HIPAA §164.312(b) Audit Logging Implementation Guide

HIPAA Audit Control Mandate (§164.312(b))

HIPAA requires hardware and software mechanisms to log and examine all ePHI access.

Audit Log Schema & Hash Chaining

import { createHash } from 'crypto';

export interface AuditLog {
  id: string;
  actorId: string;
  action: 'READ' | 'WRITE' | 'DELETE' | 'EXPORT';
  resourceId: string;
  timestamp: string;
  prevHash: string;
  hash: string;
}

export function createAuditRecord(params: Omit<AuditLog, 'hash'>): AuditLog {
  const payload = `${params.id}|${params.actorId}|${params.action}|${params.resourceId}|${params.timestamp}|${params.prevHash}`;
  const hash = createHash('sha256').update(payload).digest('hex');
  return { ...params, hash };
}

Immutable Storage (WORM)

Audit records must be streamed to Write-Once-Read-Many (WORM) containers such as AWS S3 Object Lock with a 6-year retention policy.