HIPAA Audit Logs: What to Record, How Long to Keep Them and Who Holds Them (2026)
HIPAA Compliant Hosting · https://hipaacomplianthosting.com/blog/hipaa-audit-logs
Last updated: October 16, 2026
HIPAA requires audit controls that record and examine activity on systems holding patient data, plus regular review of those records. It does not set a log retention period. That gap leaves the hard choices about HIPAA audit logs to you. The gap shows up when a risk assessment or payer questionnaire asks where your logs are and how long you keep them. You find an audit log that ages out at 90 days and a host with no answer. Our managed healthcare hosting includes six-year audit logging on single-tenant AWS, from $229 a month. We sell this hosting, so weigh our view with that in mind.
TL;DR: Quick answer
The Security Rule requires audit controls (45 CFR 164.312(b)) and regular review of activity records (164.308(a)(1)(ii)(D)).
HIPAA sets no log retention period. Many compliance guides advise keeping HIPAA audit logs for six years, the clock for required documentation under 164.316(b)(2)(i).
Defaults vary. As of October 16, 2026, Strapi audit logs default to 90 days, self-hosted n8n prunes run data after 14 days, and CloudWatch keeps logs indefinitely.
Your host, your app and each SaaS vendor can each keep a log. Ask each one what it keeps.
IP addresses and URLs are HIPAA identifiers, so a log line tied to care can be PHI.
Every managed plan includes six-year audit logging and a BAA within 24 hours of signup, from $229 a month. See current plans and pricing.
What the Security Rule requires of HIPAA audit logs
Four Security Rule duties shape HIPAA audit logs.
Audit controls, 164.312(b). The audit controls standard asks for mechanisms that "record and examine activity" in systems holding ePHI.
Activity review, 164.308(a)(1)(ii)(D), Required. You must "regularly review records of information system activity, such as audit logs, access reports, and security incident tracking reports".
Log-in monitoring, 164.308(a)(5)(ii)(C), Addressable. Monitor log-in attempts and report discrepancies.
Unique user IDs, 164.312(a)(2)(i), Required. Assign each user a unique name or number "for identifying and tracking user identity".
What goes into HIPAA audit logs is your call. OCR's January 2017 newsletter is blunt. The rule "does not identify what information should be collected from an audit log or trail or how often the audit reports should be reviewed". OCR says to weigh your HIPAA risk analysis and your current systems.
The newsletter names three kinds of audit trail: application, system-level and user. Application trails cover the "creating, reading, editing, and deleting of application records associated with ePHI". System-level trails usually capture log-on attempts, user IDs, times and devices.
OCR cites the review duty in settlements. In May 2025, HHS announced that BayCare Health System had paid OCR $800,000. The credentials used to access a patient's record belonged to a non-clinical former staff member of a physician's practice. Among the potential violations, OCR listed "Failure to regularly review records of information system activity". See real cases where log reviews caught snooping.
How we handle it: Every plan includes six-year audit logging on single-tenant AWS. The review duty still applies to your practice, so name who reads your app's logs and how often.
How long to keep HIPAA audit logs
HIPAA names no retention period for logs. The six years often quoted for HIPAA audit logs comes from a documentation rule, not a logging rule.
If the rule says to document an action, activity or assessment, you keep a written or electronic record. Under 164.316(b)(2)(i), you keep it "for 6 years from the date of its creation or the date when it last was in effect, whichever is later".
Logs often back up those records, such as activity reviews and incident reports. Many compliance guides advise keeping HIPAA audit logs for six years on that basis. Treat that as advice, not the rule's text. State law or a contract may set its own period, so check yours.
HHS published a proposed Security Rule update on January 6, 2025 (90 FR 898). Its "Audit trail and system log controls" standard would require you to "record in real-time all activity" in relevant systems. Records would be kept "as determined by" your own activity review policies. Even the proposal sets no number of years.
As of October 16, 2026, it is still a proposal, and the federal regulatory agenda lists final action for July 2027. Our guide to the new HIPAA Security Rule tracks it.
How we handle it: Every plan includes six-year audit logging, which matches the six-year documentation clock.
