Most healthcare organizations are generating HIPAA audit logs. Most of them are not reading them. That gap, between producing a log and actually reviewing it, is where the HIPAA Security Rule’s audit control requirements are most commonly violated, and it is not the gap organizations expect to have.