- Citation
45 CFR 164.308(a)(1)(ii)(D)- Standard
- Security management process, 164.308(a)(1)(i)
- Safeguard
- Administrative safeguards
- Type
- Required
What the rule says
Implement procedures to regularly review records of information system activity, such as audit logs, access reports, and security incident tracking reports.45 CFR 164.308(a)(1)(ii)(D), as currently in force
In plain English: Having logs isn't enough. Someone has to look at them on a schedule, know what they're looking for, and write down that they looked and what they found.
What it means in practice
- Pairs with audit controls (164.312(b)): that standard makes the logs exist; this one makes someone read them.
- Has a defined scope: which systems, which reports, which signs of trouble (after-hours access, mass record views, new mailbox rules, failed logins, disabled MFA).
- Has a cadence your policy states and your records prove, often monthly for the EHR access log and weekly or continuous for security alerts.
- Produces a record each time: date, reviewer, what was examined, anything found, what was done.
- Escalates into the incident procedure when something looks wrong.
Somebody has to read the river. That's the short version of this requirement.Your engineer
What OCR looks for
If an investigation touches this requirement, the data request will ask for some or all of the following.
- The review procedure, with scope and frequency.
- Dated review records for the investigation period.
- Examples of findings and follow-up.
- Alert configurations where review is automated.
Where entities get caught
BayCare, $800,000, 2025: failures in access authorization, risk management and activity review after credentials belonging to a former employee of an affiliated physician practice were used to view and photograph a patient's records. Several ransomware settlements cite failure to regularly review activity.
Snooping cases are activity-review cases: the logs showed thousands of improper views and nobody had looked.
How to meet it at a small organization
For a small practice: a monthly 30-minute review of the EHR's access report sorted by user, a monthly look at email sign-in reports and new inbox rules, immediate review of security alerts from endpoint protection, and a one-line log entry each time. The review record is what you hand OCR; the platform or spreadsheet is where it lives.
Under the proposed Security Rule update
The proposal would require written procedures and would make the supporting technical controls, including audit logging and monitoring, explicit requirements reviewed at least every 12 months. The update was proposed in January 2025 and remains a proposal as of October 2026; see what's changing.
This page explains a federal regulation in plain language. It isn't legal advice, and AccuSights doesn't certify compliance; no one can. For every standard and specification, see the Security Rule, clause by clause.
With AccuSights: Connected systems are watched continuously, alerts route to your security officer and your engineer, and each review is recorded as it happens, so the six-year documentation accumulates without anyone remembering to write it.