HIPAA Audit Logs: What to Record, Review, and Retain for ePHI

The HIPAA Security Rule requires covered entities and business associates to implement mechanisms that record and examine activity in information systems that contain or use electronic protected health information (ePHI), and to regularly review records of that activity. The rule does not list the events to log, the fields each entry must contain, or a review schedule. It leaves those decisions to a documented, risk-based approach. HIPAA does not state a retention period for audit logs, but it does require organizations to keep the documentation the Security Rule requires for six years, and organizations differ on how far that extends to the logs themselves.

Strong audit logging answers four questions after an incident or during an audit: who accessed ePHI, what they did, when it happened, and where the access came from. Kiteworks provides a control plane for secure data exchange that records user, data, and system activity in a single audit log and feeds it to your security tools, which helps healthcare organizations support audit controls for ePHI that moves through email, file sharing, SFTP, and managed file transfer.

This page provides general information, not legal advice, and it reflects one reading of the rules. HIPAA obligations depend on your organization’s circumstances, so consult your own legal counsel or compliance advisor before relying on it.

Key Takeaways

1. HIPAA Requires Logging and Review, Not Just Logging

Recording activity is only half the obligation. The audit controls standard calls for mechanisms that record and examine activity, and a separate required specification calls for regular review of audit logs, access reports, and security incident tracking reports.

2. The Rule Sets Outcomes, Not a Field List

HIPAA leaves event types, log fields, and review frequency to your risk analysis. You must be able to explain why your logging scope fits the risks to your ePHI and show that you follow it.

3. HIPAA Sets Six Years for Documentation, but Log Retention Is Your Decision

The six-year requirement applies to documentation the Security Rule requires, and the rule does not say whether raw logs count. Many organizations keep logs for six years as a precaution, and some must keep them longer because of state law, contracts, or legal holds. Decide with your own legal counsel.

4. Log Integrity and Access Control Matter as Much as Collection

A log that can be altered or read by anyone has little evidentiary value. Protect logs with access controls, tamper-evident storage, and separation from the systems they describe.

5. Your Vendors’ Logs Are Part of Your Evidence

Cloud and service providers that handle ePHI are business associates, and you need a way to obtain their activity records. Business associate agreements and technical log feeds should be planned together.

What Are HIPAA Audit Logs?

A HIPAA audit log is a chronological record of events in systems that create, receive, maintain, or transmit ePHI. Entries typically capture who performed an action, what the action was, which record or file was involved, when it occurred, where it originated, and whether it succeeded. The related term audit trail usually describes the sequence of entries that lets an investigator trace one user, record, or transaction from start to finish. In practice the two terms overlap, and our guide to audit logs covers the general concepts.

Audit logs differ from ordinary system logs in purpose. System logs help engineers troubleshoot. Audit logs exist to establish accountability for access to sensitive data, so they need to identify individual users and record access to ePHI, not only server errors. Our overview of PII and PHI explains what counts as protected health information.

What Does HIPAA Require for Audit Logs?

Several provisions of the HIPAA Security Rule point to audit logging:

The audit controls standard has no separate implementation specifications, so it applies as written. Because HIPAA is designed to scale, organizations choose measures that fit their size, complexity, and risks, but they must document their reasoning. Your risk assessment is where the logging scope should originate. For a broader checklist, read our guide to HIPAA compliance requirements.

What Events Should HIPAA Audit Logs Capture?

Group the events you log by the questions an investigator will ask:

• Authentication and access events. Successful and failed logins, logouts, multi-factor authentication outcomes, password changes, account lockouts, session timeouts, and use of emergency or break-glass access.
• ePHI activity. Viewing, creating, modifying, deleting, downloading, printing, exporting, sharing, and transmitting records or files that contain ePHI, including failed or denied attempts.
• Administrative and configuration changes. User creation and deactivation, role and permission changes, policy changes, and changes to the logging configuration itself.
• System and security events. Malware detections, intrusion alerts, software updates, service failures, and attempts to clear or alter logs.
• Data exchange events. Files and messages sent or received through email, file sharing, SFTP, and APIs, including the sender, recipient, and outcome.

What Should Each Audit Log Entry Contain?

Most healthcare organizations standardize on five elements for every entry:

1. Who: a unique user or system identifier, not a shared account.
2. What: the action taken and the type of event.
3. Which record or object: a record number, file name, or other reference that identifies the ePHI involved without copying the ePHI into the log.
4. When: a timestamp from synchronized clocks, with the time zone.
5. Where and with what result: the source IP address or device, the system, and whether the action succeeded or failed.

Keeping the contents of records out of logs follows the same logic as the minimum necessary rule: the log should identify the access, not duplicate the ePHI.

How Long Must You Retain HIPAA Audit Logs?

HIPAA does not state a retention period for audit logs. It does require you to keep documentation of required policies, procedures, actions, activities, and assessments for six years (45 CFR 164.316(b)(2)(i)), counted from the date of creation or the date the document last was in effect, whichever is later.

Organizations read this differently. Some treat only review records, risk analyses, and incident records as covered. Others keep the logs themselves for six years as a precaution, and state law, contracts, or legal holds may require longer. Decide with your own legal counsel and set a written retention schedule that you apply consistently. Storage design matters here too: logs held for years need to stay searchable, protected, and recoverable.

How Often Should Audit Logs Be Reviewed, and by Whom?

