What the Security Rule actually says about logs
Two provisions matter, and neither contains a number of years.
- Audit controls, 164.312(b): implement hardware, software and/or procedural mechanisms that record and examine activity in information systems that contain or use ePHI. That's the whole standard. OCR's own 2017 newsletter notes the rule doesn't say what to collect or how often to review it, and is silent on retention; your risk analysis decides all three.
- Information system activity review, 164.308(a)(1)(ii)(D): implement procedures to regularly review records of information system activity, such as audit logs, access reports and security incident tracking reports.
One makes the logs exist. The other makes someone read them. Retention is implied by both, because you can't review what you've deleted and you can't investigate an incident with no history, but the period is yours to set.
Where the six years comes from
164.316(b)(2)(i) says: retain the documentation required by this section for six years from the date of its creation or the date when it was last in effect, whichever is later. "Documentation" means your written policies and procedures, and "a written record of the action, activity, or assessment" wherever the Security Rule requires one. The Privacy Rule has an identical six-year rule at 164.530(j).
So the record that you reviewed the logs on a given date, who did it and what they found is documentation, and it's kept six years. Whether every raw log line is "a record of an activity required by the subpart" is the open question. HHS has never said yes. It has never said no. NIST's HIPAA implementation guide, SP 800-66 Rev. 2, leaves the retention period to your risk analysis, and audit firms disagree with each other about whether six years is required.
The review record is six years. The logs are "as long as your risk analysis says". Write both down.Your engineer
What your systems keep by default
Defaults are shorter than most people assume, which matters because an OCR investigation can start a year or more after the incident.
| System | Default retention | To extend |
|---|---|---|
| Microsoft 365, Audit (Standard) | 180 days | Audit (Premium) with E5 or add-on: 1 year for Exchange, SharePoint, OneDrive and Entra ID; a 10-year add-on licence exists |
| Google Workspace Admin console | 6 months for most log events; 30 days for email log search | Export to a SIEM or BigQuery for longer retention |
| EHR or practice management system | Varies by vendor; many keep access logs indefinitely, some purge | Ask your vendor in writing and keep the answer |
| Windows event logs | Overwrite when the file fills, often days | Central collection or a SIEM |
| Firewall and VPN | Days to weeks on the device | Central collection |
Other rules that do set a number
- PCI DSS 4.0: if you take card payments in scope, audit log history must be kept at least 12 months, with the most recent three months immediately available.
- Medicare Conditions of Participation: hospital medical records at least five years. Records, not security logs, but often conflated.
- Cyber insurance: applications increasingly ask whether logs are centralized and retained, without naming a period.
- Your BAAs: some hospital-system agreements set log retention for their vendors. Read yours.
Set your retention period
Pick the inputs that describe you and get a defensible starting point.
Your starting retention period
Starting point: 12 months. Whatever you choose, state it in the policy and keep every review record for six years.
A policy you can defend
Whatever period you choose, the defense is the same: the risk analysis considered it, the policy states it, the systems are configured to it, and the review records exist. An OCR data request asks for "audit log review records" far more often than it asks for the logs themselves, and the finding in snooping cases is almost always that nobody looked, not that the logs were gone.
With AccuSights: the platform checks that logging is enabled and retention is set on each connected system, flags the day it changes, and records every review against 164.308(a)(1)(ii)(D), so the six-year documentation accumulates on its own.