Registers and logs appendix
Granite City Family Dental — Binder edition 2026 — Policy set version 1.0 — Generated October 23, 2026
Authority: 45 CFR 164.316(b) (documentation; retain six years); 164.530(j). Each register below cites the standard that requires it.
This appendix gathers every register in the binder in one place so the practice can print it, keep it current by hand between editions, and hand it to an investigator. The same tables appear in their home documents. Where a register is empty, three blank rows are printed. The second half of the appendix holds blank forms for the logs the wizard does not collect; print and file them behind this page as they are used.
Part A — Registers kept in the wizard
A1. Workforce training roster
Authority: 45 CFR 164.530(b)(2); 164.308(a)(5). Home: document 12. Tracked by Janelle Okafor.
| Name | Role | Hire date | Privacy training date | Security awareness date | Course / module | Acknowledgment signed? |
|---|---|---|---|---|---|---|
| Dr. Maria Lindqvist | Dentist | 2012-06-01 | 2026-10-14 | 2026-10-14 | CRU HIPAA Awareness 2026 | Yes |
| Janelle Okafor | Office Manager | 2018-02-12 | 2026-10-14 | 2026-10-14 | CRU HIPAA Awareness 2026 | Yes |
| Tom Reyes | Hygienist | 2026-09-08 | No |
A2. User access list
Authority: 45 CFR 164.308(a)(3)-(4); 164.312(a)(2)(i). Home: document 14. Reviewed quarterly.
| System | User | Role / permission | MFA on? | Last reviewed |
|---|---|---|---|---|
| Open Dental | mlindqvist | Provider / admin | No | 2026-10-01 |
| Open Dental | jokafor | Front office | No | 2026-10-01 |
| Microsoft 365 | janelle@ | User | Yes | 2026-10-01 |
A3. Departures log — 2026
Authority: 45 CFR 164.308(a)(3)(ii)(C). Home: document 14.
| Name | Last day | Accounts disabled same day? | Property returned? | Completed by |
|---|---|---|---|---|
A4. ePHI inventory
Authority: 45 CFR 164.308(a)(1)(ii)(A) (scope of the risk analysis). Home: document 13.
| System / asset | Kind | Location / vendor | Responsible person | Encrypted? | Backed up? |
|---|---|---|---|---|---|
| Open Dental database server | Server in office | Locked closet, main office | Dr. Lindqvist | No | Yes |
| Front desk and operatory workstations (7) | Workstations | Main office | Janelle Okafor | Yes | No |
| Microsoft 365 email | Microsoft cloud | Janelle Okafor | Yes | Vendor-managed | |
| Digital x-ray sensors and imaging PC | Medical device / imaging | Operatories | Dr. Lindqvist | No | Yes |
| Paper charts pre-2019 | Paper records | Records room | Janelle Okafor | Unknown | No |
A5. Device inventory
Authority: 45 CFR 164.310(d)(2)(iii). Home: document 20. Reconciled annually.
| Type | Make / model | Serial / asset tag | Assigned to | Location | Encrypted? | Holds ePHI? | Status |
|---|---|---|---|---|---|---|---|
| Server | Dell PowerEdge T350 | GCFD-SRV1 | Open Dental | Server closet | No | Yes | In service |
| Desktop | Dell OptiPlex 7010 SFF | GCFD-FD1 | Front desk 1 | Reception | Yes | Yes | In service |
| Desktop | Dell OptiPlex 7010 SFF | GCFD-OP1 | Operatory 1 | Op 1 | Yes | Yes | In service |
| Printer / MFP | Brother MFC-L6900DW | GCFD-MFP1 | Shared | Back office | N/A | Yes | In service |
A6. Disposal log
Authority: 45 CFR 164.310(d)(2)(i). Home: document 20. Method: NIST 800-88 purge by IT provider with record; vendor: CRU Technologies.
| Date | Device / serial | Method | Certificate / record reference |
|---|---|---|---|
A7. Incident log — 2026
Authority: 45 CFR 164.308(a)(6)(ii); 164.414. Home: document 16. Never empty: enter "No incidents to date" if nothing has happened.
