Audit Controls & Activity Review Policy

Policy

1. Audit controls and what is logged (164.312(b))

[Organization] implements hardware, software, and procedural mechanisms that record activity in systems containing ePHI. Wherever the platform supports it, audit records capture who performed an action, what action (view, create, download, share, edit, delete, export, permission/configuration change), when (date and time), the target (file, record, or resource), and the source (user account, device, and where available the IP/network). At minimum, logging is enabled for:

• access to ePHI in the [cloud productivity & storage suite]: successful and failed attempts to access, download, share, edit, or delete ePHI files and folders;
• administrative and security-relevant actions: account and privilege changes, sharing/permission changes, and other configuration changes in systems that hold or govern access to ePHI;
• authentication events: successful and failed sign-ins, including on endpoints authorized for ePHI;
• endpoint security signals: malware/endpoint-protection detections and host-firewall events on authorized devices, where the platform can surface them.

Logging coverage is defined for the user, application, system/endpoint, and (where applicable) network levels. Where a level cannot be feasibly logged given [Organization]'s size and stack, the gap and the compensating control are documented in the risk analysis.

2. Protection and integrity of audit records (164.312(b))

Audit records are protected so they can be relied on as evidence:

• access to logs and review artifacts is restricted to authorized roles on a least-privilege basis;
• the ability to alter or delete audit/log data is withheld from ordinary users and, wherever supported, from administrators of the logged system (separation between acting and auditing);
• logs are protected against tampering using platform integrity features (append-only / write-once storage, log-file integrity validation, or equivalent) and are encrypted in transit and at rest;
• named (non-shared) accounts are used so that access to, and actions on, the logs are themselves attributable and auditable.

3. Log-in monitoring and discrepancy reporting (164.308(a)(5)(ii)(C))

[Organization] monitors authentication activity for ePHI-relevant systems for indicators of misuse: for example, repeated failed sign-ins, access from unexpected locations or devices, sign-ins at atypical times, impossible-travel patterns, and use of disabled or terminated accounts. Workforce members must report any login discrepancy they notice (an account showing activity the owner did not perform, an unexpected MFA prompt, or a "last sign-in" that does not match their own use) promptly to the [Security Official]. Where the platform supports it, high-risk login events generate automated alerts to a monitored mailbox or alias. A login discrepancy that suggests compromise is treated as a suspected security incident and escalated under the Security Incident Response Policy.

4. Regular activity review (164.308(a)(1)(ii)(D))

[Organization] regularly reviews records of information system activity (audit logs, access reports, and security-incident tracking) to confirm that activity is appropriate and that the logging itself is functioning. The review program is risk-based and operates on a defined cadence:

• Automated alerts for high-risk events (admin changes, suspicious logins, mass downloads, sharing/permission changes, malware detections) are triaged as they occur.
• A documented log and access-report review is performed at least [quarterly] by the [Security Official] or a designated reviewer, covering a defined scope (e.g., ePHI access activity, privileged-account use, sharing changes, failed-authentication trends) and confirming that the expected data is being captured and retained.
• Incident-tracking review confirms that alerts and reported discrepancies were logged, investigated, and closed.

Reviewers do not review their own activity. Where [Organization]'s size makes independent review infeasible (e.g., the [Security Official] is also the platform administrator), the following compensating controls apply: (i) dated, immutable or versioned review evidence (exports/snapshots plus a signed review note) stored in a restricted location; (ii) the platform's native audit logs as the authoritative system of record; (iii) alerting for high-risk events; and (iv) where feasible, a periodic (e.g., annual) external spot-check of one or more reviews for independence. This role consolidation and rationale are documented in the risk analysis.

5. Escalation to the incident process (164.308(a)(1)(ii)(D))

Any review finding, alert, or reported discrepancy that indicates a confirmed or suspected compromise, unauthorized access to ePHI, data loss, or other security event is escalated without delay to the Security Incident Response Policy process. Routine findings (e.g., a misconfiguration or an access that needs tightening) are recorded and tracked to remediation. The full triage, investigation, containment, breach-assessment, and notification steps are defined in the Security Incident Response Policy and are not duplicated here.

6. Cause-based (for-cause) audits (164.308(a)(1)(ii)(D))

In addition to routine review, an audit may be requested for a specific cause (for example, a complaint, a suspected violation, or an unusual access pattern). A for-cause request states the timeframe, scope, and nature of the audit and is approved by the [Security Official] before it proceeds. Detailed audit information is shared only with authorized parties on a minimum-necessary basis; if an audit reveals that a workforce member accessed ePHI inappropriately, the matter is referred for sanctions under the Workforce Security, Training & Sanctions Policy. Only de-identified results are shared with third parties, and counsel is consulted before any external communication.

7. Retention of audit records (164.312(b))

Audit logs and the records of their review (review notes, findings, remediation, attestations) are retained for at least 6 years to meet HIPAA documentation requirements, stored with restricted access, and may be moved to lower-cost protected storage via lifecycle management as long as integrity and access controls are preserved.

Roles & Responsibilities

• [Security Official]: owns this Policy; defines audit scope, parameters, and cadence; performs or assigns log-in monitoring and activity review; approves for-cause audits; ensures escalation to the incident process.
• System / application owners: generate the audit reports for their systems and ensure logging is enabled and configured.
• Reviewers: perform the scheduled reviews (never of their own activity) and document findings.
• Workforce members: protect their credentials and report login discrepancies and suspected misuse promptly.

Related documents

Audit Controls & Activity Review Procedures · Security Incident Response Policy · Access Control Policy · Workforce Security, Training & Sanctions Policy · Information System Activity Review evidence (review logs).

HIPAA controls addressed

Review & version

Reviewed at least annually by the [Security Official] and after any significant change to the ePHI environment. v1.0.