Law / United States / 
New Hampshire
Medical records: patient report of access from the audit trail and audit logs of the health information organization
RSA 332-I:2, I(g); 332-I:3, III
In force.
A data subject rights rule binding public and private bodies.
- Obligation class
- Governance, Data subject rights
- Audit expectation
- none
As of .
What it requires
- If you are the health information organization, maintain an audit log of the transactions transmitted through it (RSA 332-I:3, III).
- If you transmit or receive protected health information through the health information organization, maintain audit logs in accordance with nationally accepted interoperability standards, practices, regulations and statutes, including the identity of the health care provider accessing the information, the identity of the individual whose information was accessed, the date of access and the area of the record that was accessed (RSA 332-I:3, III).
- If you are a health care provider that maintains an individual's medical record in electronic form, give the individual, on request, a report of access to the record by a provider the individual names within an identified period in the prior 3 years, based on whatever audit trail you maintain (RSA 332-I:2, I(g)).
These lines are LexLint's reading of the law's text, as of .
What it makes you log
Who may demand the log
Data subject
What the log must hold
Actor identity, Affected person reference, Event time, Access record
Logging duty
RSA 332-I:3, III requires the health information organization to maintain an audit log of the transactions it transmits, and requires the parties transmitting or receiving information through it to maintain audit logs, including the provider's identity, the individual's identity, the date of access and the area of the record accessed. RSA 332-I:2, I(g) gives an individual whose record is kept in electronic form a report of a named provider's access within an identified period in the prior 3 years, drawn from whatever audit trail is then maintained; the paragraph does not itself require a provider to keep a trail, and the report says whether the named provider had access, did not, or whether access could not be determined from the available data. The chapter's definition of an audit trail in RSA 332-I:1, a chronological record of who accessed an electronic medical record, when, and the area accessed if known, sits in a section this row does not cite. Neither paragraph sets a retention period or names a regulator who may demand the log. Facilities subject to RSA 151:21 and 151:21-b are exempt from paragraph I of RSA 332-I:2. The cited paragraphs state no territorial reach, so no hook is taken.
- Kind
- Explicit
- As of
- Provision
- RSA 332-I:3, III (audit log of health information exchange transactions) and RSA 332-I:2, I(g) (report of access from the audit trail)
- Trigger
- personal_data_processing
What this law does
When an individual's medical record is maintained in electronic form, the individual has the right to a report, based on whatever audit trail of that record is then maintained, of access to the record by a health care provider the individual names within an identified period in the prior 3 years.
The health information organization must maintain an audit log of the transactions transmitted through it, and the parties transmitting or receiving information through it must maintain audit logs in accordance with nationally accepted interoperability standards, including the identity of the health care provider accessing the information, the identity of the individual whose protected health information was accessed, the date of access and the area of the record accessed.
When LexLint raises it
When your app profile says your app handles health records.