HIPAA Audit Log Requirements: What to Log and the 6-Year Documentation Rule

What to Log (Practical Baseline)

• Successful and failed authentication to ePHI systems
• Access, create, modify, export, and delete events for ePHI records where systems support it
• Privileged / break-glass access and admin configuration changes
• Security tool alerts that indicate potential inappropriate PHI access or exfiltration

Documentation vs Operational Logs

Product Path

For a ThreatHawk-centric view of automated HIPAA audit logging, see How ThreatHawk SIEM Automates HIPAA Audit Logging and the solution page HIPAA-Compliant SIEM.

How CyberSilo Helps

• ThreatHawk centralises ePHI-system telemetry for examination and incident timelines
• CSA stores the policies, risk analyses, and review procedures that 164.316 expects you to keep

Frequently Asked Questions

Does HIPAA require 6 years of SIEM logs?

164.316(b)(2) requires retaining Security Rule documentation for 6 years. Operational log retention should be risk-based to support §164.312(b) audit controls — not confused with a separate 6-year log statute.

What does §164.312(b) require?

Hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use ePHI.

Where should audit evidence live?

In systems that can produce searchable timelines (often a SIEM) plus documented review procedures and retention of Security Rule documentation.

Related HIPAA Resources

HIPAA hub · OCR prep · §164.312 · ThreatHawk