ArticlesDecember 1, 2020, updated October 15, 202611 min read

HIPAA SIEM: Audit Logging and Monitoring Requirements

By UTMStack Team

A hospital, clinic or health plan can have every policy the Health Insurance Portability and Accountability Act (HIPAA) asks for and still fail an investigation by the Office for Civil Rights (OCR), the part of the Department of Health and Human Services (HHS) that enforces HIPAA. The problem can be simple: nobody can show who looked at which patient records, or the logs exist but nobody ever reviewed them. The HIPAA Security Rule does not mention a SIEM. It does require you to record activity in systems that hold electronic patient data, to review those records regularly and to act on what you find.

This guide covers the Security Rule clauses that drive logging, what to log in a healthcare environment, how long to keep logs, how logs affect the breach notification clock, and where the proposed update to the Security Rule stands in October 2026.

The short answer: HIPAA does not require a security information and event management (SIEM) system by name. It requires audit controls that “record and examine activity” in systems containing electronic protected health information, or ePHI (45 CFR 164.312(b) in the Code of Federal Regulations), regular review of audit logs and access reports (164.308(a)(1)(ii)(D)), monitoring of log-in attempts (164.308(a)(5)(ii)(C)) and incident response (164.308(a)(6)(ii)). There is no fixed retention period for logs, but required documentation must be kept for 6 years (164.316(b)(2)(i)). Once you have more than a few systems, a SIEM is the practical way to collect, review and keep that evidence.

The Security Rule clauses that drive logging

The Security Rule splits its requirements into standards and implementation specifications. Specifications marked “Required” must be implemented. Those marked “Addressable” are not optional: under 164.306(d)(3) you must implement them if reasonable and appropriate, or document why not and put an equivalent measure in place.

Clause	Name	Status	What it means for logging
164.308(a)(1)(ii)(A)	Risk analysis	Required	Your risk analysis decides which systems and events you log
164.308(a)(1)(ii)(D)	Information system activity review	Required	Regularly review audit logs, access reports and security incident tracking reports
164.308(a)(5)(ii)(C)	Log-in monitoring	Addressable	Monitor log-in attempts and report discrepancies
164.308(a)(6)(ii)	Response and reporting	Required	Identify and respond to incidents, limit harm, document incidents and outcomes
164.312(a)(2)(i)	Unique user identification	Required	Every user has their own account, so every log entry traces to a person
164.312(b)	Audit controls	Standard	Hardware, software or procedures that record and examine activity in systems with ePHI
164.312(c)(1)	Integrity	Standard	Protect ePHI from improper change or destruction; logs show who changed what
164.312(d)	Person or entity authentication	Standard	Verify that people are who they claim; authentication logs prove it
164.316(b)(2)(i)	Documentation time limit	Required	Keep required documentation 6 years from creation or last effective date

How the HIPAA clauses fit together

From deciding what to log to keeping the proof

DecideRisk analysis picks the systems and events to log. 164.308(a)(1)(ii)(A)
RecordAudit controls capture activity in systems with ePHI. 164.312(b)
ReviewRegular review of logs and access reports. 164.308(a)(1)(ii)(D)
RespondAct on incidents and document the outcome. 164.308(a)(6)(ii)
KeepRequired documentation for 6 years. 164.316(b)(2)(i)

Review is the easiest step to skip: logs that exist but are never examined do not meet 164.308(a)(1)(ii)(D).

What the rule leaves to you

The Security Rule is deliberately flexible. OCR’s own guidance on audit controls says the rule does not specify what information to collect from audit logs or how often to review audit reports. You decide both through your risk analysis, and you must be able to explain the decision.

That same guidance describes three kinds of audit trail, which make a useful starting point:

Application audit trails: user activity inside applications, such as opening, creating, reading, editing and deleting records that contain ePHI.
System-level audit trails: successful and failed log-on attempts, user names, dates and times, devices used and the applications accessed.
User audit trails: commands a user runs, authentication attempts and access to ePHI files and resources.

OCR also says audit trails should be reviewed regularly, both after incidents and during normal operations, and that access to them should be strictly limited to authorized staff.