The 90-day cliff: defaults that decide how long logs last
Montefiore Medical Center shows what time does to an investigation. In May 2015, the New York Police Department told the hospital of evidence of a theft. An internal investigation found that, two years earlier, an employee had stolen the ePHI of 12,517 patients and sold it to an identity theft ring.
In February 2024, HHS announced that Montefiore had agreed to pay $4.75 million. OCR cited potential failures to implement policies and procedures that "record and examine activity" in its systems. HHS said the hospital could not "even detect the attack had happened until years later". The arithmetic is simple: HIPAA audit logs kept for 90 days cannot answer a question asked two years later.
Each tool's retention follows a default until someone changes it. Here are five, from vendor docs as of October 16, 2026.
Tool | Default | What happens | What to change |
|---|---|---|---|
n8n (self-hosted) | Pruning on; deletes runs older than 14 days or past 10,000 | Most run data, which can hold PHI, is deleted; it is not an audit log | Keep pruning on; streaming audit events, such as logins, needs Enterprise |
Strapi | Audit Logs need an Enterprise plan; 90-day default | Older entries are deleted and cannot be recovered in the Audit Logs screen | Check the license's period (config can only shorten it); export entries first |
AWS CloudTrail | Event history shows 90 days of management events | Older events drop out of event history | Create a trail for an ongoing record |
Docker | json-file driver; no log rotation | Logs can fill the disk | Set rotation; ship logs to storage you keep |
AWS CloudWatch Logs | Log data kept indefinitely | Logs, and any PHI in them, never age out | Set a retention period per log group |
The defaults run both ways: Strapi deletes audit entries at 90 days, and CloudWatch keeps logs indefinitely.
Our n8n HIPAA compliance guide covers execution history and the BAA question; for AI agents and chatbots, see our HIPAA compliant AI hosting guide. Our Strapi HIPAA guide covers its Enterprise audit logs and self-hosting.
Container logs are covered in our Docker HIPAA guide. Whatever the tool, put the retention you chose for HIPAA audit logs in writing.
How we handle it: Our HIPAA compliant n8n hosting, plus Strapi and Docker, runs on the Performance tier from $259 a month. Every plan includes six-year audit logging. App settings, such as n8n pruning or Strapi retention, are separate, so agree in writing who sets them.
Who holds which log on a hosted site
A hosted site has layers, and each one can keep its own log. Your HIPAA audit logs end up spread across them, so map who holds what.
Edge (CDN and web application firewall). It can record web requests, including IP addresses and URLs. On AWS, CloudFront access logs and AWS WAF traffic logs stay off until someone turns them on.
Server and operating system. It can record log-on attempts, user IDs and times: OCR's system-level audit trail.
Application. It can record who created, read, edited or deleted which record. What it records depends on its settings.
SaaS vendors (EHR, forms, email). Their logs sit with them, and each one that handles PHI needs a BAA. Ask what it keeps.
HIPAA audit logs can hold PHI themselves. Section 164.514(b)(2)(i) lists "Web Universal Resource Locators (URLs)" and "Internet Protocol (IP) address numbers" among the identifiers removed to de-identify data. Both are among the 18 HIPAA identifiers. A log line pairing a visitor's IP address with a booking confirmation URL can tie a person to care.
So treat logs like patient data: encrypt them and limit who can read them. OCR's newsletter says "Access to audit trails should be strictly restricted". Any vendor that stores logs holding PHI for you needs a BAA; here is what a hosting BAA should cover.
A BAA must require the business associate to report "any security incident of which it becomes aware" (164.314(a)(2)(i)(C)). Under 164.304, that includes "attempted" unauthorized access. Without logs, an attempt can go unseen. For the other server controls, see our CFR-mapped hosting security checklist.
How we handle it: Our servers run on single-tenant AWS with encryption at rest and in transit. The BAA we sign within 24 hours of signup covers the servers and services we run.
What to ask a host about HIPAA audit logs and MFA
A host's answer about HIPAA audit logs should be specific and in writing. Ask these six questions.
Which layers do you log: edge, server, database server? A good answer is a list, in writing.
How long do you keep each log? A good answer is a period, such as six years, not "it depends".
Who can read the logs, and how do we get records for an investigation? A good answer names roles and a stated way to request records.
Are the logs inside the BAA? A good answer is yes, because logs can hold PHI.
