Export event without patient context
EHR logs say UserX exported a report but not which patients. AU-3 remediation enables detailed export auditing so compliance knows the census list scope.
Content of Audit Records
High Risk
Moderate
Medium Cost
AU-3 requires audit records to contain information establishing what type of event occurred, when it occurred, where it occurred, the source of the event, the outcome, and the identity of any individuals or subjects associated with the event. Thin logs that only say "error" without user or object identity fail both NIST and practical HIPAA investigations.
Control Objective
Ensure every required audit event carries enough fields to answer who did what to which ePHI or system object, when, from where, and whether it succeeded.
Implementation Guidance
- Define mandatory fields: timestamp (synchronized), event type, subject/user ID, object/resource (patient ID/chart section where applicable), source IP/device, success/failure, and correlation ID if available.
- For ePHI access events include patient/MRN (or tokenized equivalent) and action (view, edit, print, export).
- Standardize time to UTC or consistently offset; sync clocks via NTP (ties to AU-8).
- Normalize fields across IdP, EHR, and SIEM so joins work during IR.
- Avoid logging secrets (passwords, full card data, MFA seeds) in audit content.
- Test that failed and successful events both include identity and outcome.
- Document field mappings for each major system in the logging standard.
- Upgrade or supplement systems that cannot meet minimum content (forward richer app logs).
Real-World Use Cases
How this control shows up in healthcare and HIPAA-covered environments.
VPN log missing user identity
Legacy VPN logged only public IPs. After IA/AU hardening, records include unique user ID + device posture — enough to support incident timelines.
SIEM correlation failure
IdP uses email; EHR uses short username; timestamps differ by minutes. AU-3 + identity mapping + clock sync make cross-system investigation possible.
Best Practices
- Define a minimum field schema organization-wide.
- Include outcome (success/fail) on every auth and authZ event.
- Prefer stable user identifiers (IA-4) in logs.
- Do not write authenticators or full sensitive payloads into logs.
- Validate content after vendor upgrades (fields often change).
- Preserve patient identifiers in audit stores with appropriate access controls.
Common Gaps & Violations
- Logs without user IDs or with shared IDs only.
- Missing timestamps or unsynchronized clocks.
- 'Access denied' with no object or reason code.
- EHR audit trail that omits print/export.
- Debug logs capturing passwords or tokens.
Required Documentation
- Audit record content standard (required fields)
- Per-system field mapping sheets
- Examples of compliant log records (redacted)
- Clock sync configuration evidence
- Guidance on prohibited sensitive log content
How to Test & Validate
- Trigger view/edit/export/print and inspect record fields vs standard.
- Trigger failed logon; confirm user, source, time, outcome present.
- Compare IdP and EHR timestamps on the same action.
- Confirm secrets are not present in sample logs.
- Re-check after a vendor upgrade.
Audit Considerations
Auditors open sample audit records. If they cannot identify the user, object, time, and result, AU-3 (and HIPAA audit usefulness) is not met.
HIPAA Mapping
How this NIST control supports HIPAA Security Rule expectations.
- 164.312(b) Audit Controls — mechanisms must record activity in systems with ePHI in a reviewable way.
- 164.308(a)(1)(ii)(D) Information System Activity Review — reviews require substantive record content.
- 164.312(a)(2)(i) Unique User Identification — identifiers in logs enable tracking.
- 164.528 Accounting of Disclosures — some disclosure workflows rely on adequate event detail.
Compliance Tips
- Build one redacted 'gold sample' log pack for assessors.
- Add content validation to EHR upgrade test plans.
- Protect audit data stores as carefully as production ePHI indexes.
Frequently Asked Questions
Do we need patient MRN in every log?
For ePHI access events, some durable patient object reference is usually required to investigate. Protect audit repositories accordingly.
Is syslog priority enough content?
No. Priority is metadata; AU-3 needs identity, object, time, source, and outcome in the record.
How does AU-3 relate to AU-2?
AU-2 selects events; AU-3 defines what each selected event record must contain.
References & Resources
- NIST SP 800-53 Rev. 5 — AU-3
- NIST SP 800-92
- HIPAA § 164.312(b)
- Related controls: AU-2, AU-8, AU-12, IA-4
Related Guidelines
Related controls that commonly accompany AU-3.
Need Help Implementing AU-3?
Our auditors map NIST SP 800-53 controls to your HIPAA Security Rule program — policies, technical evidence, and audit readiness.