What to log in a healthcare environment

Most healthcare networks mix clinical applications, a Windows domain, cloud email and devices that log little or nothing. This table lists the sources that usually matter most.

Source	Events to collect	Why it matters
Electronic health record (EHR) and other clinical applications	Record views, edits, prints and exports; emergency (“break the glass”) access; failed access	The only place that shows who opened which patient’s chart
Active Directory or Microsoft Entra ID	Sign-ins and failures, account creation and removal, group and privilege changes, password resets	Ties every action to a person and catches stolen accounts
Virtual private network (VPN) and remote access	Connections, source addresses, failed attempts	Remote access is a common way in
Firewalls and network devices	Allowed and blocked connections, configuration changes	Shows traffic from medical devices and other systems that cannot log themselves
Email and Microsoft 365	Mailbox access, new forwarding rules, unusual sign-ins	Patient data often travels by email
Endpoint protection	Malware detections, disabled protection	Early warning of ransomware
File servers and cloud storage	Access to folders with ePHI, mass downloads or deletions	Catches bulk copying and destructive activity
Backup systems	Failed jobs, deleted backups	Attackers often target backups before ransomware
Servers and databases	Administrator activity, audit log cleared or stopped	Proves logs are complete and untouched

With these sources in one place, a SIEM can watch for the patterns that matter in healthcare: a user opening far more records than usual, access to records of colleagues or well-known patients, sign-ins from two distant places within minutes, a mailbox forwarding rule to an outside address, or a server that suddenly stops sending logs.

How logs drive the breach notification clock

The Breach Notification Rule is where logging stops being abstract. You must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovering a breach (164.404(b)). A breach involving more than 500 residents of a state also requires notice to prominent media outlets (164.406), and breaches of 500 or more people must be reported to HHS at the same time as individual notices (164.408(b)). Smaller breaches go into a log reported to HHS within 60 days after the end of the calendar year.

Two details make logs central:

The clock can start before you notice. A breach is treated as discovered on the first day it was known, or would have been known by exercising reasonable diligence (164.404(a)(2)). Alerts that sat unread can count against you.
Logs decide the scope. Whether 40 or 4,000 records were viewed changes who you notify, whether HHS hears about it now or at year end, and whether the media must be told.

Business associates have the same discovery rule and must notify the covered entity (164.410).

How long to keep HIPAA logs

HIPAA sets no retention period for raw logs. What it does set is a 6-year period for the documentation the Security Rule requires: written policies and procedures, and records of actions the rule says to document, such as security incidents and their outcomes (164.316(b)(1) and (b)(2)(i)). The clock runs from creation or from the date a document was last in effect, whichever is later. Many organizations keep searchable logs for a shorter period set in policy, and keep log review records, reports and incident files for six years, because those records are how they show the reviews happened. State laws can require more for some records.

Our guide to HIPAA log retention requirements covers retention by log type, legal holds and storage tiers in detail.

Where the HIPAA Security Rule update stands

On January 6, 2025, HHS published a proposed rule to strengthen the Security Rule (90 FR 898). The comment period closed on March 7, 2025. As of October 2026 it is still a proposal, and the Security Rule text in the Code of Federal Regulations has not changed since 2013.

The proposed Security Rule update

Status of HHS rulemaking, Regulation Identifier Number (RIN) 0945-AA22

Jan 6, 2025Proposal publishedNotice of proposed rulemaking, 90 FR 898
Mar 7, 2025Comments closePublic comment period ends
May 2026First target missedSpring 2025 agenda had aimed for a final rule
Aug 2026Moved to long-term actions2026 Unified Agenda
Jul 2027New targetPlanned date for final action, not a deadline

Until a final rule is published and takes effect, the current Security Rule applies. Sources: Federal Register and Reginfo.gov.

In the 2026 Unified Agenda of federal regulations, published in August 2026, HHS lists the rule under long-term actions with final action planned for July 2027. The Spring 2025 agenda had aimed for May 2026. Agency target dates are plans, so the rule could still be finalized sooner, changed or withdrawn.

