HIPAA Audit Logging Requirements: What to Log, How Long to Keep It

What HIPAA Actually Requires for Audit Logs

HIPAA's Security Rule (45 CFR § 164.312) requires mechanisms to record and examine activity in systems that contain PHI. This is the Audit Controls standard.

What HIPAA does not specify: exact log format, which specific events must be logged, or required granularity. This gives engineers flexibility — but also means many teams underestimate what hospital security audits actually expect.

What Hospital Security Teams Look For

1. User-level access logging: Who accessed which PHI record, when, from where
2. Mutation logging: Who created, updated, or attempted to delete a PHI record
3. Authentication events: Successful and failed login attempts, with timestamp and IP
4. Privilege escalation: Any event where a user's permissions were elevated
5. Configuration changes: Infrastructure or application changes to systems holding PHI
6. Log retention: Minimum 6 years (HIPAA's documentation retention requirement)

The Application-Level Implementation

import json, boto3
from datetime import datetime, timezone

cloudwatch = boto3.client("logs")

def log_phi_access(
    user_id: str,
    patient_id: str,
    action: str,        # "READ" | "CREATE" | "UPDATE" | "DELETE"
    resource_type: str, # "Patient" | "Observation" | "TimeLog"
    ip_address: str,
    success: bool
):
    event = {
        "timestamp": datetime.now(timezone.utc).isoformat(),
        "user_id": user_id,
        "patient_id": patient_id,
        "action": action,
        "resource_type": resource_type,
        "ip_address": ip_address,
        "success": success,
        "event_type": "PHI_ACCESS"
    }
    cloudwatch.put_log_events(
        logGroupName="/hipaa/phi-access",
        logStreamName=datetime.now().strftime("%Y/%m/%d"),
        logEvents=[{
            "timestamp": int(datetime.now().timestamp() * 1000),
            "message": json.dumps(event)
        }]
    )

Critical: PHI access logs must be immutable. Application roles must not have DeleteLogEvents or DeleteLogGroup permissions on the HIPAA log groups. S3 with Object Lock (WORM mode) for log archives adds a second layer of protection.

The 6-Year Retention Requirement

resource "aws_cloudwatch_log_group" "phi_access" {
  name              = "/hipaa/phi-access"
  retention_in_days = 2190  # 6 years
  kms_key_id        = aws_kms_key.phi.arn
}

If CloudWatch becomes expensive at 6-year retention, archive logs older than 90 days to S3 Glacier with a lifecycle policy — Glacier storage is ~$0.004/GB/month vs CloudWatch's $0.03/GB. Both satisfy the retention requirement.

Audit Logs Enable More Than Compliance

When a patient requests an accounting of PHI disclosures (a guaranteed HIPAA right), audit logs are how you fulfill it. When a security incident occurs, they're forensic evidence. When a billing dispute arises, they prove what data was accessed and when.

Audit logging is also the evidence layer for Zero Trust architecture — continuous verification requires continuous logging. It's required by both HIPAA and SOC 2 Type II auditors; building it once satisfies both.

The HIPAA & SOC 2 Cloud Architecture service includes full audit logging infrastructure — immutable logs, 6-year retention, and PHI access reporting.