| Date | What happened | Systems / people involved | PHI involved? | Four-factor outcome | Notifications made / dates | Closed |
|---|---|---|---|---|---|---|
| 2026-10-20 | No incidents to date | No | N/A | 2026-10-20 |
A8. Contingency test log
Authority: 45 CFR 164.308(a)(7)(ii)(D). Home: document 17. Last restore test: October 18, 2026.
| Date | Type | Result | Findings / follow-up |
|---|---|---|---|
| 2026-10-18 | Restore test | Pass | 22-minute database restore |
A9. Business associate register
Authority: 45 CFR 164.504(e); 164.308(b); 164.314(a). Home: document 19. Reviewed annually by Janelle Okafor.
| Vendor | Service | PHI they handle | BAA | BAA date | Security contact | Last reviewed |
|---|---|---|---|---|---|---|
| Open Dental Software | EHR support and eFax | Full record | Signed | 2024-01-10 | [email protected] | 2026-10-20 |
| DentalXChange | Claims clearinghouse | Demographics, insurance, procedures | Not yet | |||
| CRU Technologies | IT support, backups, security | Incidental access to all systems | Signed | 2026-01-05 | [email protected] | 2026-10-20 |
| Shred-It | Document destruction | Paper PHI | Signed | 2023-05-02 | 2026-10-20 | |
| Microsoft | Microsoft 365 email | Email containing PHI | Signed | 2022-08-01 | Online services terms | 2026-10-20 |
A10. Patient request log
Authority: 45 CFR 164.524 (access), 164.526 (amendment), 164.528 (accounting), 164.522 (restrictions and confidential communications), 164.530(d) (complaints). Home: document 09. Processed by Janelle Okafor; target 10 days.
| Date received | Requester | Type | Date completed | Outcome / notes |
|---|---|---|---|---|
| 2026-09-03 | Patient (K. R.) | Access / copy | 2026-09-05 | PDF by secure email, no fee |
A11. Key, code and badge holders
Authority: 45 CFR 164.310(a)(2)(iii). Home: document 20.
| Name | Access (building, records room, server closet, alarm code) | Issued |
|---|---|---|
| Dr. Maria Lindqvist | Building, records room, server closet, alarm code | 2012-06-01 |
| Janelle Okafor | Building, records room, server closet, alarm code | 2018-02-12 |
| Cleaning service (Bright Clean LLC) | Building after hours; no records room or closet | 2024-03-01 |
A12. Risk register and risk management plan
Authority: 45 CFR 164.308(a)(1)(ii)(A)-(B). Home: document 13. Closed rows stay as proof of risk reduction. Residual risk accepted by Dr. Maria Lindqvist, Owner.
| Risk | Likelihood | Impact | Existing controls | Treatment | Planned action | Owner | Due | Status |
|---|---|---|---|---|---|---|---|---|
| Open Dental server drive is not encrypted; theft of the server exposes every chart | Low | High | Locked closet, alarm, cameras | Mitigate | Enable BitLocker on the server with recovery key escrowed by CRU | CRU Technologies | 2026-12-15 | In progress |
| Open Dental has no MFA; a stolen password gives full chart access | Medium | High | Unique logins, auto-logoff 10 min, on-premises only | Mitigate | Enable Open Dental two-factor for all users; restrict remote access to VPN with MFA | Janelle Okafor | 2026-12-31 | Open |
| Phishing of staff mailbox | High | Medium | M365 MFA, Defender, annual training | Mitigate | Add quarterly phishing simulations through CRU | Janelle Okafor | 2027-01-31 | Open |
| Clearinghouse BAA not on file | Medium | Medium | None | Mitigate | Obtain signed DentalXChange BAA and file it | Janelle Okafor | 2026-11-30 | Open |
| Backups not tested | Medium | High | CRU Backups nightly, immutable copy | Mitigate | Restore test performed 2026-10-18; schedule annually | CRU Technologies | 2026-10-18 | Closed |
A13. Compliance committee and locations (for reference)
Committee (45 CFR 164.308(a)(8)): Dr. Maria Lindqvist (Owner); Janelle Okafor (Privacy and Security Officer); CRU Technologies (IT provider).
| Site | Address | Hours | Workstations | Server closet locked? |
|---|---|---|---|---|
| Main office | 412 2nd Street South, St. Cloud, MN 56301 | Mon–Thu 7:30–5:00, Fri 7:30–12:00 | 7 | Yes |
Part B — Blank printable logs
Print as many copies as needed. Each page is dated and initialed by the person who keeps it. Completed pages are filed behind this appendix and kept six years.
