What access logs need to show when you decide whether to report a breach

After a security incident, access logs answer the questions that decide whether you must notify anyone, and whom. They show whether data was actually opened or copied, which records were involved, how many people they belong to, when it started and who was behind the access. HIPAA presumes a breach unless you can show a low probability that data was compromised, and access logs are usually the main record that can show it.

Why logs carry the decision under HIPAA

HIPAA’s breach notification rule defines a breach in 45 CFR 164.402. It means the acquisition, access, use or disclosure of protected health information in a way the Privacy Rule doesn’t permit, which compromises its security or privacy. Paragraph (2) of the definition adds a presumption. An impermissible use or disclosure “is presumed to be a breach unless” the covered entity or business associate shows a low probability of compromise through a risk assessment.

The assessment must consider at least four factors:

1. The nature and extent of the information, including the types of identifiers and how likely re-identification is.
2. The unauthorized person who used the information or to whom it was disclosed.
3. Whether the information was actually acquired or viewed.
4. How far the risk has been mitigated.

Factors 2 and 3 are questions about access, and logs answer them. Section 164.414(b) puts the burden of proof on the covered entity or business associate, and 164.530(j)(1)(iv) requires documentation sufficient to meet it.

When a breach of unsecured protected health information requires notice, 164.404 requires it without unreasonable delay and no later than 60 calendar days after discovery. A breach counts as discovered on the first day it’s known, or would have been known with reasonable diligence. To the extent possible, the notice must describe what happened, including the breach date and discovery date if known, and the types of information involved.

What state laws ask you to report

State breach laws ask similar questions. Washington’s RCW 19.255.010 applies when personal information was, or is reasonably believed to have been, acquired by an unauthorized person. Notice isn’t required if the breach is not reasonably likely to subject consumers to a risk of harm. When a breach requires notice to more than 500 Washington residents, the attorney general must receive, within 30 days of discovery, items including:

• The number of Washington consumers affected, or an estimate if the exact number isn’t known.
• The types of personal information that were, or are reasonably believed to have been, involved.
• The time frame of exposure, if known, including the breach date and the discovery date.
• A summary of the steps taken to contain the breach.

California’s Civil Code 1798.82 uses a similar trigger for a person or business. The California Attorney General’s office asks for a sample copy of the notice when one breach requires notice to more than 500 California residents.

Public companies and SEC Form 8-K

A company that files with the Securities and Exchange Commission (SEC) has a separate clock. Under Instruction 1 to Form 8-K Item 1.05, the company must decide whether an incident is material without unreasonable delay after discovering it. If it’s material, Form 8-K’s general instructions then give four business days after that decision. It must describe the material aspects of the incident’s nature, scope and timing, and its material impact or reasonably likely material impact.

If those facts aren’t known by the deadline, the filing says so. The company then files an amendment within four business days after it determines the information or the information becomes available. Instruction 4 says the company need not give technical details that would impede its response or remediation.

What each question needs from your logs

Sign-in records alone fill only part of this table. If the log shows that an account signed in but not what it opened, you may have to count every record that account could reach.

Why a shared login weakens the record

With a shared login, the log names an account, not a person. A current employee doing their job, a former employee who still knows the password, and an outsider who stole it all look the same. That matters under HIPAA, because the definition’s first exception covers good-faith, unintentional access by a workforce member acting within their authority. You can’t apply it until you know which workforce member it was. The second factor of the risk assessment, the unauthorized person, also can’t be answered from the log.

Interviews and other records can narrow it down, but they take time inside the same 30- or 60-day window. For more on what a shared account is and why it hides the person, see What is a shared account?

What to check before an incident

1. On each system that holds personal or health information, does each logged ID point to one person? HIPAA requires a unique name or number for identifying and tracking each user (164.312(a)(2)(i)).
2. Do the logs show what was opened and exported, not only sign-ins? The audit controls standard (164.312(b)) asks for mechanisms that record and examine activity in systems with health information.
3. How far back do the logs go? If an intrusion goes unnoticed for weeks, a shorter window loses its start. For HIPAA retention, see How long to keep audit logs under HIPAA.
4. Who can delete or change the logs? If the person under review can delete log entries, a log with no sign of access doesn’t prove that none happened.