What decisions have you made on the role of computer logs in compliance 
with regulations dealing with records retention and privacy like SOX, 
GLBA,and HIPAA that don't specifically name computer logs? For example, 
the HIPAA documentation standard requires entities to: 

?(i) Maintain the policies and procedures implemented to comply with this 
subpart in written (which may be electronic) form; and (ii) if an action, 
activity or assessment is required by this subpart to be documented, 
maintain a written (which may be electronic) record of the action, 
activity, or assessment.? 
?Retain the documentation required by paragraph (b)(1) of this section for

6 years from the date of its creation or the date when it last was in 
effect, whichever is later.? 

Logs are not specifically mentioned here. And some types of computer logs 
might be just too voluminous to keep for that period of time. But have you

included the original logs, or maybe just the log analysis data, in the 
retention requirements for these regs? 

Thanks,
Gary Link
Pittsburgh, PA
[log in to unmask]



The contents of this email are the property of PNC. If it was not addressed to you, you have no legal right to read it. If you think you received it in error, please notify the sender. Do not forward or copy without permission of the sender. This message may be considered a commercial electronic message under Canadian law or this message may contain an advertisement of a product or service and thus may constitute a commercial electronic mail message under US law. You may unsubscribe at any time from receiving commercial electronic messages from PNC at http://pages.e.pnc.com/globalunsub/
PNC, 249 Fifth Avenue, Pittsburgh, PA 15222; pnc.com



List archives at http://lists.ufl.edu/archives/recmgmt-l.html
Contact [log in to unmask] for assistance
To unsubscribe from this list, click the below link. If not already present, place UNSUBSCRIBE RECMGMT-L or UNSUB RECMGMT-L in the body of the message.
mailto:[log in to unmask]