implement HIPAA-compliant audit logging for a health application

Steps

1. Log every access, create, update, delete, and disclosure event for records containing PHI; each log entry must capture who (user/system ID), what (resource type and ID), when (UTC timestamp), from where (IP address, device), and the outcome (success/failure).
2. Use an append-only log store (e.g. a write-once S3 bucket, a WORM-compliant database table, or a dedicated audit logging service) to prevent tampering or deletion of audit records.
3. Encrypt audit logs at rest using AES-256 or equivalent and in transit using TLS 1.2+; restrict read access to audit logs to security and compliance roles only.
4. Retain audit logs for a minimum of six years from the date of creation or last effective date, as required by the HIPAA Security Rule.
5. Implement automated alerts for anomalous patterns such as bulk exports, access outside normal hours, repeated failed authentication attempts, or access to records by users without a care relationship.
6. Periodically review audit logs and document reviews as part of your HIPAA risk management program; prepare log export procedures for breach investigations.