Audit Logging
Recording who accessed PHI and when, as required by the HIPAA Security Rule.
Audit logging (audit controls) is the recording of who accessed protected health information and when, so activity can be reviewed and incidents investigated. It is a firm technical-safeguard requirement under the HIPAA Security Rule (45 CFR §164.312(b)), not an optional feature. Meeting that requirement in practice means deciding what to log and how long to keep it.
How long should HIPAA audit logging records be kept? HIPAA's audit controls standard (45 CFR 164.312(b)) requires systems that record and examine activity, but it sets no retention period for the logs themselves. HIPAA requires you to keep Security Rule documentation for six years from when it was created or last in effect, whichever is later (45 CFR 164.316(b)(2)(i)). Many organizations keep logs for six years to line up with that documentation rule. See log retention for what a retention policy should cover.
Our managed healthcare hosting includes six-year audit logging on every plan, on single-tenant AWS, from $229 a month. We sign the BAA within 24 hours of signup, before patient data moves. Our BAA covers the servers and services we run. See key security measures for HIPAA-compliant hosting.
For the serverless case, where debug logs and audit logs must be kept apart, see is AWS Lambda HIPAA compliant. If your app stores patient data, it needs HIPAA audit logging too, since 45 CFR 164.312(b) covers systems that contain or use ePHI. Web frameworks rarely ship an audit trail. Our Laravel HIPAA compliant guide shows how a Laravel app adds one.