{"id":"hosp-08-records-and-audit-response","version":"2026-10-06","stamp":"Template. Written against the public text of the standard cited; the organization adopts, edits and owns it as its protocol. Every threshold, identity, hold or disclosure decision belongs to the organization. We report the findings against the protocol — counts, dates, states — nothing more. Not legal advice, not a compliance determination, not a consumer report.","title":"Screening records — retention, integrity and producing evidence for a surveyor, auditor or investigator","org":"Any organization keeping screening records","owner_role":"Compliance Officer (owner); Health Information Management / Records (custodian); IT (systems)","scope":"All screening receipts, roster files, review logs, decisions and measures produced under HOSP-01 through HOSP-07.","frequency":"Retention continuous; integrity check and producibility drill quarterly.","procedure":["Set the retention period here, with counsel: ___ years (the FCA limitations period of up to 10 years and 2 CFR 200.334 are the usual anchors). Records of what a file printed are retained and never edited; a wrong record is marked superseded with a note, not deleted.","Each receipt carries a SHA-256; keep the hash with the record. Where the issuer anchors daily hashes to a public timestamp, keep the proof reference — it shows the record existed by that date without relying on the issuer.","Quarterly integrity check: sample ___ receipts across months; recompute or verify each hash against the issuer's public verify route; record pass/fail. Any failure is an incident.","Quarterly producibility drill: a person not on the compliance team picks a name and a month; time how long it takes to produce the dated record, the review log and the decision. Record the minutes.","On a survey, audit or investigation request: produce the records as kept, with the hash and proof reference; if a declaration of the record-keeping process is needed, use the issuer's system declaration (FRE 902(13)) plus your own custodian statement.","Never alter a record to fit a request; if a record is wrong, the correction is a new record that cites the old one."],"not_decided":"Privilege, scope of production, and the legal retention period — counsel's. The template describes how to keep records so they are producible and provably unaltered.","changes":[["2026-10-06","First issue."]],"standards":[{"standard":"OIG General Compliance Program Guidance — documentation of the compliance program's operation","url":"https://oig.hhs.gov/compliance/general-compliance-program-guidance/"},{"standard":"False Claims Act statute of limitations — up to 10 years (31 U.S.C. 3731(b)); informs retention","url":"https://www.law.cornell.edu/uscode/text/31/3731"},{"standard":"2 CFR 200.334 — record retention for federal awards (3 years from final report, longer if audit or litigation)","url":"https://www.ecfr.gov/current/title-2/subtitle-A/chapter-II/part-200/section-200.334"},{"standard":"Federal Rules of Evidence 902(13)/(14) — certified records of a process; hash-verified copies","url":"https://www.law.cornell.edu/rules/fre/rule_902"}],"measures":[{"measure":"Hash verification pass rate","computed_as":"sampled receipts whose hash verifies ÷ sampled","data_source":"verify route results","threshold":"set by your protocol; the finding is the number"},{"measure":"Producibility","computed_as":"minutes to produce a sampled month's record, log and decision","data_source":"quarterly drill","threshold":"set by your protocol; the finding is the number"},{"measure":"Retention compliance","computed_as":"records inside the retention period still retrievable ÷ sampled","data_source":"drill","threshold":"set by your protocol; the finding is the number"},{"measure":"Unedited records","computed_as":"records found altered after creation","data_source":"integrity check","threshold":"set by your protocol; the finding is the number"}],"records":[{"record":"Retention schedule and its notations","kept_by":"Compliance Officer","retention":"indefinite"},{"record":"Integrity check and drill results","kept_by":"Compliance","retention":"per schedule"},{"record":"Request-response log (who asked, what was produced, when)","kept_by":"Compliance","retention":"per schedule"}]}