HIPAA has no pass mark and no certificate, so there is nothing to "pass" and then coast. The Security Rule expects regular review of system activity, periodic evaluation when operations change, working safeguards and records kept for six years. Ongoing monitoring means you can show those things for any week a regulator or customer asks about.
What does the Security Rule say about ongoing work?
Section 164.308 requires, among administrative safeguards, procedures to regularly review records of information system activity, such as audit logs, access reports and security incident tracking reports. It also requires a periodic technical and non technical evaluation, based initially on the standards implemented and later in response to environmental or operational changes affecting the security of electronic protected health information.
Section 164.312 requires audit controls: hardware, software or procedural mechanisms that record and examine activity in systems containing or using that information. Section 164.316 requires retaining required documentation for six years from creation or from when it was last in effect, whichever is later.
The risk analysis is also not one and done. It is a required implementation specification, and the evaluation requirement ties updates to changes in your environment. Keep the risk analysis current whenever you add systems, vendors or locations.
The HHS website blocked automated access when we tried to fetch it on 18 October 2026, so the quoted regulation text comes from the Legal Information Institute copy. HHS guidance and enforcement priorities change, so check its site.
What should run on a schedule?
Weekly. Review audit log reports for access to systems with protected health information: failed logins, privileged use, bulk access, access outside working hours and access to records of colleagues or public figures. Record the reviewer, the date and what was investigated.
Monthly. Check joiners, movers and leavers against access, review open vulnerabilities and patch status on in scope systems, verify backup success, review open risk management actions.
Quarterly. Review access rights for every system holding protected health information, review business associate status and any vendor changes, and test one contingency element such as a restore.
Annually. Update the risk analysis, repeat the evaluation, retrain the workforce, review policies, rehearse a breach drill and confirm business associate agreements are in place.
On change. New system, new vendor, office move, acquisition or major release triggers a risk review before go live.
How do you show the review actually happened?
A log nobody reads fails the rule's intent. Keep short review notes with date, reviewer, scope, findings and follow up tickets. Even "no anomalies found in 4,200 events" is a record, as long as it is dated and attributable.
Keep an events and issues register: what was detected, whether it was a security incident or a breach, the decision and who made it. The breach notification rule requires notice to affected individuals without unreasonable delay and no later than 60 calendar days after discovery, so your register should show when each event was discovered.
What mistakes appear after the first year?
- Log reviews stop when the person who ran them moves on.
- The risk analysis never changes while the environment does.
- New vendors start handling protected health information before a business associate agreement exists.
- Workforce training lapses for new hires.
- Contingency plans untested since the first drill.
- Records kept for one year because nobody wrote down the six year rule.
- Sanctions for policy violations are never applied or recorded.
What to do
- Assign an owner and a backup for each recurring task.
- Build a calendar of weekly, monthly, quarterly and annual items with the evidence each produces.
- Automate log collection and alerts, and keep human review notes.
- Trigger a risk review for every new system or vendor.
- Keep a register of events, decisions and discovery dates.
- Store documentation with versions and a six year retention rule.
- Test restores and run a breach drill at least yearly.
- Review the whole programme once a year and record the decisions.
Quick check
Does HIPAA require continuous monitoring?
The rule requires regular review of system activity, audit controls and periodic evaluation. It does not name a tool, but you must be able to show that reviews happen and are acted on.
How long must we keep HIPAA documentation?
Six years from the date of creation or the date it last was in effect, whichever is later, under section 164.316.
Sources
- 45 CFR 164.308, administrative safeguards
- 45 CFR 164.312, technical safeguards
- 45 CFR 164.316, documentation
- 45 CFR 164.404, notice to individuals
How Safeguard helps automate this
Repeating reviews for years is where programmes decay. Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code instead of screenshots, and monitoring runs continuously, freeing the team for other work. Technical evidence comes from your real code and dependencies: scans, SBOMs and reachability. The remediation agent can open tested fix pull requests for vulnerable dependencies and other findings. It is off by default, every category starts on Manual, and you choose which categories run automatically and set the approval level. Safeguard helps you prepare and keep evidence ready, and it does not make you HIPAA compliant or replace your counsel. Book a call.
Last reviewed: 18 October 2026.
