Specifying that supervision documentation must be kept in the personnel files is prescriptive, potentially mingles consumer PHI increasing the risk of breaches, and is an undue administrative burden versus simply requiring that supervision be documented which is typically how this is worded in regs.