# How long to keep audit logs under HIPAA HIPAA sets no retention period for audit logs. Its six-year rule covers written policies and required records, and OCR auditors ask for proof of log reviews. Updated: October 16, 2026 HIPAA's Security Rule doesn't say how long to keep audit logs. The audit controls standard, 45 CFR 164.312(b), asks you to record and examine activity, with no period attached. The six years people quote come from 164.316(b)(2)(i). That rule covers your written security policies and procedures, plus records of the actions the rule requires you to document. Your written log review procedure is one of them. OCR's auditors also ask for records showing the reviews took place, so keep those on the same schedule. How long to keep the raw logs from each system is a period you set in your own policy. ## What the audit controls rule asks for Section 164.312(b) asks for "hardware, software, and/or procedural mechanisms." They must "record and examine activity in information systems that contain or use electronic protected health information." That is patient health information kept or sent electronically, or ePHI. It's a standard with no implementation specifications under it, so there is nothing to label addressable. Section 164.306(c) requires you to comply with the standards, so you have to meet it. More on how the rule is built is in [What is the HIPAA Security Rule?](/guides/healthcare-access/what-is-the-hipaa-security-rule) A second provision makes the logs useful. Information system activity review, 164.308(a)(1)(ii)(D), is labeled required. It calls for procedures "to regularly review records of information system activity, such as audit logs, access reports, and security incident tracking reports." Neither provision says what to record, how often to look, or how long to keep anything. NIST SP 800-66r2, NIST's resource guide to the Security Rule, says to settle those from your risk assessment. Its sample questions for audit controls ask: - Which activities you'll audit, such as creating, viewing, changing, sending or deleting patient records. - What each audit record includes, such as the user, the type of event, and the date and time. - Whether every system that holds ePHI produces audit records. - How often logs are reviewed, and where audit information is kept. ## What the six-year rule covers Section 164.316(b)(1) has two parts. You keep the policies and procedures you use to comply with the Security Rule in writing, which may be electronic. And if the rule requires an action, activity or assessment to be documented, you keep a written record of it. Section 164.316(b)(2)(i) then sets the time: keep each document for six years from when it was written or when it stopped being in effect, whichever is later. That six years is the only retention period anywhere in the Security Rule, and 164.316 doesn't mention audit logs. OCR's audit protocol, the checklist HHS's Office for Civil Rights uses in audits, shows what it covers in practice. For 164.316(b)(2)(i), auditors check that policies and procedures are kept for six years. They also check records of required actions, activities and assessments. ## Why it gets read as a log rule A log is a record of activity, and 164.316(b)(1) speaks of keeping records of "the action, activity, or assessment." Since six years is the rule's only retention number, reading it onto logs is natural. But the rule ties that duty to actions the subpart requires you to document. The audit controls standard asks you to record and examine activity. It doesn't call the log itself documentation, and HHS hasn't set a log period in the rule. The January 2025 proposal points the same way. HHS proposed amendments to the Security Rule (90 FR 898). They would require written policies for keeping and reviewing activity records. The records would be kept "for a period of time that is reasonable and appropriate for the type of report or log" (proposed 164.308(a)(7)(ii)(D)). Even the proposal leaves the number to you. It hasn't been finalized. ## Making the retention decision Split what you keep into two groups. Keep the first group for six years. The policies fall under 164.316 directly, and the review records are what OCR asks to see: - Your policy for reviewing system activity, and each version of it. - The records that show reviews happened. OCR's audit protocol asks how reviews are documented. It asks for proof of which logs, access reports and incident reports were reviewed. It asks whether reviews were timely and signed off by the right people. - Decisions the rule asks you to write down, such as why you didn't implement an addressable specification (164.306(d)(3)). Your chosen log retention period belongs in your policy, so it's kept too. The second group is the raw logs from each system. Here you set the period, and write the reasons into your policy. Things to weigh: - How far back an investigation might need to look. A login stolen months ago can only be traced if the logs from then still exist. - What the system or vendor keeps by default. If it deletes logs after a set time, export them before then when you need them longer. - Protecting the logs. NIST asks where audit information will reside, such as a separate server. Logs kept apart from a system are harder for someone who misuses that system to erase. - Cost and volume. Longer retention means more storage. HHS's voluntary performance goals list centralized log collection as an enhanced goal, and stress cost effectiveness alongside visibility and faster response. ## Logs kept by your EHR or cloud vendor With a cloud EHR, telehealth platform or portal, the logs sit with the vendor. NIST's resource guide asks whether audit information will be stored outside your organization, for example