Series Title (Agency Series #): Description, Retention (Legal Citation)
HIPAA Policy and Procedure Records (DOH41-001): Series documents review, assessment, development, and authorization of department policies and procedures required to implement federal HIPAA law. Records include authorizing bulletins and advisories, notice of privacy practices, final policy statements and directives, and supporting documentation. Information often includes policy and procedure numbers, revision dates, subject identification, narrative description, authorization information, and effective date.
Retention: Retain 20 years after superseded. (MOAR 166-103-0005(24))
HIPAA Training Program Records (DOH41-002(a) and DOH41-002(b)): Records related to the design and implementation of HIPAA training programs provided to employees by the department. Includes both training programs provided by department staff and training provided through the county's online HIPAA training system. May include class descriptions, instructor certifications, planning documentation, instructional material, course outlines, class enrollment and attendance records, and related significant records.
Retention: DOH41-002(a) Individual attendance and training completion records: retain 6 years; DOH41-002(b) Course and instructor records: retain 5 years. (45 CFR 164.503(j); OAR 166-103-0040(22))