Implement Audit Logging

[suhasramanand]

Implement hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use ePHI.

Acceptance criteria

• Log all access attempts (successful and failed)
• Log all user authentication events
• Log modifications to ePHI
• Timestamp, user ID, action, resource accessed, source IP
• 6-year retention
• Tamper-evident

---

Source: § 2.2.1

Covered entities MUST implement hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use ePHI.