What is an audit log?
An audit log is a time-stamped, tamper-resistant record of activity in an information system: who signed in, which records they viewed, created, changed, exported or deleted, and when. In healthcare, audit logs are how a practice can answer the question "who looked at this patient's information?" HIPAA requires systems holding electronic PHI to record and examine that activity.
- HIPAA's Security Rule makes audit controls a required standard (45 CFR 164.312(b)).
- It also requires practices to regularly review system activity records (45 CFR 164.308(a)(1)(ii)(D)). Keeping logs nobody reads is not enough.
- A useful log entry answers who, what, which record, when and from where.
- Ask every vendor that holds your patients' data what it logs, how long it keeps the logs and how you can see them.
What HIPAA requires
Two parts of the HIPAA Security Rule work together. The audit controls standard requires a practice to implement hardware, software or procedural mechanisms that record and examine activity in information systems that contain or use electronic PHI. The information system activity review specification requires the practice to regularly review records of that activity, such as audit logs, access reports and security incident tracking reports.
HIPAA does not prescribe a specific log format, a list of events or a review frequency. HHS expects each practice to decide based on its risk analysis. It also does not set a specific retention period for the logs themselves; HIPAA's six-year retention rule in 45 CFR 164.316(b)(2) applies to required policies and documentation, and many practices keep audit logs at least that long to be safe. State law and your own policies may set longer periods.
What a useful log entry contains
- Who: the specific user account, not a shared login.
- What: the action, such as view, create, edit, print, export, delete or sign in.
- Which record: the patient or data object affected.
- When: an accurate date and time.
- Where: the device, location or network address the action came from.
- Outcome: whether the action succeeded or failed, which matters for spotting repeated failed sign-ins.
Why it matters to an independent practice
Audit logs earn their keep in three situations. First, investigations: when a patient asks who viewed their record, or staff suspect snooping, the log is the evidence. Second, incidents: after a stolen password or suspicious email, the log shows what the attacker reached, which determines whether a breach occurred and who must be notified. Third, disputes: when someone says an appointment was changed or a message was never sent, the log settles it.
Shared logins quietly break all three. If the whole front desk signs in as "frontdesk," the log can say what happened but not who did it. Unique user accounts are the foundation.
How to review logs without a security team
A small practice cannot read every log line, and doesn't need to. A practical routine:
- Monthly spot check. Pull the EHR's access report for a handful of patients, including any staff members or their family who are also patients, and confirm each access had a work reason.
- Watch for patterns. Sign-ins at odd hours, large exports, many records viewed in a short time, or repeated failed sign-ins.
- Review on departure. When an employee leaves, confirm the account was disabled and check recent activity.
- Review after any incident. A lost device, phishing email or unexpected change should trigger a targeted look.
- Document it. A one-line note of each review, with the date and result, shows the review requirement is being met.
Example: a snooping question
Illustrative case: a patient who is also a neighbor of a staff member calls, worried that the staff member looked at her chart. The office manager runs the EHR access report for that patient over the past six months. It shows 14 entries: check-ins, a billing update and clinical documentation, all tied to her three visits, plus one view by the staff member in question on a day the patient had no appointment.
The log has turned a vague worry into a specific question the practice can investigate under its privacy policy, and if the access was improper, assess under the breach notification rules. Without unique logins and an access report, there would be nothing to look at.
Common mistakes
- Shared logins. The single biggest reason logs fail to answer questions.
- Logging but never reviewing. The Security Rule requires review, and unreviewed logs catch nothing.
- Not asking vendors. Your EHR is not the only system with PHI. Texting tools, billing services and revenue tools should log access too. Our guide to audit trails for automated actions covers what automated systems should record.
- Letting anyone edit logs. Logs should be read-only for ordinary users and protected from deletion.
- Confusing the audit log with an accounting of disclosures. Patients have a separate right, under 45 CFR 164.528, to an accounting of certain disclosures. The audit log helps produce it, but they are not the same thing.
Every action recorded, every recovery itemized
DocsMD itemizes every recovered visit in a weekly report: the patient, the date, the action taken and the dollar amount, so you can trace what happened and why. It signs a Business Associate Agreement before any data moves, and keeps data encrypted at rest and in transit in U.S. data centers. Our security page has more.
Questions
Is an audit log required by HIPAA?
Audit controls are a required standard under 45 CFR 164.312(b), and regular review of system activity is required under 45 CFR 164.308(a)(1)(ii)(D). HIPAA does not dictate the exact format.
How long should we keep audit logs?
HIPAA does not set a specific period for logs. Many practices keep them at least six years, matching HIPAA's documentation retention rule, and longer if state law requires.
Can a patient see who accessed their record?
Patients have a right to an accounting of certain disclosures under 45 CFR 164.528. Many practices also answer access questions from audit logs as a matter of policy. Ask your compliance adviser about your obligations.
Who in a small practice should review audit logs?
Usually the privacy or security official, often the office manager. The important part is that a named person owns the review and documents it.
What is the difference between an audit log and an audit trail?
They are usually used interchangeably. Some people use audit trail for the full history of one record and audit log for the system-wide record.