The HIPAA Security Rule requires you to record and examine activity in systems that hold electronic protected health information (ePHI). It does not list log sources or tools, and it does not give a retention period for the logs themselves. This guide explains the rules that matter for audit logs, how long organisations keep them and what that means for your log setup.
Not legal advice
This is general guidance on the HIPAA Security Rule (45 CFR Part 164). Your privacy and security officers and legal counsel decide how it applies to your organisation.
The rules that are about logging
| Rule | Name | What it means for logs |
|---|---|---|
| 164.312(b) | Audit controls | Hardware, software or procedures that record and examine activity in systems with ePHI. |
| 164.308(a)(1)(ii)(D) | Information system activity review | Regularly review audit logs, access reports and security incident tracking. |
| 164.308(a)(5)(ii)(C) | Log-in monitoring | Monitor log-in attempts and report discrepancies (addressable). |
| 164.312(c)(1) | Integrity | Protect ePHI against improper change; logs help show who changed what. |
| 164.316(b)(2)(i) | Documentation retention | Keep required documentation for 6 years. |
Audit controls are a standard without implementation specifications: you decide how, based on your risk analysis. Activity review is required, so collecting logs and never looking at them does not meet the rule.
What to log
- Sign-ins and failed sign-ins to systems with ePHI.
- Who viewed, created, changed or deleted patient records, and when.
- Changes to accounts, roles and access rights.
- Exports, prints and bulk queries of ePHI.
- Security events from endpoints, network and cloud around those systems.
Keep the ePHI itself out of the log lines where you can: log the record ID and the action, not the diagnosis. That keeps the log useful without turning it into a second copy of the medical record.
How long to keep HIPAA audit logs
HIPAA requires 6 years for required documentation such as policies, risk analyses and activity reviews. It does not name a period for raw audit logs, but most organisations keep them for 6 years as well, so they can back up the documented reviews. State laws and contracts can ask for more. See log retention by regulation.
How LogPulse fits
LogPulse collects and parses logs centrally, runs detection rules on sign-ins, privilege changes and unusual access, and keeps notables and cases as a record of each review. Pipelines can mask or drop fields before they are stored, so ePHI does not end up in your logs by accident.
Enterprise and 6 years
HIPAA-eligible configurations and a signed Business Associate Agreement (BAA) are available on the Enterprise plan only. Log data is hosted in the EU. For the 6-year window, keep a copy in your own HIPAA-compliant storage: a stream pipeline sends every log there as it comes in. See Compliance & Trust. LogPulse supports your HIPAA programme; it does not make you HIPAA compliant on its own.