HIPAA says “regularly” without defining a schedule, so the frequency should follow your risk analysis. A common approach combines automated alerts for high-risk events, such as repeated failed logins, privileged access, or bulk downloads, with scheduled sampling of routine access, for example weekly or monthly. Your security officer is accountable for the program and usually designates trained reviewers. Document each review, including findings and follow-up, so you can show that it took place. Feeding logs into a SIEM makes alerting and correlation across systems much more practical than manual review.

What Are the Best Practices for Implementing HIPAA Audit Logging?

1. Centralize collection. Send logs from applications, servers, and data exchange channels to one place so investigators do not chase records across systems.
2. Standardize formats. Use consistent fields and timestamps so events can be correlated.
3. Synchronize clocks. Use a trusted time source so sequences of events are reliable.
4. Protect log integrity. Use tamper-evident storage, write-once options, or hashing, and alert on attempts to alter or clear logs.
5. Restrict and monitor log access. Apply role-based access control so only authorized staff can read or manage logs.
6. Encrypt logs in transit and at rest. Logs often reference sensitive systems and users. See our guide to HIPAA encryption.
7. Set alerts for high-risk events. Do not rely only on periodic review.
8. Align logging with incident response. Make sure the logs you keep support your incident response plan and breach risk assessments.
9. Test regularly. Periodically confirm that you can answer “who accessed this record, and when” within a reasonable time.

What Are the Common Challenges With HIPAA Audit Logs?

• Volume. Large health systems generate enormous numbers of events, which makes manual review impractical and drives the need for filtering and alerting.
• Coverage gaps. Logging often misses data that moves outside the electronic health record, such as files sent through email, shared folders, or file transfer tools.
• Inconsistent formats. Each system logs differently, which complicates correlation.
• Review fatigue. Without prioritization, reviewers miss the few events that matter.
• Third-party visibility. Cloud and service providers may offer limited log access unless the contract and configuration provide for it.

What Happens if Audit Logging Falls Short?

The Office for Civil Rights (OCR) enforces the Security Rule through investigations, resolution agreements, corrective action plans, and civil money penalties. Missing or unreviewed logs make it harder to determine the scope of a breach, harder to show that you meet the Breach Notification Rule, and harder to demonstrate a reasonable security program after an incident. Penalty amounts are listed in the dated section below. For the wider regulatory picture, see our overview of the HITECH Act.

How Do Audit Logs Apply to Cloud Providers and Other Business Associates?

A cloud service provider that creates, receives, maintains, or transmits ePHI for you is a business associate and must sign a business associate agreement. The agreement should address how you will obtain activity records, how quickly the provider reports security incidents, and who is responsible for which logs. Ask whether the provider offers log export or a feed to your SIEM, and how long it keeps logs. Our guides to HIPAA-compliant cloud storage and managed file transfer for HIPAA cover these questions for common data exchange tools.

Current Status: Penalty Amounts and Proposed Rule Changes

This section is reviewed and updated separately from the rest of the page. Last reviewed: October 2026.

Civil money penalties. HHS publishes inflation-adjusted HIPAA penalty amounts each year. The adjustment published in the Federal Register on January 28, 2026 set these figures per violation, with a calendar-year cap for identical violations:

Penalty amounts change with each annual adjustment, so confirm current figures with your own legal counsel.

Proposed Security Rule changes. In December 2024, HHS proposed updates to the HIPAA Security Rule to strengthen cybersecurity protections for ePHI. The proposal remained a proposed rule at the time of this review, and the current Security Rule remains in effect. Secondary reporting indicates that OCR received more than 4,700 comments and that the federal regulatory agenda now lists a final rule for July 2027. Keep meeting the current audit controls and information system activity review requirements, and watch the rulemaking. Our guide to the HIPAA Security Rule tracks the developments.

How Kiteworks Helps With HIPAA Audit Log Compliance

For many healthcare organizations, the biggest logging gap is ePHI that leaves the electronic health record by email, shared folder, or file transfer. Kiteworks provides a control plane for secure data exchange that governs those channels and records activity across them. The platform helps organizations support HIPAA audit controls in these ways:

• A single audit log. Kiteworks records user, data, and system activity in one audit log, including administrative changes, permission changes, and configuration changes, so teams do not reconcile a separate log for each channel.
• Real-time SIEM feeds. The audit log can be sent in real time through syslog and a Splunk Universal Forwarder to SIEM products such as Splunk, QRadar, ArcSight, and LogRhythm.
• Visibility for security teams. The CISO Dashboard shows activity across email, file sharing, SFTP, and managed file transfer, with alerts for unusual patterns.
• Privacy-aware logs. Audit logs are anonymized by default using identifiers, and administrators can resolve them to email addresses when verification requires it.
• User-level tracking. Users who manage files and emails can track views, downloads, uploads, and edits of that data.
• Least-privilege access. Role-based permissions and configurable administrator roles limit who can see ePHI and who can manage the logs.
• Encryption and key control. Customers own their encryption keys, and data is protected with double encryption at the file and disk level. The platform offers FIPS 140-3 Level 1 validated encryption.
• HIPAA reporting. A built-in HIPAA compliance report summarizes policy settings and monitoring of relevant operations to support audit preparation.

Explore the Kiteworks HIPAA compliance page or see how the platform serves healthcare organizations.

Additional Resources

• Blog Post Everything You Need to Know About HIPAA Compliance [Complete Checklist]
• Blog Post Managed File Transfer & HIPAA-compliant Solutions
• Blog Post Top HIPAA-compliant Forms
• Blog Post HIPAA Encryption: Requirements, Best Practices & Software
• Blog Post Send HIPAA-compliant Email