The HIPAA Security Rule's audit controls standard is a single sentence. It does not say what to log, how often to review it or how long to keep it, which leaves those decisions to you.
The one-sentence standard
Here is the full text of 45 CFR 164.312(b), which applies to covered entities and business associates: "Implement hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use electronic protected health information."
Note the 2 verbs. A log that records everything but that nobody examines covers only half of the standard.
A log is also only as good as the sign-ins behind it. The same section requires unique user identification, a unique name or number for each user, and procedures to verify that anyone seeking access is who they claim to be. If 3 staff share 1 login, the log cannot tell you which of them opened a chart.
The review requirement
The examining half shows up again in the administrative safeguards. The rule at 45 CFR 164.308(a)(1)(ii)(D) is labeled Required: regularly review records of system activity, such as audit logs, access reports and security incident tracking reports.
A separate specification on log-in monitoring, procedures to monitor log-in attempts and report discrepancies, is labeled Addressable.
Addressable does not mean optional. Under 164.306(d), you must assess whether it is reasonable and appropriate. If it is not, you must document why and put an equivalent alternative in place where that is reasonable.
What the rule leaves open
The rule sets no review frequency. Instead, it lets each practice choose measures based on its size, complexity, technical setup, costs and the likelihood and impact of risks.
Your risk analysis, itself a required specification, is where those choices get made. NIST's 2024 guide to the Security Rule, SP 800-66 Rev. 2, turns this into a set of questions:
- Which activities will you audit: creating, viewing, changing, sending or deleting patient data?
- What does each audit record include, such as the user, event type, date and time?
- Who is responsible for the audit process and its results?
- How often will audits take place, and how often will results be analyzed?
- Where will audit information be stored?
The guide also asks whether you have considered automation to help with monitoring, and how managers and staff will be told about suspect activity.
What certified EHRs must do
The federal certification program for health IT sets a more specific bar for software. Criterion 170.315(d)(10) says certified technology must record actions on health information by default.
If auditing can be turned off, only a limited set of users may do it. Recorded actions must not be changeable, overwritable or deletable by the software, and the software must be able to detect whether the log has been altered.
Timestamps get attention too. Under the related standard in 170.210, certified audit logs must use a system clock synchronized with a Network Time Protocol standard, so times line up across systems.
That criterion applies to developers seeking certification, not to your practice. It is still a useful benchmark when you ask any vendor how its log works.
A review routine for small teams
- Name 1 person responsible for reviews, plus a backup
- Set a review schedule your risk analysis supports, and write it down
- Look for exceptions: charts opened with no linked visit, bulk exports, after-hours access and repeated failed sign-ins
- Record each review with the date, reviewer, findings and any action taken
- Feed what you find back into training and your sanction policy, which is itself a required specification
Keep the paperwork. Under 45 CFR 164.316, documentation of required actions and assessments must be kept for 6 years from creation or the date it was last in effect, whichever is later. Whether raw logs must be kept that long is a question for your compliance advisor.
The rule may change
HHS proposed updates to the Security Rule in January 2025. As of the October 2026 eCFR text, the provisions quoted above were unchanged. Check the current status with your compliance advisor before you rewrite policies.
EMR MD records chart views, edits and exports in a hash-chained audit log, a design meant to make changes to past entries detectable when you review them.
Sources
- 45 CFR 164.312: Technical safeguards Electronic Code of Federal Regulations (eCFR), 2026
- 45 CFR 164.308: Administrative safeguards Electronic Code of Federal Regulations (eCFR), 2026
- 45 CFR 164.306: Security standards: General rules Electronic Code of Federal Regulations (eCFR), 2026
- 45 CFR 164.316: Policies and procedures and documentation requirements Electronic Code of Federal Regulations (eCFR), 2026
- 45 CFR 170.315: 2015 Edition health IT certification criteria Electronic Code of Federal Regulations (eCFR), 2026
- 45 CFR 170.210: Standards for health information technology to protect electronic health information created, maintained, and exchanged Electronic Code of Federal Regulations (eCFR), 2026
- SP 800-66 Rev. 2: Implementing the HIPAA Security Rule: A Cybersecurity Resource Guide National Institute of Standards and Technology, 2024
- HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information (proposed rule) Federal Register, 2025
This article is general information, not legal or medical advice. Rules change; check the source and your compliance advisor before acting.