HIPAA-Compliant Log Management for Health Information Systems | Datadog

HIPAA-compliant log management for health information systems

Author Ari Shahar
Author Andrew Spangler

Last updated: April 1, 2021

As healthcare and life sciences organizations move to digitize their operations and automate their workflows, they are encountering new challenges related to HIPAA regulations, which dictate how patient information should be collected and stored. For example, a modern healthcare organization might be responsible for managing millions of patient records across a variety of devices and applications, making it essential for their infrastructure to be able to safely and securely handle enormous data streams coming from every digital asset within their system.

It is particularly important for these organizations to adhere to HIPAA logging requirements as they grow and scale. Audit logs must be safely collected from every service within an organization’s system and stored for six years in case they are needed for an internal or HHS investigation. With Datadog’s HIPAA-compliant log management and security solutions, organizations can capture and store audit logs on a long-term basis, leverage their logs to verify their level of compliance with other HIPAA provisions, and automatically detect security threats in real time.

An example dashboard for a health information system.
An example dashboard for a health information system.

Observing HIPAA regulations in a changing industry landscape

The Health Insurance Portability and Accountability Act, commonly known as HIPAA, is a set of rules and regulations passed by Congress in 1996 that established standardized requirements for the protection and confidential handling of protected health information (PHI). HIPAA rules were designed to govern healthcare providers, health plans, and similar organizations, which are defined as “covered entities,” as well as vendors of products and services working with healthcare-related organizations, which are defined as “business associates.”

Two of the most relevant HIPAA laws for companies leveraging technology to service their customers are:

  • The HIPAA Privacy Rule, which sets access standards for protected health information (PHI), such as medical health records and treatment plans. This information might include a patient’s personally identifiable information (PII), such as their Social Security Number and contact information. This rule applies to HIPAA “covered entities.”
  • The HIPAA Security Rule, which implements technical, physical, and administrative safeguards designed to protect electronic personal health information (ePHI). This rule applies both to “covered entities” and “business associates.”

As more and more healthcare and life sciences organizations enlist cloud service providers for their treatment plan processing and administration needs, the Security Rule in particular is profoundly impacting how these organizations, as well as their vendors and service providers, conduct business. HIPAA provides guidance on appropriate administrative, physical, and technical safeguards to protect the confidentiality, integrity, and availability of ePHI. Covered entities are responsible for conducting a periodic risk analysis in order to detect potential vulnerabilities and violations, making it essential that they associate with business partners who not only make compliance easier, but who are HIPAA-compliant themselves.

HIPAA-compliant log management

One of the main objectives of organizations that are pursuing HIPAA compliance is the maintenance of proper safeguards for technologies that process ePHI. The Security Rule’s provision on Audit Controls states that covered entities and business associates must “implement hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use electronic protected health information.” Practically speaking, this means covered entities and business associates must keep detailed audit logs of all activities (such as user logins, data store queries, access control changes, and administrator actions) that occur within their application and infrastructure.

Datadog’s HIPAA-compliant log management solution helps organizations rise to this challenge by collecting and storing their audit logs from a variety of sources, such as electronic health record (EHR) systems, patient survey software, cloud providers’ services, and other third-party applications. The log retention period is customizable, and logs can also be archived for long-term storage in Amazon S3, Azure Storage, or Google Cloud Storage. Archived logs can then be rehydrated if and when they are needed for an investigation.

This comprehensive approach to log management ensures that all activities within an organization’s system—whether they are routine or suspicious—are documented, so organizations can quickly pinpoint and remedy any vulnerabilities. For example, the Security Rule’s stipulation on Access Control requires that covered entities protect against unauthorized access to ePHI. Datadog customers can verify they are in compliance with this portion of the rule by monitoring their logs to detect an increase in users trying to gain access to ePHI without the proper credentials. Additionally, logs can be used to pinpoint user attempts to change or delete patient records—activities that could potentially violate the Security Rule’s provision on Integrity Controls, which is intended to protect ePHI from illicit alterations and deletions.

An example of a log indicating that an attempt to access data was denied.
An example of a log indicating that an attempt to access data was denied.

HIPAA-compliant security monitoring

The Security Rule’s administrative safeguard standards, which are outlined in § 164.308(a)(6), state that an effective security incident procedure is one of the requirements for HIPAA compliance. Datadog Security Monitoring includes several features—such as built-in security integrations, out-of-the-box security dashboards, and customizable threat detection rules—that help companies ensure their security practices adhere to this stipulation. Detection rules apply to the full stream of ingested logs, and if any rule is violated, Datadog will automatically notify the appropriate team members and generate a security signal. You can search and filter all security signals in a unified explorer, or view the details of a particular signal to get more insight into the activity that triggered it, as shown below.

View security signals in a unified explorer.
View security signals in a unified explorer.

Datadog Security Monitoring is fully integrated with the rest of the Datadog platform, so users can pivot seamlessly between a potential threat and associated monitoring data in order to investigate and remediate breaches as quickly as possible.

HIPAA compliance and security at Datadog

Monitoring solutions that integrate deeply across a healthcare or life sciences organization’s technology stack need to ensure that the ePHI and PII they gather, process, and store is handled in a HIPAA-compliant manner. As a business associate, Datadog is committed to the security and privacy of our customers' data. For example, Datadog has implemented risk-based security controls and compliance programs to help our customers increase observability while maintaining HIPAA compliance. Furthermore, Datadog has continued to pursue independent third-party assessments and validations of our security and compliance capabilities, including industry-standard certifications and reports, like ISO 27001 and SOC 2 Type II. Finally, Datadog has additional capabilities to further secure the usage of the Datadog platform across distributed tracing and APM, log management, and the Agent. These features are part of the Datadog Cloud Security Platform, which protects an organization’s production environment with a full-stack offering providing threat detection and posture management, as well as workload and application security.

Datadog provides real-time visibility into application performance, device hardware, and user experience for healthcare and life sciences organizations as they adopt increasingly complex technologies to service their patients and their health records. If you’re already a Datadog customer and you would like more information about enabling Datadog’s HIPAA-compliant log management and security solutions, please contact Datadog support. New to Datadog? Get started with a free .