System Logging The system must maintain an automated audit trail which can 20 identify the user or system process which initiates a request for PHI COUNTY discloses to 21 CONTRACTOR or CONTRACTOR creates, receives, maintains, or transmits on behalf of COUNTY, 22 or which alters such PHI. The audit trail must be date and time stamped, must log both successful and 23 failed accesses, must be read only, and must be restricted to authorized users. If such PHI is stored in a 24 database, database logging functionality must be enabled. Audit trail data must be archived for at least 3 25 years after occurrence.
System Timeout The system providing access to PHI COUNTY discloses to 11 CONTRACTOR or CONTRACTOR creates, receives, maintains, or transmits on behalf of COUNTY 12 must provide an automatic timeout, requiring re-authentication of the user session after no more than 13 twenty (20) minutes of inactivity.
