Audit Controls & Activity Review Procedures

2. Log-in monitoring and discrepancy reporting (164.308(a)(5)(ii)(C))

1. Configure the [cloud productivity & storage suite] and the [identity provider / single sign-on] to surface authentication activity and to alert on high-risk login events (repeated failed sign-ins, new-device or new-location sign-ins, impossible-travel, use of disabled/terminated accounts); route alerts to a monitored mailbox or alias.
2. During the scheduled review (§3), examine failed-authentication trends and anomalous sign-ins.
3. Any workforce member who notices a login discrepancy (activity they did not perform, an unexpected MFA prompt, a mismatched "last sign-in") reports it promptly to the [Security Official].
4. The [Security Official] evaluates the discrepancy; if it suggests compromise, hand it off to the incident process per §4. Record the discrepancy and its disposition either way.

3. Scheduled activity-review SOP and cadence (164.308(a)(1)(ii)(D))

1. Open the review. At the defined cadence (high-risk alerts triaged as they occur; a documented review at least [quarterly]), the [Security Official] opens a review record in the [compliance tracking system] and assigns a reviewer who is not reviewing their own activity.
2. Pull the evidence. The reviewer collects the in-scope reports for the period (ePHI access activity, privileged-account use, sharing/permission changes, failed-authentication trends) and any open security-alert and incident-tracking entries.
3. Review. The reviewer confirms (a) activity is appropriate and consistent with role and least-privilege, and (b) the expected data is being captured and retained. Findings are recorded on the review record and categorized (routine vs. significant).
4. Investigate and remediate. Routine findings are tracked to remediation; significant findings are escalated per §4. The record is updated as items close.
5. Sign off. The [Security Official] approves the completed review (returning it for more detail if needed) and marks it done with any notes. Where the reviewer is also the administrator, attach a short attestation (date, scope covered, and a statement that findings and corrections were recorded) and, where feasible, obtain a periodic external spot-check for independence.
6. Trigger events. Treat the following as prompts for additional, possibly for-cause, review: high-risk incidents, complaints from a customer/business associate/partner, known vulnerabilities, atypical activity patterns, failed-authentication spikes, remote-access anomalies, and post- termination account activity.

4. Alert-to-incident handoff (164.308(a)(1)(ii)(D))

1. Classify. When an alert, review finding, or reported discrepancy indicates a confirmed or suspected compromise, unauthorized ePHI access, data loss, or other security event, the [Security Official] classifies it as a suspected security incident.
2. Hand off. Open an incident under the Security Incident Response Policy, attaching the triggering evidence (alert, log excerpt, review note). Triage, investigation, containment, breach-assessment, and notification are performed under that policy. Do not perform or duplicate those steps here.
3. Preserve. Preserve the relevant logs and review artifacts as evidence; do not modify them.
4. Close the loop. Once the incident is resolved, cross-reference the incident record from the review record so the activity-review trail shows the event was tracked to closure.

5. Retention of audit records (164.312(b))

1. Retain audit logs and all review records (notes, findings, remediation, attestations) for at least 6 years.
2. Keep retained logs under restricted access; if moving them to lower-cost storage via lifecycle management, preserve their integrity protection and access controls.

Records produced (evidence)

Logging-configuration records and risk-analysis notes · login-monitoring alert settings and discrepancy reports · [quarterly] activity-review records with findings, sign-offs, and attestations · alert-to-incident handoff references · retained audit logs. These are the artifacts an auditor will request to confirm the controls operate.

HIPAA controls addressed

Review & version

Reviewed at least annually by the [Security Official]. v1.0.