Written and maintained by CASRAI Editorial Board
Last updated
The HIPAA audit log requirements govern how Covered Entities and Business Associates record, protect, review, and retain activity trails across every application, database, operating system, and network boundary that creates, receives, maintains, or transmits electronic Protected Health Information (ePHI). Anchored in 45 CFR § 164.312(b) (Technical Safeguards: Audit Controls) and paired with 45 CFR § 164.308(a)(1)(ii)(D) (Administrative Safeguards: Information System Activity Review), a compliant audit trail architecture must capture granular user and patient-record events (defined by ASTM E2147-18 and 45 CFR § 170.315(d)(2)) and preserve tamper-resistant logs across the statutory retention lifecycle.
1. What Are the HIPAA Audit Log Requirements Under 45 CFR § 164.312(b)?
Within the HIPAA Security Rule, audit logging is governed by three interconnected regulatory provisions interpreted alongside NIST SP 800-66 Rev. 2:
| CFR Citation | Standard / Implementation Specification | Type | Operational Mandate for ePHI Systems |
|---|---|---|---|
| 45 CFR § 164.312(b) | Technical Safeguards — Audit Controls | Required (Statutory Standard) | Implement hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use ePHI. |
| 45 CFR § 164.308(a)(1)(ii)(D) | Administrative Safeguards — Information System Activity Review | Required | Implement procedures to regularly review records of information system activity, such as audit logs, access reports, and security incident tracking reports (passive logging without active review violates § 164.308). |
| 45 CFR § 164.308(a)(5)(ii)(C) | Administrative Safeguards — Log-in Monitoring | Addressable | Implement procedures for monitoring log-in attempts (successful and failed authentication, privilege escalation, and brute-force anomalies) and reporting discrepancies. |
| 45 CFR § 164.312(c)(1)–(2) | Technical Safeguards — Integrity & Mechanism to Authenticate ePHI | Standard / Addressable | Protect ePHI and audit logs from improper alteration or destruction using cryptographic checksums, HMACs, or RFC 3161 trusted timestamps. |
2. How Long Must HIPAA Audit Logs and Compliance Documentation Be Retained?
A frequent compliance question during a HIPAA compliance checklist review is why 45 CFR § 164.312(b) itself does not state a specific number of years, yet HHS Office for Civil Rights (OCR) auditors enforce a 6-year baseline retention requirement:
- The 6-Year HIPAA Documentation Rule (45 CFR § 164.316(b)(2)(i) & § 164.530(j)(2)): Under the Security Rule documentation standard (§ 164.316(b)(2)(i)) and the Privacy Rule retention standard (§ 164.530(j)(2)), Covered Entities and Business Associates must retain all required policies, procedures, actions, activities, or designations—including Information System Activity Review documentation, security incident investigations, risk analyses, and Business Associate Agreements—for 6 years from the date of its creation or the date when it last was in effect, whichever is later.
- The 6-Year Accounting of Disclosures Window (45 CFR § 164.528(a)(1)): Patients have a statutory right to receive an accounting of disclosures of their PHI made by a Covered Entity in the 6 years prior to the date on which the accounting is requested.
- Preemption by Longer Federal or State Retention Mandates: Note that HIPAA’s 6-year rule applies to compliance documentation and audit trails supporting security/privacy reviews, not the underlying clinical medical record itself, which is governed by state medical record retention statutes (often 7 to 10 years for adults and up to age of majority plus several years for minors), CMS Conditions of Participation (5 years minimum for hospital records under 42 CFR § 482.24(b)(1); 10 years for Medicare Advantage organizations under 42 CFR § 422.504(d)), or FDA 21 CFR § 312.62 clinical trial record rules. Best-practice healthcare SIEM and cold-storage architectures retain immutable ePHI access logs in AES-256 encrypted Write-Once-Read-Many (WORM) archival storage (such as AWS S3 Object Lock in Compliance Mode or Azure Immutable Blob Storage) for at least 6 years (or longer to match state medical record statutes).
3. What Events Must Be Captured in an EHR HIPAA Audit Trail? (ASTM E2147-18 & ONC § 170.315(d)(2))
Because 45 CFR § 164.312(b) is technology-neutral, the Office of the National Coordinator for Health Information Technology (ONC / ASTP) codified exact technical logging specifications in 45 CFR § 170.315(d)(2) (Auditable Events and Tamper-Resistance), § 170.315(d)(3) (Audit Report(s)), and § 170.315(d)(10) (Auditing Actions on Health Information) by incorporating ASTM E2147-18 (Standard Specification for Audit and Disclosure Logs for Use in Health Information Systems):
- Action / Event Type (`CRUD` + Export/Print/Query): Every `Create` (`add`), `Read` (`view` / `access`), `Update` (`modify` / `amend`), `Delete` (`soft-delete` / `purge`), `Copy` (`clipboard` / `download`), `Print`, `Query` (`search` execution), `Break-the-Glass` emergency override, and `Audit Status Change` (enabling/disabling logging) must be logged.