What happens to our logs if we leave? A good answer is a clear exit plan before you sign. If you plan to migrate to HIPAA compliant hosting, export the old host's logs before you cancel.
Where does MFA apply? A good answer: on every admin login to the servers, and on your app's staff logins. MFA is one way to meet the person or entity authentication standard; see HIPAA MFA requirements.
How we handle HIPAA audit logs on managed hosting
This is the part we sell, stated plainly. Here is what every plan includes.
Six-year audit logging on every plan, on single-tenant AWS.
The rest of the stack. CloudFront CDN, a web application firewall, encryption at rest and in transit, EBS storage with 7-day snapshot retention, and tested encrypted backups. Snapshots and backups are recovery copies, not audit logs.
A BAA within 24 hours of signup, before patient data moves. Our BAA covers the servers and services we run.
Plain pricing. Plans start at $229 a month, and the Performance tier for n8n, Drupal, Strapi, Docker and Phalcon starts at $259. There are six sizes, Starter to Network, billed monthly with no long-term contract.
Help to get set up. Your first month includes 4 hours of migration and configuration. Here is what the 4 hours cover; after that, it is $175 an hour, quoted before work starts.
When are we the wrong choice? If your PHI lives only in a SaaS EHR, its HIPAA audit logs sit with that vendor, so ask the vendor and skip us. If you need a SOC 2 report, look elsewhere. HIPAA Compliant Hosting does not hold SOC 2 or HITRUST certification. A standard plan will not fit if you need multi-zone (quoted separately) or root access (Enterprise only).
Frequently asked questions
Does HIPAA require audit logs?
In practice, yes. The audit controls standard, 164.312(b), requires mechanisms that "record and examine activity" in systems holding ePHI. You must also regularly review records "such as audit logs".
How long do HIPAA audit logs need to be kept?
HIPAA sets no log retention period. Many compliance guides advise keeping HIPAA audit logs for six years, the clock for required documentation under 164.316(b)(2)(i). State law or a contract may set its own period. The January 2025 proposal names no number of years either.
What should a HIPAA audit log include?
The rule lists no fields, so weigh your risk analysis and systems. OCR's 2017 newsletter gives examples. At the system level: log-on attempts, user IDs, times and devices. At the application level: who created, read, edited or deleted records with ePHI.
How often should HIPAA audit logs be reviewed?
The rule says "regularly" and sets no schedule. OCR urges review after security incidents and during real-time operations. Write a schedule into your policy, and name who reviews your HIPAA audit logs.
Do HIPAA compliant hosting providers keep audit logs for you?
Some do, so ask which layers they log and for how long. Our managed plans all include six-year audit logging. Check what your app logs, too. To weigh hosts side by side, compare HIPAA hosting providers; if you are on a regular host, see HIPAA hosting vs regular hosting.
Can audit logs contain PHI?
Yes. HIPAA audit logs can capture IP addresses and URLs, which are both on HIPAA's identifier list. A log line can become PHI when it ties a person to care. Encrypt logs, restrict who can read them, and get a BAA from any vendor that stores logs with PHI for you.
Recap: HIPAA audit logs that are still there when you need them
HIPAA requires audit controls and regular review but leaves retention to you. Tool defaults range from 14 days to no expiry, so set each one on purpose. Map who holds which of your HIPAA audit logs, and get your host's answers in writing. We sign the BAA within 24 hours of signup and run single-tenant AWS with six-year audit logging, from $229 a month. Your first month includes 4 hours of migration and configuration. Request a quote for your practice, or request an infrastructure quote for your app. You can also compare our current plans.
This article is general information, not legal advice. Base your log decisions on your documented risk analysis, and confirm your obligations with qualified counsel. Vendor settings were checked on October 16, 2026, and can change.
Sources
HHS OCR: audit controls newsletter (January 2017), Montefiore settlement (announced 2024) and BayCare settlement (announced 2025).
Proposed rule: 90 FR 898 (January 6, 2025) and Unified Agenda, RIN 0945-AA22.
n8n: execution data and log streaming.
Strapi: Audit Logs. Docker: logging drivers.
AWS: CloudTrail event history and CloudWatch Logs.
AWS: CloudFront standard logs and AWS WAF logging.