Integrity, decided and documented

Integrity is the standard almost everyone skips, because nothing announces the failure. There is no locked door left open and no missing encryption. There is just a record nobody can vouch for.

The policy is composed from your clinic’s facts

Your integrity policy is generated against your recorded clinic facts. It covers protecting records from improper alteration or destruction, the required standard alongside the one addressable mechanism with your recorded decision rendered in, and the workflow that separates a legitimate correction from tampering: finalize the record, keep the prior content, capture who changed it and why.

It also covers per-system integrity controls, vendor evidence refreshed yearly, annual backup integrity checks, and what happens when a record looks altered. Conditional clauses handle paper records, AI-drafted content that is not final until a clinician signs off, and session recordings.

What gets tracked after the policy exists

Seven requirements, each holding or not:

• The policy is active and reviewed within the last twelve months.
• Every vendor recorded as touching PHI has a current integrity attestation on file.
• The platform’s own PHI integrity mechanism is attested.
• Your decision on the addressable specification is finalized and recorded.
• The policy is adopted, and its facts have not drifted.

What this is, and what it is not

The system tracks whether the integrity decision was made and recorded, and whether your vendors attested to their own controls. It does not checksum records, test version history, or restore a backup to see whether it works. Those are things you and your vendors do, and the system’s role is to make sure the decisions exist, are current, and can be produced.

The failure this addresses is not a clinic with weak integrity controls. It is a clinic that has never considered this standard at all, which is most of them.

What an investigator gets

A dated, adopted policy describing your correction workflow. Vendor integrity attestations on file. A recorded addressable decision with reasoning. For the standard nobody assesses, a documented answer.