HIPAA audit controls requirement: 45 CFR 164.312(b)

Citation

45 CFR 164.312(b)

Standard

Audit controls, 164.312(b)

Safeguard

Technical safeguards

Type

Standard (required)

Implement hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use electronic protected health information.45 CFR 164.312(b), as currently in force

In plain English: Your systems have to keep track of who did what with patient information, and you have to be able to examine that record. Logging turned on, kept, and looked at.

• Applies to every system that contains or uses ePHI: the EHR or practice management system, email, cloud storage, identity provider, servers, cloud infrastructure, remote access.
• The rule doesn't list events, frequencies or retention. OCR's 2017 newsletter says the entity decides what to collect and how often to review it through its risk analysis, and is silent on retention.
• Pairs with information system activity review (164.308(a)(1)(ii)(D)), which requires someone to regularly examine the records.
• Logs should be protected from the people they monitor; restrict who can alter or delete them.
• Retention is your decision; the record that you reviewed the logs is documentation kept six years.

The river remembers who swam where. That's the short version of this requirement.Your engineer

If an investigation touches this requirement, the data request will ask for some or all of the following.

• Logging configuration for each in-scope system.
• Retention settings and where logs are stored.
• Dated review records.
• Alerting rules where review is automated.

Warby Parker, $1.5 million civil money penalty, 2025: among the findings, failure to regularly review records of information system activity after a 2018 credential-stuffing attack. The clearest example of logs that existed and were never read. BayCare, $800,000, 2025: access authorization and activity review.

Snooping cases live here: the EHR logged thousands of improper views, and the logs were the evidence against the entity because nobody had reviewed them.

Confirm logging is on in the EHR and that the access report is available by user; turn on the unified audit log and mailbox auditing in Microsoft 365 or Vault and audit logs in Google Workspace; keep identity provider sign-in logs beyond the short defaults; decide retention in the risk analysis; schedule the review and record it.

The proposal would make the supporting monitoring and logging controls explicit and require them to be reviewed and tested at least every 12 months. The update was proposed in January 2025 and remains a proposal as of October 2026; see what's changing.

This page explains a federal regulation in plain language. It isn't legal advice, and AccuSights doesn't certify compliance; no one can. For every standard and specification, see the Security Rule, clause by clause.