It is helpful to occasionally reassess the processes covered entities use to meet compliance obligations under HIPAA regulations. One of those is user access monitoring. This is not a term used in HIPAA regulations; however, guidance from U.S. Department of Health & Human Services Office for Civil Rights (OCR) clearly identifies user audit controls as necessary.^[1]

Under the HIPAA Security Rule, covered entities and business associates have an obligation to have policies and procedures in place to prevent, detect, contain, and correct security violations.^[2] The regulations also require covered entities and business associates to “Implement procedures to regularly review records of information security system activity, such as audit logs, access reports and security incident tracking reports.”^[3] It also dictates the implementation of hardware, software, and/or procedural processes that record and examine activity in information systems containing electronic protected health information (ePHI).^[4]