HIPAA audit controls, under 45 CFR 164.312(b), require hardware, software or procedural mechanisms that record and examine activity in information systems that contain or use ePHI. The rule does not list log fields or retention periods. You choose them based on risk, then show that someone actually looks at the records.
Record and examine are two verbs
The standard says record and examine. Many teams do the first and skip the second. A related administrative requirement, the information system activity review in 164.308(a)(1)(ii)(D), asks you to regularly review records such as audit logs, access reports and security incident tracking reports. Together they mean logs are only worth keeping if someone reads them.
A practical list of events to record
The regulation does not name fields, so treat this as a sensible starting point, not a rule.
- Successful and failed logins, and logouts.
- Who opened, changed, exported, printed or deleted a patient record, and when.
- Access outside normal duties, including break-glass use.
- Changes to user accounts, roles and permissions.
- Administrative actions on the system itself, such as configuration changes and log settings.
- API calls that read or write patient data, with the calling client and the resource type.
- Bulk exports and reports that return many records.
Keep PHI out of the logs themselves
Logs about ePHI can become ePHI. Patient names in URLs, request bodies in debug logs and search terms are common leaks. Record a record identifier and an actor, not the clinical content. Restrict who can read the logs, and protect them from edits.
Examine: make review small and regular
A weekly review of a few high value reports is better than a quarterly plan nobody follows. Try:
- Accounts that viewed an unusual number of records.
- Access to records of staff, VIPs or known contacts.
- Failed login spikes.
- Role and permission changes.
- Exports and downloads.
Write down who reviewed, when and what they found, including "nothing found." That note is your evidence.
Retention
The audit controls standard gives no log retention period. Set one based on risk and legal advice, write it down, and apply it consistently.
Safeguard's compliance and evidence automation can collect review artifacts alongside other control evidence. See also the HIPAA Security Rule for software teams.
Quick check
Does HIPAA say how long to keep audit logs?
Section 164.312(b) does not give a log retention period. Set one based on risk and legal advice, and document it.
Sources
Last reviewed: 19 October 2026.