- Actor / User Identification: Unique User ID (mandated by 45 CFR § 164.312(a)(2)(i)), active role/privilege level at time of access, authentication method (SSO/MFA session ID), and originating network endpoint (source IP address, device ID, or workstation identifier).
- Synchronized Timestamp (UTC): Exact date and time down to the second or millisecond, synchronized via Network Time Protocol (NTP) to a trusted time standard so logs across database, API, and application tiers correlate accurately.
- Patient and Data Object Identification: Unique Patient ID (MRN / EMPI) and the specific record, HL7 FHIR resource (`Patient/123`, `Observation/456`), or table field accessed—including old and new values (or pointers to the prior version) for modification events.
- Tamper-Resistance and Separation of Duties: Under § 170.315(d)(2), only a tightly restricted set of privileged administrators may configure audit parameters, no user may edit or delete recorded audit entries, and cryptographic hashes (SHA-256 chains or Merkle trees) must detect any unauthorized tampering.
4. HIPAA Audit Log Schema Template and Compliance Checklist
{
"event_id": "evt_01JBM9K4X27R8P",
"timestamp_utc": "2026-10-15T14:22:08.412Z",
"ntp_sync_status": "synchronized",
"event_category": "ePHI_Access",
"astm_e2147_action": "READ",
"outcome": "SUCCESS",
"actor": {
"user_id": "usr_dr_smith_8841",
"npi": "1234567890",
"role": "Attending_Physician",
"auth_amr": ["pwd", "mfa_webauthn"],
"source_ip": "10.42.18.109",
"workstation_id": "WKS-ICU-04"
},
"target_patient": {
"mrn": "MRN-90041285",
"empi": "EMPI-7731902"
},
"target_resource": {
"resource_type": "MedicationRequest",
"resource_id": "medreq-552019",
"version_id": "3",
"access_reason": "Treatment_Inpatient_Rounding",
"break_the_glass": false
},
"prev_entry_sha256": "8f434346648f6b96df89dda901c5176b10a6d83961dd3c1ac88b59b2dc327aa4",
"entry_sha256": "3a7bd3e2360a3d29eea436fcfb7e44c735d117c42d1c1835420b6b9942dd4f1b"
}Operational Audit Log Review Checklist
- Automated SIEM Anomaly Detection: Forward EHR, database, and cloud IAM logs in real time to a HIPAA-covered Security Information and Event Management (SIEM) platform configured to alert on VIP/celebrity chart snooping, coworker/family last-name/address matches, bulk FHIR `$export` downloads, off-hours access spikes, and repeated failed logins.
- Documented Periodic Review (`§ 164.308(a)(1)(ii)(D)`): Maintain signed, dated review tickets proving that the Security Officer or Privacy Officer investigated triggered alerts and random access samples on a scheduled cadence (daily automated alerts + weekly/monthly formal reviews), retaining both the logs and the review records in WORM storage for `>= 6 years`.
- Zero Raw ePHI in Application Debug Logs: Enforce log-scrubbing middleware so stack traces and developer debug logs capture resource identifiers (`Patient/123`) rather than leaking unencrypted SSNs, names, or clinical narratives into non-production logging tools.
5. Frequently Asked Questions
What are the HIPAA audit log requirements under 45 CFR 164.312(b)?
Under 45 CFR § 164.312(b) (Audit Controls), Covered Entities and Business Associates must implement hardware, software, and/or procedural mechanisms to record and examine activity in all information systems that contain or use ePHI. This technical safeguard operates alongside 45 CFR § 164.308(a)(1)(ii)(D), which requires organizations to regularly review audit logs, access reports, and security incident logs rather than merely collecting them passively.
How long must HIPAA audit logs and compliance documentation be retained?
Under 45 CFR § 164.316(b)(2)(i) (Security Rule) and 45 CFR § 164.530(j)(2) (Privacy Rule), all required HIPAA compliance documentation—including Information System Activity Review records, security incident reports, and accounting of disclosure trails—must be retained for at least 6 years from the date of creation or last effective date. If state medical record laws, CMS Medicare Advantage rules (10 years), or Business Associate Agreements mandate a longer period, the longer retention period applies.
What events must be captured in an EHR HIPAA audit trail?
Aligned with ASTM E2147-18 and ONC certification criteria (45 CFR § 170.315(d)(2)), an EHR audit trail must capture every create, read/view, update, delete, print, copy/export, query, emergency break-the-glass override, and authentication event, recording the NTP-synchronized UTC timestamp, unique user ID and role, source IP/workstation, unique patient identifier, and specific clinical record or field accessed in a tamper-resistant format.
