical Record Laws

Medical Record Access Period

Federal HIPAA law mandates a maximum 30-day period for accessing medical records. Once a patient requests their medical record, the healthcare provider has 30 days to furnish it. Some states however have laws that are stronger - that is, the time period is shorter than 30 days. Other states have a longer time period so are weaker and federal HIPAA law prevails. Yet other states have no specific law for this access period - in this case federal HIPAA law of 30 days prevails. Certain states have laws that govern only specific entities, in which case federal HIPAA applies to covered entities (CAs). The following chart shows where each state stands compared to HIPAA.

• State = less than 30 days, state law applies (state tronger than federal)
• HIPAA = equal to or greater than 30 days, HIPAA law applies
• Split = HIPAA applies to covered entities, state law applies for entities not covered under HIPAA

Medical Record Retention Period

HIPAA federal law doesn't specify a minimum rention period for medical records, so state law dictates this for patient medical records (EMR/EHR). Although there are no HIPAA retention requirements for medical records, there is a requirement covering how long other ePHI documents must be retained. The documents must be retained for a minimum of six years from when the document was either created or last updated (like a privacy notice):

• Privacy Policies
• PHI Access Logs
• Business Associate Agreements
• Authorizations for PHI Access
• Risk Assessments and Risk Analyses
• Disaster Recovery and Contingency Plans
• Information Security Policies
• Employee Sanction Policies
• Incident and Breach Notification Documentation
• Complaint and Resolution Documentation
• Physical Security Maintenance Records
• IT Security System Reviews