GMB Billing Firm maintains a comprehensive audit log of all platform coding events for HIPAA compliance, accountability, and PHI protection. This document describes what is logged, what is not logged, and how logs are used.
The Medical Coding Audit Log is a security and compliance control maintained by GMB Billing Firm under the HIPAA Security Rule's Audit Controls standard (45 CFR §164.312(b)). The audit log records activity on the GMB Billing Firm coding platform to:
GMB Billing Firm does not log, store, or retain any clinical content submitted by users. The audit log contains only event metadata — timestamps, event types, and detection results — never the actual text, codes, or documents.
| Data Type | Stored in Audit Log? | Reason |
|---|---|---|
| Clinical notes text | ❌ NOT stored | Patient privacy — no clinical content retained |
| Generated ICD-10/CPT codes | ❌ NOT stored | Coding output belongs to the provider |
| Claim data content | ❌ NOT stored | Billing data not retained beyond session |
| Appeal letter text | ❌ NOT stored | Provider-generated content not retained |
| Specific PHI values detected | ❌ NOT stored | PHI category logged (e.g., "SSN"), never the actual value |
| Uploaded file content | ❌ NOT stored | File content processed in-memory only |
| Patient identifiers | ❌ NOT stored | No patient data ever stored by platform |
| Full IP address | ❌ NOT stored | Only anonymized region (state level) recorded |
| Session timestamp | ✓ Stored | Required for HIPAA audit controls compliance |
| PHI detection event type | ✓ Stored | Compliance documentation for PHI incident review |
| De-ID confirmation | ✓ Stored | Liability protection — proof of user attestation |
| Code generation request | ✓ Stored | Audit trail for coding activity volume |
The following illustrates the format of audit log entries. All entries contain only metadata — no clinical content is ever included:
Note: categories=[DATE, MRN] records only the type of PHI detected — never the actual date or MRN value.
Audit logs are retained for a minimum of 6 years from the date of creation, consistent with the HIPAA documentation retention standard (45 CFR §164.530(j)(2)). After 6 years, logs are securely deleted using NIST 800-88 compliant data sanitization methods.
Access Controls: Audit logs are accessible only to authorized GMB Billing Firm compliance personnel and, upon valid legal request, to regulatory authorities (OCR, HHS). Covered Entities may request a summary of their organization's audit log data by contacting support@gmbcoding.com with their organization's domain information.
Log Integrity: Audit logs are stored in a write-once, append-only format with cryptographic hash chaining to prevent tampering. Log files are replicated across multiple secure locations and cannot be modified or deleted by any single user, including GMB Billing Firm administrators.
Security: All audit log data is encrypted at rest (AES-256) and in transit (TLS 1.3). Access to log systems requires multi-factor authentication and is restricted to authorized personnel only.
GMB Billing Firm will disclose audit log data to the HHS Office for Civil Rights (OCR) or other regulatory authorities when required by law, subpoena, or valid regulatory request. In the event of a HIPAA investigation, audit logs serve as documentation of the PHI detection system's operation and user acknowledgments.
The Medical Coding Audit Log serves as critical evidence in the event of a HIPAA investigation or OCR audit. Specifically, the audit log demonstrates:
The audit log will record any instance where a user overrides PHI warnings or bypasses the de-identification confirmation. These records establish that the user was informed of PHI detection and chose to proceed — shifting liability to the Covered Entity for any resulting HIPAA violation.
To request an audit log summary for your organization, report a potential PHI incident, or inquire about audit log policies, contact:
GMB Billing Firm Privacy & Compliance Office
📧 Privacy Inquiries: support@gmbcoding.com
📧 Legal & BAA: support@gmbcoding.com
🌐 Platform: gmbbillingfirm.com