The HIPAA Security Rule asks for written policies, a risk analysis, regular review of system activity, audit controls and documentation kept for six years. You can automate the collection of logs, inventories and reports that show those things. You cannot automate judgment: someone still has to read, decide and sign.
What does the rule actually say about records?
We read the regulation text for 45 CFR Part 164, Subpart C.
Risk analysis (164.308(a)(1)(ii)(A), required). Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity and availability of electronic protected health information held by the covered entity or business associate.
Information system activity review (164.308(a)(1)(ii)(D), required). Implement procedures to regularly review records of information system activity, such as audit logs, access reports and security incident tracking reports.
Evaluation (164.308(a)(8)). Perform a periodic technical and nontechnical evaluation, based initially on the standards implemented and later in response to environmental or operational changes, that establishes how far your policies and procedures meet the rule.
Audit controls (164.312(b)). Implement hardware, software or procedural mechanisms that record and examine activity in systems containing or using electronic protected health information.
Technical safeguard headings (164.312). Access control, with unique user identification and emergency access procedure required and automatic logoff and encryption addressable, plus integrity, person or entity authentication and transmission security.
Documentation (164.316(b)). Keep policies and procedures in written form, which may be electronic. Keep a written record of any action, activity or assessment the subpart requires to be documented. Retain the documentation for six years from the later of its creation or the date it was last in effect. Make it available to those responsible for the procedures, and review and update it periodically.
What can you automate?
Think of three kinds of evidence.
Records the systems already generate. Audit logs, access reports and authentication events. Automate collection into one place on a schedule, with tamper protection and retention that covers six years for documentation you must keep.
Point in time exports. User lists with roles, device and software inventories, vulnerability scan results and configuration states. Capture them on a schedule with a date and a scope note, so you can show the state at any past moment.
Review proof. The rule requires regular review of activity, so evidence includes the review itself: who looked, when, what they found and what they did. Automation can create the task and store the sign off. A person still does the review.
What stays human?
- Deciding which risks matter and how to treat them in the risk analysis.
- Interpreting logs for suspicious activity.
- Deciding whether an addressable specification is reasonable and appropriate for you, and documenting why.
- Approving policy changes.
Automation that gathers evidence nobody reads satisfies neither the rule nor common sense.
What to do
- List the Security Rule items you must evidence, using the headings above.
- For each, name the source system and the owner.
- Schedule exports, and store them in one tamper resistant place with dates and scope notes.
- Create recurring review tasks with a stored sign off.
- Set retention to cover the six year documentation period, and test retrieval.
- Run an internal mock request: pick a past month and try to assemble the evidence in an hour.
- Review gaps each quarter, and note changes in systems that trigger a new evaluation.
Where Safeguard fits
Safeguard offers compliance automation and framework mapping that can help collect evidence from connected systems, and dependency inventories for the software you build. Try the framework mapping demo below. Safeguard does not certify HIPAA compliance, and this post is not legal advice.
Open the framework mapping demo
Quick check
How long must HIPAA Security Rule documentation be kept?
Six years, counted from the later of the date it was created or the date it was last in effect, under 45 CFR 164.316(b)(2)(i).
Can software do the required activity review for me?
It can collect logs and schedule the review, but the rule requires procedures to regularly review records. Someone must review and act, and you should store proof that they did.
Sources
- 45 CFR 164.308, Administrative safeguards
- 45 CFR 164.312, Technical safeguards
- 45 CFR 164.316, Policies and procedures and documentation requirements
Last reviewed: 18 October 2026.