with a cloud provider. A vendor that handles ePHI for you is your business associate ([What is a HIPAA business associate?](/guides/healthcare-access/what-is-a-hipaa-business-associate)). Before you rely on its logs, ask four things: - Does each log entry show the user, the action, the patient record and the time? - How long does the vendor keep logs, and can that be extended? - How do you get an export when you need one, in what format, and how fast? - Who at the vendor can see or change the logs? ## When the log can't name the person A log is only as good as the user name in it. HICP, guidance HHS publishes with industry through its 405(d) program, says organizations of every size need to identify all users. They also need audit trails that track each user's access. Unique user identification, 164.312(a)(2)(i), is labeled required for the same reason. On a shared login, the log shows the account, not the person. However long you keep that log, it can't say who acted. So for each shared login, keep a separate record of who used it and when. Logs for administrator accounts are covered in [What records to keep for privileged account audits](/guides/privileged-access/privileged-access-audit-records). ## Frequently asked questions **Does HIPAA require keeping audit logs for six years?** The rule doesn't say so. The audit controls standard sets no period. The six-year rule applies to written policies and procedures and to records of actions the rule requires you to document. **What does the six-year rule cover, then?** Your security policies and procedures, and records of required actions, activities and assessments. Keep each for six years, counted from when it was written or when it stopped being in effect, whichever came later. **How often do audit logs have to be reviewed?** The rule says "regularly" and gives no interval. NIST's HIPAA resource guide says to set the frequency from your risk assessment. **Would the proposed rule set a retention period for logs?** No fixed number. It would require written retention policies and a period that is reasonable and appropriate for each type of log. The proposal isn't final. ## Sources - [eCFR: 45 CFR 164.312, Technical safeguards](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.312) - [eCFR: 45 CFR 164.308, Administrative safeguards](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.308) - [eCFR: 45 CFR 164.316, Policies and procedures and documentation requirements](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.316) - [eCFR: 45 CFR 164.306, Security standards: General rules](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.306) - [eCFR: 45 CFR Part 164, Subpart C, Security Standards for the Protection of Electronic Protected Health Information](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C) - [HHS OCR: Audit Protocol (updated July 2018)](https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/audit/protocol/index.html) - [NIST SP 800-66r2, Implementing the HIPAA Security Rule: A Cybersecurity Resource Guide (February 2024)](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-66r2.pdf) - [HHS 405(d): HICP Technical Volume 1, Cybersecurity Practices for Small Healthcare Organizations (2023 Edition)](https://hhscyber.hhs.gov/Documents/HICP/tech-vol1-508.pdf) - [HHS: Healthcare and Public Health Sector Cybersecurity Performance Goals](https://hhscyber.hhs.gov/cybersecurity-performance-goals.html) - [Federal Register: HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information (proposed rule, 90 FR 898, January 6, 2025)](https://www.federalregister.gov/documents/2025/01/06/2024-30983/hipaa-security-rule-to-strengthen-the-cybersecurity-of-electronic-protected-health-information) ## How Junify handles this **Doing this by hand** You give every clinician and staff member their own login, open and close access for each per-diem shift and vendor staff change, and keep a record of who used which system and when for someone to review. **With Junify** Junify keeps the "who" your shared-login logs are missing. Staff verify on their own phone before they open an EHR or portal through Junify, so even on a shared login, each sign-in is recorded under the person's name, with the system and the time. You can export that record as a CSV. The record of what was done inside the system stays in that system, and you still set how long each log is kept. Junify is an access management service for handing work in your web accounts to employees, contractors and outside teams without giving them the password. Each person verifies on their own phone and clicks a card to sign in. The password is never shown, and Junify records who used which account and when. - [Try the demo](https://www.junify.com/bpo/try?lang=en&scenario=healthcare&from=guide&cluster=healthcare-access&slug=hipaa-audit-log-retention) - [Book a 30-minute demo](https://www.junify.com/bpo/demo) ## More on this topic - [Can staff use personal devices to access clinical systems?](/guides/healthcare-access/byod-for-clinical-systems): HIPAA allows it with safeguards. Treat each personal laptop or phone as a workstation, write a device policy, and protect both the device and the login. - [Who is responsible for user accounts in your practice's cloud software?](/guides/healthcare-access/clinic-saas-responsibility-split): The vendor secures its service. Your practice decides who gets a login and removes it when they leave. HHS says to sign a BAA and put the split in writing. - [The HHS cybersecurity performance goals for accounts and logins](/guides/healthcare-access/hhs-cybersecurity-performance-goals-accounts): Four of HHS's 10 essential goals cover logins: MFA, revoking departing staff's access, unique credentials and separate admin accounts. HHS calls them voluntary.