Burden 1: HIPAA Audit Requirements
HIPAA §164.312(b) — Audit Controls
“Implement hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use electronic protected health information.”
What This Means in Practice:
Healthcare organizations must:
1. RECORD all access to ePHI systems (who, what, when, where)
2. EXAMINE activity (review logs for unauthorized access)
3. RETAIN logs for 6 years (HIPAA minimum retention)
4. PROVE logs are complete and unaltered (integrity verification)
Current State (Manual Compliance):
Audit preparation (annual or post-breach):
Week 1: Identify all systems containing ePHI
Week 2: Export logs from multiple sources
Week 3: Correlate logs manually
Week 4: Fill gaps (some systems don't log adequately)
Week 5: Format into assessor-readable report
Total: 5 weeks, 200 hours, $16,000 labor cost
Questions Healthcare IT Can't Answer:
"Show me every person who accessed patient record #12345 in the last 6 months."
Problem: Logs don't correlate patient records to infrastructure access
"Prove these logs haven't been modified since the incident."
Problem: Logs stored in /var/log (editable files, no integrity proof)
"Show me the complete chain of custody for the database restart on March 15."
Problem: Engineer restarted DB manually, didn't document who/why/when
"What actions did user john.doe@hospital.org take on production systems last year?"
Problem: Logs rotated after 30 days, older data gone
Result: Incomplete audit evidence, failed assessments, or expensive remediation.