Compliance Framework

HIPAA Audit Logging Requirements

HIPAA requires covered entities and business associates to implement audit controls that record and examine activity in systems containing electronic protected health information (ePHI).

Overview

HIPAA is the primary regulatory framework governing the security and privacy of health information in the United States. The Security Rule (45 CFR Part 164) specifically mandates audit controls under section 164.312(b). Any SaaS platform that stores, processes, or transmits ePHI must maintain comprehensive audit trails. HIPAA violations can result in fines ranging from $100 to $50,000 per violation, with annual maximums of $1.5 million per violation category.

Key facts

HIPAA applies to covered entities (healthcare providers, health plans, clearinghouses) and their business associates

The HHS Office for Civil Rights has imposed over $130 million in HIPAA fines since 2003

Audit log requirements are addressable specifications, meaning organizations must assess and implement if reasonable

Business Associate Agreements (BAAs) must address audit logging responsibilities

Retention period: 6 years from creation date or last effective date (per 45 CFR 164.530(j))

Audit logging requirements

164.312(b) - Audit Controls

Implement hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use electronic protected health information.

How AuditKit helps: Comprehensive event capture with SHA-256 hash chains for tamper-evident logging

164.312(c)(1) - Integrity Controls

Implement policies and procedures to protect electronic protected health information from improper alteration or destruction.

How AuditKit helps: Merkle tree proofs provide mathematical proof that audit records have not been altered

164.312(d) - Person or Entity Authentication

Implement procedures to verify that a person or entity seeking access to ePHI is who they claim to be.

How AuditKit helps: Authentication event logging captures identity verification details for every access attempt

164.308(a)(5)(ii)(C) - Log-in Monitoring

Procedures for monitoring log-in attempts and reporting discrepancies.

How AuditKit helps: Real-time authentication event streaming with anomaly detection support

Frequently asked questions

What audit logging does HIPAA require?

HIPAA Security Rule section 164.312(b) requires audit controls that record and examine activity in systems containing ePHI. This includes logging access to patient records, authentication events, data modifications, and system administration actions. AuditKit provides HIPAA-compliant audit logging with tamper-proof hash chains and configurable 6-year retention.

Does AuditKit sign a BAA for HIPAA compliance?

AuditKit offers Business Associate Agreements (BAAs) for healthcare customers on paid plans. The platform is designed with HIPAA requirements in mind, including encryption at rest and in transit, access controls, and audit logging that meets 164.312(b) requirements.

Related compliance frameworks

Related resources

Get HIPAA-ready with AuditKit

Tamper-proof audit logging that satisfies HIPAA requirements. Start from $99/mo with no lock-in.