B1. Sanction log
Authority: 45 CFR 164.308(a)(1)(ii)(C); 164.530(e)(2). Imposed by Privacy Officer with the owner's approval. Count is reported at the annual review.
| Date | Workforce member | Role | Policy violated | Tier (1-4) | Sanction imposed | Retraining date | Imposed by | Appeal / notes |
|---|---|---|---|---|---|---|---|---|
Reviewed at annual meeting by: ___________________________ Date: ______________
B2. Complaint log
Authority: 45 CFR 164.530(d)(2). Complaints received by Janelle Okafor; acknowledged within 5 days.
| Date received | Complainant (or anonymous) | How received | Summary of complaint | Date acknowledged | Investigation / findings | Resolution and date | OCR involved? | Handled by |
|---|---|---|---|---|---|---|---|---|
No retaliation against any person who complains (45 CFR 164.530(g)).
B3. Accounting of disclosures log
Authority: 45 CFR 164.528. One line per disclosure that must be accounted for (public health, oversight, law enforcement, subpoenas, abuse reports, research, coroners, and any disclosure not for treatment, payment, operations or made under an authorization). Location of record: Both. Retain six years.
| Date of disclosure | Patient name / ID | Recipient (name and address) | Description of PHI disclosed | Purpose or legal basis | Disclosed by |
|---|---|---|---|---|---|
B4. Notice of Privacy Practices acknowledgment — good-faith effort log
Authority: 45 CFR 164.520(c)(2)(ii). Use when a patient does not sign the acknowledgment (refused, emergency, left before signing). Method of recording signed acknowledgments: Paper signature at first visit.
| Date | Patient name / ID | Notice given? (Y/N) | Reason acknowledgment not obtained | Staff member | Follow-up at next visit |
|---|---|---|---|---|---|
B5. Information-system activity review log
Authority: 45 CFR 164.308(a)(1)(ii)(D); 164.312(b). Reviewer: CRU Technologies with Janelle Okafor; cadence monthly. Logs available: EHR access log, Email sign-in log (M365 / Google), Windows event logs, Firewall log and Backup job log.
| Date of review | Logs reviewed (EHR, email, Windows, firewall, backup, remote) | Period covered | Findings | Action taken / incident opened | Reviewer |
|---|---|---|---|---|---|
B6. Visitor log
Authority: 45 CFR 164.310(a)(2)(iii). Rule: Visitors sign in, wear a badge and are escorted beyond the waiting room. Vendors working on systems are supervised; after-hours vendors do not have access to records rooms or unlocked workstations.
| Date | Visitor name | Company | Purpose | Escorted by | Time in | Time out | Badge returned? |
|---|---|---|---|---|---|---|---|
B7. Facility maintenance log
Authority: 45 CFR 164.310(a)(2)(iv). Repairs and changes to doors, locks, alarms, cameras, the server or network closet, and anything else that affects physical security. After-hours vendors: Bright Clean LLC (cleaning, Tue/Fri evenings).
| Date | Location | What was repaired or changed | Vendor / person | Supervised by | Keys or codes changed? (Y/N) | Notes |
|---|---|---|---|---|---|---|
B8. Security reminders and tabletop record
Authority: 45 CFR 164.308(a)(5)(ii)(A); 164.308(a)(7)(ii)(D). Reminders quarterly; tabletop annually.
| Date | Type (reminder / tabletop / downtime drill) | Topic or scenario | Delivered by | Attendees or audience | Findings / follow-up |
|---|---|---|---|---|---|
B9. Emergency and break-glass access log
Authority: 45 CFR 164.312(a)(2)(ii). Procedure: document 21, section 1.
| Date and time | Account used | Used by | Reason | Systems or records reached | Credentials changed afterward? (Y/N) | Reviewed by / date |
|---|---|---|---|---|---|---|
Appendix compiled by Janelle Okafor on October 23, 2026. Signature: ___________________________