Healthcare
Does HIPAA require a visitor log?
No. HIPAA does not mandate a visitor log, and any vendor telling you it does is selling on a misreading of the Security Rule. The real position is more nuanced, and understanding it leads to a better answer than the myth does.
This matters because compliance decisions built on a wrong premise tend to be the wrong size: either an expensive system bought to satisfy a rule that does not exist, or a shrug when the actual obligation goes unmet.
What the rule actually says
The relevant provision is 45 CFR 164.310(a), Facility Access Controls, within the HIPAA Security Rule. It has four implementation specifications: contingency operations, a facility security plan, access control and validation procedures, and maintenance records. The phrase "including visitor control" appears inside the access control and validation specification.
All four specifications are Addressable, not Required. So the Security Rule contemplates visitor control as part of validating who gets into a facility, without mandating a log as the mechanism.
Addressable does not mean optional
This is where the myth-busting can overshoot in the other direction. Addressable means you must assess whether the specification is reasonable and appropriate for your environment, implement it if it is, and if it is not, document why and implement an equivalent alternative where reasonable. Doing nothing and documenting nothing is not a compliant response.
For most hospitals and clinics, controlling and recording physical access to areas holding protected health information is plainly reasonable. The practical outcome is usually a visitor log. The difference is that you arrive there through a documented decision rather than a misquoted mandate, which is exactly what an auditor wants to see.
The six-year rule is about documentation, not logs
HIPAA requires policies, procedures and certain documentation to be retained for six years. That is frequently misreported as a six-year visitor log retention requirement. It is not. Your retention decision for visitor records is yours to justify, and holding identifiable visitor data for six years without a reason works against you under the minimum necessary principle.
What healthcare facilities should focus on instead
- Vendor credentialing. Representatives entering clinical areas typically need immunisation records, training and liability cover verified before entry. This is a bigger operational problem than visitor logging and is usually handled worse.
- Exclusion screening. Healthcare organisations must check employees, contractors and vendors against the OIG exclusion list before engagement and monthly afterwards, with significant penalties per item or service furnished by an excluded person. Note this is a different list from sanctions screening.
- Badge distinguishability. A visitor badge that looks like a staff badge defeats the control regardless of what the log says.
- Area-level control. The question is rarely whether someone entered the building. It is whether they entered a unit holding protected health information.
Where BeckonDesk fits
BeckonDesk records visits with visitor name, company, host, timestamps, badge number and an optional photo, and holds a configurable retention period so records are purged on a schedule you set rather than kept indefinitely. Sign-in screens arrivals against sanctions lists and your own watchlist.
To be clear about a boundary: that screening does not include the OIG exclusion list or SAM.gov. If exclusion screening is what you need, it is a separate process and we would rather say so now than let a demo imply otherwise.
Related reading
See it on your own site.
A 30-minute walkthrough of sign-in, screening, and the record an auditor asks for. 30-day free trial, no credit card.