HIPAA Security Rule: endpoint audit and monitoring controls

Which Security Rule citations touch endpoint monitoring?

Two notes on reading that table. "Addressable" does not mean optional. It means the organization implements the specification, or documents why it is not reasonable and appropriate and implements an equivalent alternative. Separately, HHS published a proposed update to the Security Rule in January 2025 that would remove the addressable category. Confirm the current status of that rulemaking before treating any specification as discretionary.

164.312(b) audit controls: what is recorded

The standard requires mechanisms that record and examine activity in systems that contain or use electronic protected health information. It names no fields, so the useful answer to a reviewer is the record itself.

At the endpoint

• Kernel event capture through Event Tracing for Windows on Windows and eBPF on Linux, covering process creation, file input and output, network connections, registry activity and service state changes
• Behavioral rule evaluations against that event stream, with the matched rule and the evidence that triggered it
• Endpoint posture at each heartbeat, including Defender status and definition age, firewall state, BitLocker, UAC and Secure Boot

At the console

• Authentication attempts, with failures returning no information about valid identifiers
• Agent connection and disconnection events with agent, organization and connection identifiers
• Alert rule evaluations, logged per agent with timestamps
• Script creation and modification, with user identity, organization, timestamp and a SHA-256 content hash for tamper detection
• Every command execution, with risk score, matched indicators, user identity, target agent, command hash and the execution decision

The command record is the one worth showing an auditor. It answers who acted, on which machine, with what, and whether the platform allowed it, in a single row.

164.308(a)(1)(ii)(D) information system activity review

This specification requires procedures to regularly review records of system activity. The evidence a reviewer looks for is not only that logs exist but that someone looks at them.

ET Ducky supports that in two ways. Alert rules evaluate health and behavioral conditions continuously and produce dated alert records rather than requiring a person to open a log. Natural-language reports run against organization-scoped datasets, so a monthly review can be asked as a question and rendered as a chart and table that is dated evidence of the review itself.

Unlicensed workspace users can sign in to generate reports, which matters when the person who performs the review is a compliance officer rather than an engineer.

164.308(a)(5)(ii)(B) protection from malicious software

Ten always-on behavioral rules run against the kernel event stream on both operating systems: mass file access, mass file rename to ransom extensions, ransom-note patterns, shadow copy and backup deletion, suspicious execution chains, reverse-shell heuristics, privilege escalation from non-interactive parents, unusual outbound traffic from system daemons, a crypto-miner heuristic, and a kill-chain rule that fires when two or more of the others occur within five minutes.

164.308(a)(6) security incident procedures

On a detection at or above the configured confidence threshold, the agent applies network isolation automatically and a ticket is opened in the connected ticketing system with the full alert detail, including a note that isolation was applied. That produces a dated incident record without an operator being present.

Isolation removal requires dual approval: an authenticated dashboard request plus independent approval by a person at the device, either through a single-use HMAC-TOTP code or an on-device approval prompt. For an incident procedure, that means the containment decision and the release decision are separately attributable.

Data held by an organization under a security hold is exempt from the retention purge, so the evidence trail survives the investigation rather than expiring mid-review.

Encryption: 164.312(a)(2)(iv) and 164.312(e)(2)(ii)

Can protected health information end up in telemetry?

This is the question a covered entity should ask, and the answer is more specific than yes or no.

The platform does not collect end-user content, browsing history, keystrokes, file contents or employee activity. Raw kernel events are correlated on the endpoint and only sanitized summaries are uploaded. During AI-driven dynamic diagnostic sessions, events from additional providers are counted on the host and only the counts are uploaded, so raw payloads from those sessions never leave the endpoint.

The realistic exposure route is narrower than a document upload. File paths and process arguments appear in kernel event data, and an application can write a patient identifier into a filename. A covered entity should evaluate that path against its own applications rather than assume telemetry is free of identifiers.

Is a business associate agreement required?

Whether ET Ducky is a business associate depends on whether the telemetry from your environment creates, receives, maintains or transmits electronic protected health information, which depends on your applications and your configuration. That determination belongs to the covered entity. Raise it with [email protected] before deployment rather than after.

The Local-First self-hosted deployment changes the analysis. Endpoint telemetry lands only in the customer's own PostgreSQL instance, no vendor-side secrets ship to customer infrastructure, and the documented egress list is the complete set of outbound connections. See the self-hosted documentation.

Retention and the six-year rule

Retention is configured per agent: 14 days by default, extending to 90, 365 or 730 days on paid tiers. Purging is automatic and permanent.

HIPAA's six-year retention requirement at 164.316(b)(2)(i) applies to the documentation the rule requires an organization to maintain, such as policies, procedures and risk analyses. It does not require six years of raw system telemetry. An organization that chooses to treat audit records as required documentation needs to confirm that its retention tier and its own export process together cover the period it has committed to, because the highest tier is 730 days.

One caveat belongs in a retention assessment. An organization under a legal or security hold accumulates data past its purchased window until the hold is released. Automatic holds expire after 365 days; manual holds persist until an administrator releases them.

What this does not cover

ET Ducky is not SOC 2 audited. The security whitepaper maps controls to the SOC 2 Trust Services Criteria, ISO 27001 Annex A, NIST CSF and GDPR Article 32, and a mapping is not a certification.

No endpoint agent addresses risk analysis, workforce training, sanction policy, physical safeguards, contingency planning or business associate contracting. Those are the bulk of a Security Rule program and they sit outside any product.