HIPAA Visitor Log: What to Record and How to Keep It

HIPAA does not hand you a template for a visitor log. It asks you to control who enters your facility, and a log is the simplest way to show that you do. A good one records who came in, when, why and who they visited. It leaves out anything a later visitor should not see, and it can be produced quickly if an auditor, a regulator or a fire warden asks for it.

This guide explains what the rule says, what to put on the log, why the open paper binder is the weak point, and what to check before you move to an electronic system.

TL;DR

• The Security Rule lists visitor control as an addressable part of facility access controls, so you need a documented, reasoned approach to it.
• Record the minimum: name, organization, host, purpose, time in and time out. Do not ask visitors to write down health details.
• Paper sheets that show earlier entries to the next person create incidental disclosure risk. Covered or tear-off formats and digital sign-in reduce it.
• A cloud visitor system that holds protected health information (PHI) makes the vendor a business associate. You need a signed Business Associate Agreement (BAA) and your own risk analysis.
• The same record that proves who visited also tells you who is in the building during an evacuation.

Table of Contents

• What HIPAA actually says about visitor control
• Why a visitor log matters beyond security
• What to record on a HIPAA visitor log
• Patient sign-in sheets versus visitor logs
• The problem with the paper visitor book
• Moving to an electronic visitor log
• The cloud question: BAAs and risk analysis
• A simple visitor policy you can adapt
• How to maintain the log day to day
• Our perspective
• Using EntryWatch for healthcare sign-in
• Frequently asked questions
• Sources

What HIPAA actually says about visitor control

The Security Rule has a section on physical safeguards, 45 CFR 164.310. Its first standard is facility access controls: policies and procedures that limit physical access to electronic information systems and the buildings that house them, while making sure properly authorized people can still get in.

Under that standard sits an addressable specification called access control and validation procedures. It explicitly names visitor control, alongside control of access based on a person’s role or function. Two points follow from this.

“Addressable” does not mean optional. You must assess whether the measure is reasonable and appropriate for your setting. If it is, you implement it. If it is not, you document why and put an equivalent measure in place. For nearly every clinic, hospital, lab and billing office, some form of visitor control is reasonable.

The rule does not say “keep a log.” It says control visitors. A log is the usual evidence, but a badge process, an escort policy and a reception procedure all form part of the picture. The log is what lets you prove the rest actually happens.

That is why searches such as “visitor log requirements HIPAA” rarely return one clear answer. There is no prescribed field list and no prescribed retention period for the visitor log itself. Your own written policy sets those, based on your risk analysis.

Why a visitor log matters beyond security

Most people think of a visitor log as a way to keep strangers out of the records room. It does more than that.

• Accountability. If a patient complains that a stranger was in a treatment area, or a device goes missing, the log narrows down who was on site.
• Audit evidence. A reviewer asking how you control physical access wants to see the policy and the records that show it is followed.
• Contractor oversight. Cleaners, IT engineers, shredding companies and equipment technicians can reach areas where PHI is stored. A log shows when they were there and who hosted them.
• Emergency response. In a fire or other evacuation, staff need to know who is in the building, including visitors. A paper book left at reception often cannot be carried to the assembly point, and it may be out of date within minutes.

That last use is often missed. Facility access planning covers the people as well as the servers, and a live list of who is on site supports both.

What to record on a HIPAA visitor log

The guiding idea is data minimization. Collect what you need to control access and answer questions later, and nothing more.

What to leave off

Do not ask for medical reasons for a visit. If a family member is visiting an inpatient, record the visitor’s name and the unit or host, not the patient’s diagnosis. Avoid fields that invite free-text answers about health. A line that reads “visiting her mother for chemotherapy” turns a visitor log into a PHI document.

For patients signing in at a front desk, the position is a little different, and we cover it next.

Patient sign-in sheets versus visitor logs

People often mix these up. A visitor log records non-patients who enter the facility. A patient sign-in sheet records people arriving for appointments. HHS addresses the second directly: its FAQ confirms that physician offices may use patient sign-in sheets or call out patient names in waiting rooms, provided the practice applies reasonable safeguards and limits the information collected. Its general guidance on incidental uses and disclosures explains that some incidental disclosure is not a violation if you have applied reasonable safeguards and followed the minimum necessary standard.

In practice that means:

• Ask for name and arrival time only. Do not ask for the reason for the appointment or the provider’s specialty if the specialty reveals a condition.
• Use a format that stops the next person reading earlier entries, such as tear-off slips or a sheet where each entry is covered after signing.
• Remove completed sheets from the counter and store or destroy them according to your policy.

