When most home health administrators think about cybersecurity threats, they think about external attackers — ransomware groups, phishing campaigns, dark web credential sales. These are real and serious threats. But the threat category that appears most frequently in OCR enforcement actions is one that comes from inside the organization: workforce members accessing, using, or disclosing patient information without a legitimate purpose. It happens at every size of agency and in every clinical role. It happens most often not from malicious intent but from curiosity, carelessness, or the assumption that organizational systems are less monitored than they actually are — or should be.
Detecting internal violations requires a different set of controls than detecting external attacks. The attacker already has valid credentials. Their access events look legitimate to basic monitoring. What distinguishes an internal violation from legitimate access is context: who accessed what, at what time, with what frequency, in relation to what care relationship or business function. That contextual analysis is what audit log review exists to perform.
What HIPAA Requires for Internal Monitoring
The HIPAA Security Rule requires covered entities to implement "hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use electronic protected health information." The second part of that requirement — "examine" — is the one most agencies comply with technically (by enabling logging) but fail to satisfy operationally (by actually reviewing the logs). OCR investigators consistently ask for evidence of periodic audit log review. An agency that can show logs were generated but cannot show they were reviewed has a compliance gap that OCR treats as a meaningful failure.
This general HIPAA obligation runs alongside a more specific version for New York agencies — see SHIN-NY Audit Log Requirements: What You Need to Track and How to Prove It for the additional retention and documentation obligations that apply on top of everything below for SHIN-NY-connected systems.
The Audit Log Review Process That Satisfies HIPAA
What Must Be Logged
At minimum, audit logs must capture: all logins and logouts (including failed login attempts), all access to patient records (which user, which record, what actions), all changes to patient data (who made the change, what was changed, when), all exports or downloads of patient data, all administrative actions (user creation, permission changes, policy modifications), and all access to billing and financial data by clinical staff and vice versa.
How Often Logs Must Be Reviewed
HIPAA doesn't specify a review frequency — but OCR has found agencies non-compliant for annual-only log review when the scope of their ePHI environment warranted more frequent review. A reasonable standard for home health agencies: automated alerting for high-priority access patterns (any access to records outside an assigned caseload, any bulk data export, any access outside normal business hours from an unusual location), reviewed immediately upon alert, plus manual periodic review of access logs for a sample of records and users, conducted monthly.
What to Look For in Access Log Review
Staff accessing patient records for patients not on their assigned caseload — this is the most common internal violation pattern and the most frequently cited in OCR actions against home health agencies
High-volume record access that exceeds what a clinical role requires — a field nurse who accessed 200 patient records in a single session has no legitimate clinical purpose for that volume
Access outside normal working hours — a billing coordinator accessing clinical records at 2am on a weekend warrants investigation