HIPAA Glossary · Security Rule concepts
Audit controls
Mechanisms that record and allow examination of activity in systems containing ePHI — plus, in practice, somebody actually reviewing the output.
Context
Required by §164.312(b). The rule requires audit controls to exist; §164.308(a)(1)(ii)(D) requires activity review on a cadence. The common failure is logs that exist but are never reviewed — a configuration that satisfies 312(b) but fails 308(a)(1)(ii)(D). See [MFA & Logging](/platform/mfa-and-logging/).
Related terms
- Technical safeguards — Access control, audit controls, integrity, authentication, and transmission security for ePHI.
Where this fits
This is one of 50+ terms in the HIPAA Glossary. For how HIPAA is structured end-to-end, see the Security Rule guide and the Privacy Rule guide.