HIPAA's six year rule: does it mean keep security logs six years?

The six year figure in the HIPAA Security Rule applies to required documentation of policies, procedures and related actions. Whether it also covers raw system logs depends on how you classify them, so confirm your reading with counsel. Many organizations choose to keep key audit logs for that period to be safe. This is not legal advice.

What the regulation says

Under 45 CFR 164.316(b)(2)(i), titled "Time limit (Required)," a covered entity or business associate must retain the documentation required by paragraph (b)(1) for 6 years from the date of its creation or the date when it last was in effect, whichever is later.

Paragraph (b)(1) concerns documentation: policies and procedures, and written records of actions, activities or assessments that the rule requires to be documented. So the clock attaches to those records.

Where logs fit

This is where reading matters. Some logs are clearly evidence of a required activity. Others are operational data. A few examples to discuss, not conclusions:

• Review of system activity. If your documented procedure says you review audit logs weekly, the record of those reviews is the kind of documentation the rule anticipates.
• Raw audit logs. Whether the underlying logs count as documentation, or as the data reviewed, is a classification question for your compliance lead.
• Incident records. Documentation of a security incident and its response is commonly treated as retained documentation.

Because the rule and its guidance can be read differently, a common conservative practice is to retain access and audit logs for security relevant systems, along with review records, for six years. That is a policy choice, not a statement of what the text demands.

Costs of keeping everything

Longer retention has a price. It costs money, widens the data exposed in a breach, and logs often contain personal data. Tiering helps, as in hot, warm and cold log tiers, and so does limiting what you log in the first place, as in minimizing personal data in logs.

A practical approach

1. Write down which log types you consider part of required documentation.
2. Record the reasoning, so a future auditor sees a decision rather than a gap.
3. Set the retention for each type, and separate review records from raw volume.
4. Make sure the archive is retrievable and access controlled.
5. Revisit when systems, vendors or state law change. State requirements can differ, so check yours.

What to give an auditor

Evidence that the policy exists, that logs are collected, that reviews took place, and that retention is enforced. A dated sample retrieved from the oldest tier is persuasive.

Quick check

Sources

• 45 CFR 164.316, Policies and procedures and documentation requirements

Last reviewed: 19 October 2026.