audit-logging Controls

Identify all users, processes, and devices that access systems

Maintain audit logs of physical access to secured areas

Implement hardware, software, and procedural mechanisms that record and examine activity in systems containing ePHI