HIPAA Audit Logs: What to Record, How Long to Keep It, and Why It Saves You

The middle ground between nothing and too much

The HIPAA Security Rule requires audit controls that record activity involving ePHI, yet many practices either log nothing or log so much that no one ever reviews it. The goal is the middle ground: capturing the access events that matter, keeping them long enough to investigate, and actually reviewing them on a schedule.

What to log

At minimum, log access to the EHR, including who opened which record and when, and log administrative actions like user creation, privilege changes, and failed logins. Retain logs for at least six years to align with HIPAA documentation requirements, though many practices balance that against storage cost with a tiered retention approach. The key is being able to reconstruct what happened during an incident.

Someone has to look

Logs only help if someone looks at them. Set up regular reviews for unusual access patterns, like a user opening far more records than their role would suggest, and make sure alerts reach a person who will act. Reviewing audit logs turns a passive compliance checkbox into an active defense, and it is part of our HIPAA IT compliance service.

What to do next

Confirm EHR access logging is on, set an alert for abnormal access volume, and assign a reviewer.

• Log EHR access and all administrative actions
• Retain logs long enough to investigate incidents
• Review access patterns regularly, not just after a breach