Audit logs are the EMR's memory of who did what. They're required by the HIPAA Security Rule's audit-control standard at 45 CFR 164.312, they're your primary tool for investigating inappropriate access, and they're often the first thing an investigator asks for after an incident. Most practices have them; far fewer actually use them. A log nobody reviews satisfies the letter of the requirement while delivering none of its protection, which is the gap this guide is meant to close. Here's how to do both — capture the right events and actually put them to work.
Know what should be logged
The Security Rule requires mechanisms to record and examine activity in systems that contain electronic PHI. In practice, your EMR should capture access and changes at the record level, not just at the system boundary — knowing that someone logged in tells you far less than knowing which charts they opened.
| Event | Why it matters |
|---|---|
| Record access (who viewed which chart) | Detecting snooping / unauthorized viewing |
| Logins / failed logins | Account compromise, brute-force attempts |
| Data changes | Integrity, amendments, who edited what |
| Privilege / config changes | Detecting misuse of admin rights |
| Exports / printing of PHI | Potential data exfiltration |
Confirm your EMR actually records each of these — defaults vary, and some systems log access only when configured to. It's worth verifying what your system captures out of the box before you rely on it, because the time to discover a gap is during a routine check, not in the middle of a breach investigation.
Review proactively, not just reactively
Watch for these patterns
- Employees viewing their own, family members', or coworkers' records without a care reason.
- Access to high-profile patients or to records unrelated to a user's assignments.
- Unusual export, print, or bulk-access activity.
- Logins at odd hours or from unexpected locations.
These patterns are worth understanding because they map to the most common real-world misuse. Employee snooping on a coworker's or relative's chart is among the most frequent inappropriate-access findings in healthcare, and it rarely looks like a sophisticated attack — it looks like a curious staff member opening a record they had no business opening. A small, consistent review program that targets exactly these patterns catches the overwhelming majority of problems.
Protect and retain the logs
- Restrict who can view and especially who can alter audit logs — separation of duties applies here too.
- Ensure logs are tamper-resistant; an attacker who can edit logs can erase their tracks.
- Retain logs per your policy and applicable requirements so they're available for investigations.
- Document your review process and findings as evidence the control is operating.
Connect logs to incident response
When something goes wrong — a suspected breach, a complaint, a lost device — your audit logs answer the critical questions: what was accessed, by whom, and when. Those answers also drive your legal obligations: determining the scope of a potential breach, and therefore whether and how you must notify affected patients, depends directly on what the logs show. An investigation that can pinpoint exactly which records a compromised account touched is far less disruptive than one that has to assume the worst because the evidence isn't there.
Make sure your incident-response plan names the logs you'll pull, who can pull them, and how quickly — the middle of an incident is the wrong time to figure out where the relevant data lives or who has rights to export it. Practice retrieving and reading the logs before you need them in anger, so the process is familiar. NIST's HIPAA Security Rule guidance frames audit controls and information-system activity review as core safeguards; treating them as a living program rather than a checkbox is what turns logging into actual protection.