Screening records — retention, integrity and producing evidence for a surveyor, auditor or investigator

Template version 2026-10-06 · for: Any organization keeping screening records · owner role: Compliance Officer (owner); Health Information Management / Records (custodian); IT (systems) · adopted by organization effective date . Editable .txt · JSON

Template. Written against the public text of the standard cited; the organization adopts, edits and owns it as its protocol. Every threshold, identity, hold or disclosure decision belongs to the organization. We report the findings against the protocol — counts, dates, states — nothing more. Not legal advice, not a compliance determination, not a consumer report.

Standards served

OIG General Compliance Program Guidance — documentation of the compliance program's operation — https://oig.hhs.gov/compliance/general-compliance-program-guidance/
False Claims Act statute of limitations — up to 10 years (31 U.S.C. 3731(b)); informs retention — https://www.law.cornell.edu/uscode/text/31/3731
2 CFR 200.334 — record retention for federal awards (3 years from final report, longer if audit or litigation) — https://www.ecfr.gov/current/title-2/subtitle-A/chapter-II/part-200/section-200.334
Federal Rules of Evidence 902(13)/(14) — certified records of a process; hash-verified copies — https://www.law.cornell.edu/rules/fre/rule_902

Scope

All screening receipts, roster files, review logs, decisions and measures produced under HOSP-01 through HOSP-07.

Frequency

Retention continuous; integrity check and producibility drill quarterly.

Procedure

Set the retention period here, with counsel: ___ years (the FCA limitations period of up to 10 years and 2 CFR 200.334 are the usual anchors). Records of what a file printed are retained and never edited; a wrong record is marked superseded with a note, not deleted.
Each receipt carries a SHA-256; keep the hash with the record. Where the issuer anchors daily hashes to a public timestamp, keep the proof reference — it shows the record existed by that date without relying on the issuer.
Quarterly integrity check: sample ___ receipts across months; recompute or verify each hash against the issuer's public verify route; record pass/fail. Any failure is an incident.
Quarterly producibility drill: a person not on the compliance team picks a name and a month; time how long it takes to produce the dated record, the review log and the decision. Record the minutes.
On a survey, audit or investigation request: produce the records as kept, with the hash and proof reference; if a declaration of the record-keeping process is needed, use the issuer's system declaration (FRE 902(13)) plus your own custodian statement.
Never alter a record to fit a request; if a record is wrong, the correction is a new record that cites the old one.

Findings reported — computed from your own records; the threshold is your protocol's

Finding	Computed as	Data source	Threshold
Hash verification pass rate	sampled receipts whose hash verifies ÷ sampled	verify route results	your protocol
Producibility	minutes to produce a sampled month's record, log and decision	quarterly drill	your protocol
Retention compliance	records inside the retention period still retrievable ÷ sampled	drill	your protocol
Unedited records	records found altered after creation	integrity check	your protocol

Records

Record	Kept by	Retention
Retention schedule and its notations	Compliance Officer	indefinite
Integrity check and drill results	Compliance	per schedule
Request-response log (who asked, what was produced, when)	Compliance	per schedule

What this procedure does not decide

Privilege, scope of production, and the legal retention period — counsel's. The template describes how to keep records so they are producible and provably unaltered.

Change log

Date	Change
2026-10-06	First issue.
date	adopted / edited by name

Other templates: 01 · 02 · 03 · 05 · 06 · 07 · 09 · 10 · 01 · Duty Sheets (one page per rule, generated on any receipt) · our own procedures · 2026-10-25