Audit log

An audit log is a system's own record of who did what and when. HIPAA expects practices to keep this kind of record for systems that hold patient data and to review it regularly. A log on its own proves nothing until someone reads it.

What is an audit log?

An audit log is a time-stamped record of who accessed, changed or exported data in a system, used to review activity and investigate security incidents. A typical entry shows the user, the action (view, edit, export, delete, permission change), the timestamp, and sometimes the device or IP address. "Audit trail" is commonly used as a synonym.

In practice at a clinic or small practice

Most staff never open an audit log, but their logins and record views are written to one. The EHR records which user opened a patient's chart. The scheduling or billing system logs who moved an appointment or edited a claim. The office manager or privacy officer pulls these logs when a patient asks who viewed their record, or when a staff member's access looks unusual. One example is a front desk account opening charts for patients who had no visit that day.

The same idea applies to staff tools such as email, file storage and team chat. When a practice evaluates a staff messaging tool, IT asks whether it logs admin activity, such as users added or removed and role changes, and whether it logs file downloads and exports. Chanty is one example. Its audit trail covers user and admin actions, and AI-agent actions on the Enterprise plan, the only plan that includes AI agents. A staff chat tool's log covers activity in that tool only. It does not replace the EHR's audit trail. See security, HIPAA and BAA details.

Not to be confused with

Accounting of disclosures. This is a patient's right to a list of certain disclosures of their PHI to outside parties. It is a Privacy Rule obligation (45 CFR 164.528), not a raw system log, though logs may help a practice produce it.

Activity feed or notifications. These are what users see inside an app, such as "Maria edited this file." An activity feed is usually not tamper-resistant and may be incomplete. It also typically cannot be exported in a form that supports an investigation.

What the rules say

• Audit controls. Under the HIPAA Security Rule, covered entities and business associates must implement hardware, software or procedural mechanisms that record and examine activity in information systems that contain or use ePHI (45 CFR 164.312(b)). Audit controls are a required standard, not an addressable one. See addressable vs required safeguards.
• Information system activity review. Practices must regularly review records of system activity, such as audit logs, access reports and security incident tracking reports (45 CFR 164.308(a)(1)(ii)(D)). Collecting logs that nobody reviews does not meet this expectation.
• Format and retention. HIPAA does not prescribe a specific log format or a retention period for audit logs themselves. The six-year retention rule applies to required policies and documentation (45 CFR 164.316(b)(2)). Each practice sets its own log retention through its risk analysis.
• Certified EHR technology. ONC health IT certification includes criteria for auditable events and tamper-resistance, and for audit reports, in certified EHR technology (45 CFR 170.315(d)(2) and (d)(3)).

Your obligations depend on your systems and your risk analysis. Check current HHS guidance and confirm the details with your privacy officer or counsel.

Related reading

• HIPAA Security Rule: where audit controls sit among the technical safeguards.
• Addressable vs required safeguards: why audit controls are not optional.
• Security, HIPAA and BAA details: how a staff chat tool handles logging, permissions and the BAA.
• Healthcare operations glossary: more terms from security reviews and software evaluations.