CurrentPennsylvania Insurance DepartmentPolicy 6

P3N Auditing Policy

Customize your policy alerts

Sign up for Pennsylvania Insurance Department Policy 6 alerts

Get alerted when Policy 6 changes without checking for updates manually.

Monitor payer policy activity

Receive email alerts as soon as relevant payer policies are published or updated.

Establishes auditing, logging, monitoring, and retention requirements for Certified Participants (CPs) and their Member Organizations (MOs) handling Protected Health Information (PHI) transmitted over the Pennsylvania Patient & Provider Network (P3N). Affects all CPs and strongly encourages other P3N participants to comply.

Policy Summary

PayerPennsylvania Insurance Department

PolicyP3N Auditing Policy

Policy CodePolicy Policy 6

Change TypeAdministrative update (no material coverage change)

Effective DateJan 1, 2026

Last ReviewJan 1, 2026

Next Review DateN/A

Key ActionCPs must retain audit files for seven (7) years and monitor access to PHI, notifying PA eHealth of any unauthorized access.

SourceLink

POLICY UPDATE CHANGES

No material clinical or coverage changes in this revision.

7 yearsrequired audit file retention period

biennialaudit frequency

All CPsapplicability

Jan 1, 2026effective

Audit and Logging Requirements

Audit and Audit Log Requirements

Audit log content, maintenance, review, retention, and patient accounting requirements for Certified Participants (CPs) and their Member Organizations (MOs).

All transactions made by the CP and its MOs shall be identified by a unique record key or number contained within an audit log.

Login/logout events must be recorded for CPs and their MOs, including: User Identification (unique Authorized User ID) and Date and System Time (exact date/time of access and exit). Access Device and User Role are optional fields.

Audit files shall include entries at the time events occur related to PHI such as Create, Modify, View, and Delete.

Where technically feasible, audit file entries triggered by events related to PHI shall include: User Identification; Date and System Time; Patient Identification; Access Device (optional); Type of Action; Identification or category of Patient Data Accessed; Source of Access (optional unless combined trails); and User's Role (optional).

CPs shall monitor access to and use of PHI obtained through the P3N (directly or through MOs) to detect unauthorized access or use, notify PA eHealth of any unauthorized access or use, and maintain policies and procedures for addressing such events; CPs and their MOs shall review audit logs.

Audit files and audit trails must be created automatically without manual intervention, be restricted to authorized personnel, and CPs/MOs shall not allow modification of audit files.

CPs and MOs will retain audit files for a period of seven (7) years.

PA eHealth shall audit a CP no more frequently than biennially unless a security breach exposing patient PHI warrants investigation.

When conducting audits, PA eHealth will attempt to limit requests to audit files/trails containing PHI that traveled over the P3N; if a CP cannot identify such PHI, PA eHealth may request broader audit files or audit trails of systems that might contain PHI that traveled over the P3N.

CPs shall adhere to 45 C.F.R. §164.528 regarding patient access, correction, amendment, and accounting of disclosures, shall advise their MOs of these obligations, and shall refer patient requests to the appropriate CP or MO Privacy Office.

PA eHealth may contract certified third-party auditors to conduct random or scheduled external audits; on-site audits will be scheduled to minimize impact.

This policy applies to all Certified Participants; other P3N participants are strongly encouraged to adhere. The policy does not address subsequent access after PHI has been acquired and incorporated into an MO's records; ongoing accounting after incorporation is the MO's responsibility.

Audit Authority and Requests

Prior Authorization

PA eHealth audit authority

PA eHealth may conduct random and scheduled audits of P3N usage and security and may contract certified third‑party auditors to perform random or scheduled external audits; any on-site audits will be scheduled so as not to negatively impact the Certified Participant.

PA eHealth may conduct random and scheduled Audits of P3N Usage.
PA eHealth may contract certified third‑party auditors to conduct random or scheduled external audits.
On‑site audits will be scheduled to minimize impact on the CP.

Documentation Required

Scope of audit requests

PA eHealth will try to limit audit requests to Audit Files and Audit Trails containing PHI that traveled over the P3N, but if a CP cannot identify what PHI traveled via the P3N, PA eHealth may request broader audit files or audit trails of systems that might contain such PHI.

Requests will be limited to audit files/trails containing PHI that traveled over the P3N when possible.
If the CP cannot identify which PHI traveled via the P3N, PA eHealth may request broader audit trails or systems that might contain that PHI.

Key Terms

inv-04: Certified Participant (CP) — definition of Certified Participants to which this document applies.