What the proposal would change for logging, if adopted as written:

A new standard for audit trail and system log controls. Regulated entities would have to deploy technology that monitors and records, in real time, all activity in relevant systems, identifies signs of unauthorized activity and alerts staff.
A more specific activity review. The proposal lists the records to review: audit trails, event logs, firewall logs, system logs, backup logs, access reports, anti-malware logs and incident tracking reports, with written review frequencies.
No more “addressable.” Almost all implementation specifications would become required, with limited exceptions.
Related technical duties: a written technology asset inventory and network map, multi-factor authentication, encryption, vulnerability scans at least every six months, penetration tests at least every 12 months and restoring critical systems within 72 hours.

None of this is law yet. But a SIEM that already monitors in real time, alerts on unauthorized activity and keeps a record of reviews would put you close to the proposed bar.

Recognized security practices can reduce penalties

Since January 2021, Public Law 116-321 has required HHS to consider whether a covered entity or business associate had “recognized security practices” in place for the previous 12 months when deciding fines, audit scope and other remedies. These include the Cybersecurity Framework of the National Institute of Standards and Technology (NIST) and the Health Industry Cybersecurity Practices published under section 405(d) of the Cybersecurity Act of 2015. HHS has said documenting the practices is not enough: you must show they were actually in use over the period. A year of SIEM alerts, reviews and closed incidents is exactly that kind of proof.

Cloud SIEMs and business associate agreements

Security logs can contain ePHI: patient names in file paths, email subjects or database queries. HHS guidance on cloud computing says a cloud provider that creates, receives, maintains or transmits ePHI for you is a business associate, even if it cannot read the data. So if your logs may contain ePHI and you use a cloud SIEM or a managed service, you need a business associate agreement with that provider. A SIEM you run on your own servers avoids that question for the logs themselves.

How UTMStack helps with HIPAA

UTMStack collects logs from Windows and Linux agents, Active Directory, firewalls, Microsoft 365 and the main cloud platforms, plus any application that can send syslog or the Common Event Format (CEF). Each event is checked against more than 600 detection rules as it arrives, before storage, and alerts become incidents your team can assign, document and close, which is the record 164.308(a)(6)(ii) asks for.

The HIPAA framework in the compliance module is part of the Enterprise edition. It evaluates controls such as log collection, access control and authentication, and real-time alerting from your own events, and produces PDF reports with reviewer sign-off for your activity review records. Retention is up to 5 years, with older data in a cold tier that stays searchable without a restore. Because UTMStack can run on your own servers, logs that might contain ePHI do not have to leave your network.

UTMStack is priced per device, never by log volume (pricing). You can explore UTMStack on sample data in the live demo, with no sign-up. For the wider program, see our guide to HIPAA compliance requirements, and for other frameworks, SIEM compliance requirements by framework.

Frequently asked questions

Does HIPAA require a SIEM? No. HIPAA requires audit controls, regular review of activity, log-in monitoring and incident response. It does not name a product. A SIEM is the common way to meet those requirements once logs come from many systems.

What are the HIPAA audit logging requirements? The core is 45 CFR 164.312(b): mechanisms that record and examine activity in systems with ePHI. It works with 164.308(a)(1)(ii)(D), which requires regular review of audit logs, access reports and incident tracking reports.

How long must HIPAA audit logs be kept? HIPAA sets no period for raw logs. Required documentation, such as policies and incident records, must be kept 6 years from creation or the date it was last in effect, whichever is later. Many organizations keep log review records for six years too.

Is log-in monitoring mandatory under HIPAA? It is addressable. You must implement it if reasonable and appropriate, or document why not and use an equivalent measure. For most organizations, monitoring log-in attempts is reasonable.

Has the HIPAA Security Rule changed in 2026? No. The update proposed in January 2025 has not been finalized. The 2026 Unified Agenda lists it as a long-term action with final action planned for July 2027.

Does a cloud SIEM need a business associate agreement? If the logs it stores may contain ePHI, yes. HHS treats a cloud provider that maintains ePHI as a business associate, even when it cannot read the data.