Source: https://www.healthit.gov/test-method/audit-reports
Timestamp: 2019-04-26 10:13:38+00:00

Document:
Step 2 for SUT and TLV were both clarified and changed to reflect that multiple audit reports can also be created to meet the criterion. The data references in the SUT column were also re-ordered to make the required data clearer.
Enable a user to create an audit report for a specific time period and to sort entries in the audit log according to each of the data specified in the standards in §170.210(e).
The audit log must record the information specified in sections 7.2 through 7.4, 7.6, and 7.7 of the standard specified in § 170.210(h) and changes to user privileges when health IT is in use.
The date and time must be recorded in accordance with the standard specified at § 170.210(g).
The audit log must record the information specified in sections 7.2 and 7.4 of the standard specified at § 170.210(h) when the audit log status is changed.
The date and time each action occurs in accordance with the standard specified at § 170.210(g).
(3) The audit log must record the information specified in sections 7.2 and 7.4 of the standard specified at § 170.210(h) when the encryption status of electronic health information locally stored by EHR technology on end-user devices is changed. The date and time each action occurs in accordance with the standard specified at § 170.210(g).
Updated to reflect this criterion is not eligible for gap certification per the 2015 Edition final rule correction notice.
Edited document to correctly reflect that the 2015 Edition “audit report(s)” certification criterion is revised as compared to the 2014 Edition “audit report(s)” criterion.
Added clarifications for the application of this criterion to relied upon software and HISPs. In addition, clarified the meaning of the term “user” and that either a single audit log or multiple audit logs may be used to meet the requirements of this criterion.
A user can create one or more audit reports for a specific time period that includes some or all of the data specified in sections 7.2, 7.3, 7.4, 7.6, and 7.7 of ASTM E1247-01; including changes to user privileges when health IT is in use; and record the date and time of the action in accordance with RFC 1305 or RFC 5905.
The content included in each audit log is sortable.
For the purposes of certification, a Health IT Module may produce a single audit report with all of the specified auditable data or it may produce multiple audit reports with some portion of the required auditable data. However, if this latter approach is used, when all of the audit reports are considered together the total content they include must represent all of the required auditable data (which would be equivalent to the single audit report approach).
Approach 1 requires disclosure of the software that was relied upon to meet the criterion.
Approach 2 requires documentation of how the external services that are necessary to meet the requirements of criteria will be deployed and used.
For HISP software that does not normally store patient data, certification to (d)(3) does not create the obligation to do so. Rather, certification to (d)(3) requires that a user is able to produce a forensic reconstruction of events in the case of a security incident. Audit reports would need to be generated that can sort and filter on the types of data identified in (d)(2).

References: §170
 § 170
 § 170
 § 170
 § 170
 § 170
 § 170