DefinitionCertified Participants (CPs): entities to which this auditing policy applies; CPs are responsible for implementing and maintaining required audit logs and related procedures.

ApplicabilityApplies to all Certified Participants; other P3N participants are strongly encouraged to adhere.

Audit ObligationsCPs must record and retain audit logs for transactions made by the CP and its Member Organizations, and must monitor access and use of PHI obtained through the P3N.

Audit Review & NotificationCPs shall review audit logs, maintain policies/procedures to address unauthorized access or use, and notify PA eHealth of any unauthorized Access or Use.

Retention & FrequencySubject to policy retention and audit frequency rules (see policy: retention of audit files for seven years and PA eHealth audit frequency up to biennial).

inv-05: Member Organization (MO) — definition of Member Organizations whose actions and logging obligations CPs must obligate.

DefinitionMember Organization (MO): an organizational participant whose actions and logging obligations CPs must obligate as a condition of participation.

Logging RequirementCPs shall obligate their MOs to record user identification and exact date/time of access and exit for log on/off events (access device and user role optional).

Audit File EntriesMOs must generate audit file entries at the time events occur related to PHI such as Create, Modify, View, and Delete; entries should include user ID and date/time and, where feasible, patient identification and action type.

Review & PoliciesCP and its MOs shall review audit logs and maintain policies and procedures for addressing unauthorized Access or Use.

inv-06: PHI over P3N — definition clarifying that Protected Health Information transmitted over the P3N is within scope.

Scope DefinitionProtected Health Information (PHI) that travels over the Pennsylvania Patient & Provider Network (P3N) is within the scope of this policy.

LimitationThis policy does not address access subsequent to PHI being acquired through the P3N and incorporated into an MO's records; subsequent accounting and access controls are the MO's responsibility.

Audit ScopePA eHealth will, when possible, limit audit requests to audit files/trails containing PHI that traveled over the P3N; if CP cannot identify such PHI, broader trails may be requested.

Policy Summary

PayerPennsylvania Insurance Department

PolicyP3N Auditing Policy

Policy CodePolicy Policy 6

Change TypeAdministrative update (no material coverage change)

Effective DateJan 1, 2026

Last ReviewJan 1, 2026

Next Review DateN/A

Key ActionCPs must retain audit files for seven (7) years and monitor access to PHI, notifying PA eHealth of any unauthorized access.

SourceLink

On This Page

OpenPayer is powered by Trek Health's payer performance platform. Trek continuously ingests, validates, and normalizes Transparency in Coverage data alongside payer policies and other commercial payer data to create a structured payer intelligence foundation. OpenPayer uses this foundation to deliver personalized search results, dynamically generated policy pages, and tailored policy monitoring based on each user's payers, specialties, billing codes, and areas of interest. The same intelligence powers broader payer performance workflows, including reimbursement benchmarking, contract evaluation, payer negotiations, and financial decision-making.

P3N Auditing Policy

Customize your policy alerts

Sign up for Pennsylvania Insurance Department Policy 6 alerts

Get alerted when Policy 6 changes without checking for updates manually.

Monitor payer policy activity

Receive email alerts as soon as relevant payer policies are published or updated.

Audit and Logging Requirements

Audit and Audit Log Requirements

Audit log content, maintenance, review, retention, and patient accounting requirements for Certified Participants (CPs) and their Member Organizations (MOs).

All transactions made by the CP and its MOs shall be identified by a unique record key or number contained within an audit log.

Audit files shall include entries at the time events occur related to PHI such as Create, Modify, View, and Delete.

Audit files and audit trails must be created automatically without manual intervention, be restricted to authorized personnel, and CPs/MOs shall not allow modification of audit files.

CPs and MOs will retain audit files for a period of seven (7) years.

PA eHealth shall audit a CP no more frequently than biennially unless a security breach exposing patient PHI warrants investigation.

PA eHealth may contract certified third-party auditors to conduct random or scheduled external audits; on-site audits will be scheduled to minimize impact.

Audit Authority and Requests

Prior Authorization

PA eHealth audit authority

PA eHealth may conduct random and scheduled Audits of P3N Usage.
PA eHealth may contract certified third‑party auditors to conduct random or scheduled external audits.
On‑site audits will be scheduled to minimize impact on the CP.

Documentation Required

Scope of audit requests

Requests will be limited to audit files/trails containing PHI that traveled over the P3N when possible.
If the CP cannot identify which PHI traveled via the P3N, PA eHealth may request broader audit trails or systems that might contain that PHI.