Put an empty investigation worksheet beside the vendor’s demo screen. Ask the presenter to reconstruct 12 minutes in a test chart: one failed sign-in, one read, one correction, one export, and one role change. The useful product is not the prettiest activity page. It is the system that can produce a defensible sequence without a support engineer narrating around missing events.
The procurement standard is concise: show the event, preserve its history, and hand over usable evidence. HIPAA requires audit controls, not a particular dashboard or brand. Six years applies to required compliance documentation; the audit-controls paragraph does not assign one blanket term to every raw log.
This is an operational review aid, not legal advice. State law, payer contracts, and the practice’s risk analysis may add duties.
Start at the export
The HIPAA Security Rule says a regulated entity must implement mechanisms that record and examine activity in systems containing or using electronic protected health information. The text is at 45 CFR 164.312(b). It does not name an EHR feature tier, a SIEM, or a magic report.
That brevity pushes the hard work back to the practice. HHS’s audit protocol asks how activity is recorded, what is reviewed, how often reviews occur, and what evidence shows the procedure is followed. Buying software with an “audit log” menu item answers none of those questions by itself.
Score whether the sequence can be reconstructed
Use this as a vendor-demo scorecard. Mark a row only after the vendor shows the event and its export.
| Event | Minimum evidence | Demo test |
|---|---|---|
| Sign-in | user, time, device or location clue, result | fail a sign-in, then find it |
| Chart read | user, patient or record, time, action | open a chart without editing it |
| Create or edit | author, object, time, old and new state or version link | correct one demographic field |
| Delete or void | actor, object, time, reason, recoverability | void a test document |
| Export or print | actor, scope, time, destination or job identifier | export one test chart |
| Permission change | administrator, affected user, old and new role, time | remove a test user’s access |
| Emergency access | user, record, time, stated reason, review state | demonstrate break-glass access |
| Configuration change | administrator, setting, old and new value, time | change a harmless test setting |
CMS describes an EHR audit log as a record of system activity and notes that it can show access plus amendments, corrections, and deletions in its EHR decision table. The table above turns that concept into a procurement test. It is not a claim that every system must use these exact field names.
Reconstruct one short investigation
Use synthetic records, never a patient’s chart. Give two test users different roles, then run a compact sequence:
- 09:00: fail a sign-in;
- 09:02: open the chart without changing it;
- 09:05 and 09:07: change the same field twice;
- 09:09: export the chart;
- 09:12: remove one user’s role.
Ask a second person to rebuild the sequence from the exported evidence without watching the demo. Confirm that both versions of the changed field survive and that reads are not hidden behind an edit-only report. Then ask who can purge, disable, or alter the history and require the answer in writing.
A polished dashboard can still fail this reconstruction. If evidence requires a support ticket and a seven-day wait, put that delay into the incident plan. If only the vendor can read the raw trail, the contract should state availability, format, cost, and response time.
Retention needs two separate decisions
Teams often repeat “HIPAA logs must be kept for six years” as if the regulation assigned that term to every event stream. The cleaner reading is narrower. HIPAA’s documentation rule sets a six-year term for required policies, procedures, and documented actions or assessments. The audit-controls paragraph does not set a universal raw-log term.
Keep two rows in the retention schedule:
| Record | Owner | Retention basis |
|---|---|---|
| Evidence that reviews occurred | privacy or security lead | HIPAA documentation rule and policy history |
| Underlying application and infrastructure logs | security lead | risk analysis, other law, contracts, investigations, storage cost |
Counsel can then map state-specific record law or litigation needs without muddying the technical configuration.
Close reviews with a work product
A review is not “someone looked at the dashboard.” Record the period, systems covered, filters used, exceptions found, disposition, reviewer, and completion time. Keep the saved query or exported evidence when policy requires it. Escalate suspected snooping, unusual bulk exports, access by departed staff, unexplained emergency access, and disabled logging.
Link the review to the HIPAA security checklist for AI scribes and the medical-record amendment guide. Those two controls answer different questions: who touched the record, and how a valid correction remains traceable.
Patient Square is an AI clinical platform. Practice Copilot brings the whole practice under one AI copilot: an ambient AI Medical Scribe that hands back a structured SOAP note, ICD-10 suggestions, and a prescription draft minutes after the visit, plus a bundled AI EHR, scheduling, and messaging as you move up the plan. Hospitals get Hospital Copilot. Review the current controls and scope on the security page before placing PHI in any product, and require the vendor to show the event history plus a usable export during the evaluation.