Allen forgot he used to work at a Hospital that had to comply as well.
Les, I guess bottom line is that one would sort of need to interpret the law to some degree. I'm no lawyer by any means, but as I recall reading the law it did not specify down to that exact level so I'm thinking your auditor is trying to be tough in this area to satisfy his own policies either by himself or his Company.
If you're management can't or won't fight back on the issue then you don't really have much of a choice in the matter. I know though that from experience if you can't get the auditor to see things your way then I doubt your Management will fight the battle for you unless they can see in BLACK & WHITE the actual cost difference between doing it your way and the auditors way.