Log Retention
Keeping log records for a set period so they remain available for review and investigations.
Log retention means keeping log records for a set length of time. It makes past events available for review. A policy sets out which logs to keep, how long to keep them, where they are stored, and who can read them.
How log retention differs from logging
Audit logging creates records of events. Log retention keeps them over time. Access log review is the work of checking them. Each serves a different purpose.
Log rotation starts a new file when a size or time limit is reached. It may also delete old files. Rotation alone does not ensure that logs last as long as your policy says.
Why the retention period matters
A practice may learn of improper access months after it happened. If the logs have been deleted, a longer retention setting will not bring them back.
For example, a portal may keep access records for 90 days. Its host may keep server logs for longer. A later review could still lack the portal records that show which patient chart was opened. Check each source of logs. One host setting may not cover the whole service.
Log retention in healthcare
The HIPAA Security Rule sets a six-year period for certain required documents. The clock starts when a document is created or was last in effect, whichever is later. This is not a blanket six-year rule for every log. See 45 CFR 164.316.
Choose periods based on your risks, review needs and the rules that apply to you. Limit who can read or change stored logs. Logs that hold patient data need protection too.
What to put in a retention policy
- List the app, server and vendor logs you need.
- State how long each is kept and who sets that period.
- Check that stored records can be found and read.
- Plan how to export needed logs before changing hosts.
Our HIPAA audit logs guide explains settings and questions to ask your host.