HIPAA Audit Logs and BAAs for Automated Workflows: What the Security Rule Requires

Updated November 5, 2026, based on HHS's HIPAA rules in 45 CFR, the Federal Register and the federal regulatory agenda as of that date.

A vendor that creates, receives, maintains or transmits protected health information (PHI) for your organization is a business associate under HIPAA. You need a signed business associate agreement (BAA) before it touches patient data, and that holds even if the vendor only stores the data and never views it.

For audit logs, the HIPAA Security Rule requires systems that record and examine activity, and regular review of those records. It doesn't list the fields a log must contain or set a retention period for logs. It does require you to keep Security Rule documentation for six years.

This guide covers when an automation vendor is a business associate, what the BAA must say, what the Security Rule says about audit controls and retention, and what to ask a vendor before you share PHI.

When an automation vendor is a business associate

HIPAA's definition of a business associate in 45 CFR 160.103 covers a person who, on behalf of a covered entity, "creates, receives, maintains, or transmits protected health information for a function or activity regulated by this subchapter." The listed functions include claims processing, billing, benefit management and practice management. A vendor that runs eligibility checks, authorizations or document intake for you and handles PHI to do it generally meets that definition.

The definition also reaches down the chain. It includes "A subcontractor that creates, receives, maintains, or transmits protected health information on behalf of the business associate." If your vendor uses a cloud host or another service that handles your PHI, that service is a business associate of the vendor.

Storage alone counts. In the 2013 HIPAA Omnibus Rule, HHS said "an entity that maintains protected health information on behalf of a covered entity is a business associate," and that this holds "even if the entity does not actually view the protected health information."

Sign the BAA before sharing PHI

The Privacy Rule lets you disclose PHI to a business associate only after you get "satisfactory assurance" that it will protect the information. Under 45 CFR 164.502(e), those assurances "must be documented through a written contract or other written agreement or arrangement with the business associate." The Security Rule repeats the requirement for electronic PHI in 45 CFR 164.308(b)(1).

Get the agreement signed before any patient data moves, including test data drawn from real patients.

What the BAA must say

45 CFR 164.504(e) lists what the contract has to include. The business associate must:

• "Not use or further disclose the information other than as permitted or required by the contract or as required by law."
• Use appropriate safeguards and comply with the Security Rule where it applies.
• Report any use or disclosure the contract doesn't allow.
• Make sure its subcontractors agree to the same restrictions.
• Make its records on PHI use and disclosure available to HHS.
• "At termination of the contract, if feasible, return or destroy all protected health information."

The Security Rule adds that the business associate must "Report to the covered entity any security incident of which it becomes aware, including breaches of unsecured protected health information," under 45 CFR 164.314(a).

The first item answers a common question: whether a vendor can use your patient data to train its models. A business associate may use PHI only as the contract permits or the law requires, and the same section says the contract can't authorize a use that would violate the Privacy Rule if your organization did it, with limited exceptions. If you don't want PHI used for training, say so in the BAA and in the service agreement.

Audit controls: what the Security Rule actually says

The audit controls standard in 45 CFR 164.312(b) is one sentence: "Implement hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use electronic protected health information."

Two administrative safeguards in 164.308 go with it. Information system activity review is required: "Implement procedures to regularly review records of information system activity, such as audit logs, access reports, and security incident tracking reports." Log-in monitoring is addressable. Under 45 CFR 164.306(d), that means you "Assess whether each implementation specification is a reasonable and appropriate safeguard in its environment," then implement it, or document why not and use an equivalent measure if one is reasonable.

The rule doesn't say what a log entry must contain. That leaves the design to you and your vendor. For automated portal and document work, you can ask for more than the rule's wording: a record of which run checked which patient with which payer, where each answer came from, and what failed. That's what lets a team trace a denial back to the verification behind it. A vendor that keeps no logs, in the name of privacy, leaves you unable to show what happened.

Retention: the six-year rule and what it covers

45 CFR 164.316(b)(2) says to "Retain the documentation required by paragraph (b)(1) of this section for 6 years from the date of its creation or the date when it last was in effect, whichever is later." Paragraph (b)(1) covers your written Security Rule policies and procedures, plus any action, activity or assessment the rule requires you to document.

Whether raw audit logs, call recordings or run videos fall under that six years is an interpretation, not a line in the rule. Decide with your compliance lead or counsel, write it into your policy, and make sure the vendor's retention matches.

Questions to ask an automation vendor

Before you share PHI, get written answers to these:

1. Will you sign our BAA, or what does yours say about use, subcontractors, incident reporting and return or destruction of data?
2. Which subcontractors handle our PHI, and do you have BAAs with them?
3. What do you log for each run, and can we search those logs by case ID and payer?
4. How long do you keep logs, recordings and run videos, and where are they stored?
5. Do you use our data to train models?
6. How and how fast will you tell us about a security incident?
7. How are portal logins and multifactor authentication handled?

Logs also matter when an automation breaks. A run that fails silently is hard to fix without a record of what it saw.

A proposed Security Rule update is pending

HHS published a proposed rule, "HIPAA Security Rule to Strengthen the Cybersecurity of Electronic Protected Health Information," on January 6, 2025. The federal regulatory agenda entry for the rule lists it under "Long-Term Actions" with final action dated "07/00/2027." Until a final rule is published, the current text above applies.

Frequently asked questions

Do we need a BAA if the vendor only stores our data?

Yes. HHS said in the 2013 Omnibus Rule that an entity maintaining PHI on your behalf is a business associate even if it doesn't view the information.

How long must HIPAA audit logs be kept?

The Security Rule sets six years for required documentation, counted from creation or the date it was last in effect. It doesn't name a separate period for audit logs. Set one in your policy with your compliance lead and hold vendors to it.

Does HIPAA say what an audit log must contain?

No. 45 CFR 164.312(b) requires mechanisms that record and examine activity, and 164.308 requires regular review. The content is up to you, so define what you need for investigations.

Can a business associate use our PHI to train AI models?

Only as the contract permits or the law requires, and the contract can't authorize a use the Privacy Rule would bar for your organization, with limited exceptions. The BAA must bar any other use or disclosure. State your position on training in the agreement, and ask counsel if the vendor wants that right.

Does the BAA cover the vendor's cloud provider?

Not directly. You don't need your own assurances from the vendor's subcontractors, but the vendor must have its own agreement with any subcontractor that handles your PHI, and your BAA must require that.

Evaluating automation for portal work that touches PHI?

Champ automates portal work like eligibility checks and authorizations. We set it up and run it, so your staff sees only the finished results. If you're weighing automation for that work, learn more here.

This post is general information, not legal, compliance or billing advice. Requirements vary by state and by your contracts and change often, so confirm with your compliance lead or counsel before acting. Champ is not affiliated with or endorsed by HHS or the other federal agencies named here.