HIPAA requires two linked things: audit controls that record and examine activity in systems that contain or use ePHI, and a regular review of those records. The first is a technical standard in 164.312(b). The second is a required administrative step in 164.308(a)(1)(ii)(D). Logging without review does not meet the intent.
The two clauses
Section 164.312(b) says to implement hardware, software or procedural mechanisms that record and examine activity in information systems that contain or use ePHI. It does not list events or a retention period.
Section 164.308(a)(1)(ii)(D), under the security management process, requires procedures to regularly review records of information system activity, such as audit logs, access reports and security incident tracking reports. This is a required specification.
The rule is silent on exact fields, so your risk analysis decides scope. That freedom is also the trap: you have to be able to explain your choices.
What to log for ePHI systems
A defensible baseline for an application that handles ePHI:
- Authentication events, including failures, lockouts and privilege changes.
- Record level access: who viewed, created, changed or exported which patient record, and when.
- Administrative actions, such as role changes and configuration edits.
- Bulk exports and report runs.
- Break glass or emergency access use.
- Access by support or operations staff to production data.
Keep the PHI itself out of log lines. Record identifiers and event types, not the content of the record.
Making review real
Regularly is not defined, so set a cadence that fits risk and write it down. Then make the review produce evidence:
- Define what you look for. Examples: access to records of employees or VIPs, off hours bulk exports, many failed logins, access from new locations.
- Automate alerts for the clear cases, and sample the rest manually.
- Record each review: date, reviewer, scope, findings and follow up.
- Route findings to the incident process under the security incident procedures standard.
- Protect the logs. Integrity matters, since altered logs are worthless. The integrity standard in 164.312(c) asks for policies to protect ePHI from improper alteration, and that logic applies to your evidence too.
Retention
HIPAA sets no specific log retention period in the Security Rule text. It does require documentation of policies, actions and assessments to be kept for six years. Many teams therefore keep security review records for six years and set raw log retention by risk and cost. Confirm the choice with your compliance lead, and see documentation retention.
Why this matters during a breach
If PHI may have been accessed, the risk assessment has to examine whether it was actually acquired or viewed. Record level access logs are often the only way to answer that. See breach notification deadlines.
Quick check
Does HIPAA say how long to keep audit logs?
No fixed log retention period appears in the Security Rule text. The six year rule applies to required documentation, so decide and document your own period.
Is an automated alert enough for the review requirement?
It helps, but the rule asks for procedures to regularly review activity records. Keep a record that people reviewed the output and acted on findings.
Sources
- 45 CFR 164.312, technical safeguards
- 45 CFR 164.308, administrative safeguards
- 45 CFR 164.316, documentation requirements
- 45 CFR 164.402, breach definition and risk assessment factors
Last reviewed: 19 October 2026.
