How long to keep audit logs under HIPAA

HIPAA’s Security Rule doesn’t say how long to keep audit logs. The audit controls standard, 45 CFR 164.312(b), asks you to record and examine activity, with no period attached. The six years people quote come from 164.316(b)(2)(i). That rule covers your written security policies and procedures, plus records of the actions the rule requires you to document. Your written log review procedure is one of them. OCR’s auditors also ask for records showing the reviews took place, so keep those on the same schedule. How long to keep the raw logs from each system is a period you set in your own policy.

What the audit controls rule asks for

Section 164.312(b) asks for “hardware, software, and/or procedural mechanisms.” They must “record and examine activity in information systems that contain or use electronic protected health information.” That is patient health information kept or sent electronically, or ePHI. It’s a standard with no implementation specifications under it, so there is nothing to label addressable. Section 164.306(c) requires you to comply with the standards, so you have to meet it. More on how the rule is built is in What is the HIPAA Security Rule?

A second provision makes the logs useful. Information system activity review, 164.308(a)(1)(ii)(D), is labeled required. It calls for procedures “to regularly review records of information system activity, such as audit logs, access reports, and security incident tracking reports.”

Neither provision says what to record, how often to look, or how long to keep anything. NIST SP 800-66r2, NIST’s resource guide to the Security Rule, says to settle those from your risk assessment. Its sample questions for audit controls ask:

• Which activities you’ll audit, such as creating, viewing, changing, sending or deleting patient records.
• What each audit record includes, such as the user, the type of event, and the date and time.
• Whether every system that holds ePHI produces audit records.
• How often logs are reviewed, and where audit information is kept.

What the six-year rule covers

Section 164.316(b)(1) has two parts. You keep the policies and procedures you use to comply with the Security Rule in writing, which may be electronic. And if the rule requires an action, activity or assessment to be documented, you keep a written record of it. Section 164.316(b)(2)(i) then sets the time: keep each document for six years from when it was written or when it stopped being in effect, whichever is later.

That six years is the only retention period anywhere in the Security Rule, and 164.316 doesn’t mention audit logs. OCR’s audit protocol, the checklist HHS’s Office for Civil Rights uses in audits, shows what it covers in practice. For 164.316(b)(2)(i), auditors check that policies and procedures are kept for six years. They also check records of required actions, activities and assessments.

Why it gets read as a log rule

A log is a record of activity, and 164.316(b)(1) speaks of keeping records of “the action, activity, or assessment.” Since six years is the rule’s only retention number, reading it onto logs is natural. But the rule ties that duty to actions the subpart requires you to document. The audit controls standard asks you to record and examine activity. It doesn’t call the log itself documentation, and HHS hasn’t set a log period in the rule.

The January 2025 proposal points the same way. HHS proposed amendments to the Security Rule (90 FR 898). They would require written policies for keeping and reviewing activity records. The records would be kept “for a period of time that is reasonable and appropriate for the type of report or log” (proposed 164.308(a)(7)(ii)(D)). Even the proposal leaves the number to you. It hasn’t been finalized.

Making the retention decision

Split what you keep into two groups.

Keep the first group for six years. The policies fall under 164.316 directly, and the review records are what OCR asks to see:

• Your policy for reviewing system activity, and each version of it.
• The records that show reviews happened. OCR’s audit protocol asks how reviews are documented. It asks for proof of which logs, access reports and incident reports were reviewed. It asks whether reviews were timely and signed off by the right people.
• Decisions the rule asks you to write down, such as why you didn’t implement an addressable specification (164.306(d)(3)). Your chosen log retention period belongs in your policy, so it’s kept too.

The second group is the raw logs from each system. Here you set the period, and write the reasons into your policy. Things to weigh:

• How far back an investigation might need to look. A login stolen months ago can only be traced if the logs from then still exist.
• What the system or vendor keeps by default. If it deletes logs after a set time, export them before then when you need them longer.
• Protecting the logs. NIST asks where audit information will reside, such as a separate server. Logs kept apart from a system are harder for someone who misuses that system to erase.
• Cost and volume. Longer retention means more storage. HHS’s voluntary performance goals list centralized log collection as an enhanced goal, and stress cost effectiveness alongside visibility and faster response.

Logs kept by your EHR or cloud vendor

With a cloud EHR, telehealth platform or portal, the logs sit with the vendor. NIST’s resource guide asks whether audit information will be stored outside your organization, for example with a cloud provider. A vendor that handles ePHI for you is your business associate (What is a HIPAA business associate?). Before you rely on its logs, ask four things:

• Does each log entry show the user, the action, the patient record and the time?
• How long does the vendor keep logs, and can that be extended?
• How do you get an export when you need one, in what format, and how fast?
• Who at the vendor can see or change the logs?

When the log can’t name the person

A log is only as good as the user name in it. HICP, guidance HHS publishes with industry through its 405(d) program, says organizations of every size need to identify all users. They also need audit trails that track each user’s access. Unique user identification, 164.312(a)(2)(i), is labeled required for the same reason. On a shared login, the log shows the account, not the person. However long you keep that log, it can’t say who acted. So for each shared login, keep a separate record of who used it and when. Logs for administrator accounts are covered in What records to keep for privileged account audits.