HIPAA Audit Controls Standard (45 CFR 164.312(b))

45 CFR 164.312(b)) is a single-line required standard: implement hardware, software, and procedural mechanisms that record and examine activity in information systems that contain or use ePHI.

The standard is technology-neutral. The Security Rule does not specify what events to log, what to retain, or for how long. Implementation flows from the risk analysis and the parallel administrative specification at 164.308(a)(1)(ii)(D)(1)(ii)(D)) which requires regular review of information system activity (audit logs, access reports, security incident tracking).

Practical baseline: every system that creates, receives, maintains, or transmits ePHI must produce audit logs covering authentication events (success and failure), access to records (read, modify, delete), administrative changes, and system events. Logs must be retained long enough to support investigations — six years is a defensible floor, aligned with the Privacy Rule documentation retention.

The 2024 NIST SP 800-66 r2 update walks audit-control selection in detail and points to NIST SP 800-92 ("Guide to Computer Security Log Management") as the procedural reference.