The same logic applies to visitors. A sheet that lists forty names, companies and hosts, left open on the desk for anyone to read, shows who has been in your building and who they came to see. In a small practice, a visitor’s name next to a clinician’s name can reveal that a particular person is a patient or a patient’s relative.

The problem with the paper visitor book

A paper binder is cheap and familiar. It is also hard to defend.

1. Visible history. Every visitor can read the entries above theirs.
2. Illegible or missing entries. Handwriting, skipped sign-outs and “I’ll do it later” make the record unreliable.
3. No access control on the record. Anyone passing reception can open it. You cannot see who looked at it.
4. Slow retrieval. Finding every visit by one contractor over six months means paging through binders.
5. No use in an emergency. It cannot tell you in real time who is still on site.

We have written about this in more detail in why the paper visitor book needs to go. If you are not ready to switch, the minimum fixes are a covered or tear-off format, a short field list, a clear sign-out step and a written rule for who reviews and stores completed pages.

Moving to an electronic visitor log

An electronic log solves most of the paper problems at once. Each visitor signs in on their own screen, so no one sees earlier entries. The record is time-stamped automatically. Access can be limited by role, so a receptionist sees today’s visitors while a compliance officer can search history. Sign-out can be prompted by the system, and reports can be exported when someone asks.

For healthcare settings, look for these features:

• Minimal on-screen data. After sign-in, the screen returns to a blank welcome page and shows no one else’s details.
• Role-based access. Not every staff member needs the full history.
• Configurable forms. You can add an NDA, site rules or a health declaration where your policy calls for one, and leave them out where it does not.
• Host notification. The person being visited gets an email, SMS or chat message, so visitors do not wait at an open desk.
• Badge printing. A printed badge makes it easy for staff to see who has signed in.
• Document expiry tracking. Useful for contractor insurance, certifications and inductions.
• An auditable record. Entries cannot be quietly edited, and exports are straightforward.
• Evacuation roll call. The list of people on site can be viewed on a phone at the assembly point.

If your front desk is also overloaded with calls and booking, it may be worth looking at medical scheduling automation for clinics alongside visitor sign-in, since both reduce the pressure on reception staff.

The cloud question: BAAs and risk analysis

This is the step most buyers skip. If an electronic visitor system could create, receive, maintain or transmit PHI for you, the vendor is likely to be a business associate. HHS says so plainly in its guidance on HIPAA and cloud computing: when a covered entity engages a cloud service provider to handle ePHI on its behalf, the provider is a business associate.

Whether a visitor log holds PHI depends on what you put in it. A log with only visitor names, companies and hosts may not. A log that captures patient names, appointment details or health declarations can. A visitor system used in a hospital ward, where a visitor’s entry is tied to a named patient, is closer to the second case. Make that decision deliberately and write it down.

Before you sign with any vendor:

1. Decide what data the system will hold. List the fields. Remove any that you do not need.
2. Run and document a risk analysis that covers the new system.
3. Ask whether the vendor will sign a BAA and what services it covers. Get this in writing before go-live.
4. Do not rely on a “HIPAA compliant” label. Software can offer the right features, but your organization stays responsible for how it is configured and used.
5. Check where data is stored, who at the vendor can see it, and how deletion works when you leave.
6. Write the procedure for who reviews the log, how often, and how long you keep it.

If you are unsure whether your visitor data counts as PHI, ask your privacy officer or healthcare compliance counsel. This article is general information and not legal advice.

A simple visitor policy you can adapt

Your written policy is as important as the tool. A one-page version for a clinic or office might cover:

1. Scope. Who counts as a visitor: guests, vendors, contractors, students on placement, family members of patients.
2. Sign-in and sign-out. Every visitor signs in on arrival and out on departure. Staff check that the sign-out happened.
3. Identification. Whether you ask for photo ID, for which visitor types, and how it is verified.
4. Badges. Visible at all times and returned at the end of the visit.
5. Escort rules. Which areas require an escort, such as records rooms, server rooms and pharmacy storage.
6. Data collected. The field list, and the rule that health information is never written on the log.
7. Access to the log. Named roles, and who can export it.
8. Review. A regular check, for example monthly, for unusual patterns such as repeated after-hours visits.
9. Retention and disposal. Set by your own policy and legal advice, applied the same way to paper and digital records.
10. Emergency use. The log is used for roll call, and someone is named to run it.

Public hospital visitor policies are worth reading for wording. Sharp HealthCare’s visitor policy is one public example of how a health system explains visiting arrangements to the public. Note that visiting rules for patients, such as hours and numbers of visitors, are a different subject from the access log your compliance team keeps. HHS also publishes FAQs on patient visitation at certain federally funded facilities, which concern nondiscrimination in visiting rights rather than logging.

How to maintain the log day to day

A policy only works if the daily habits match it.

• Check the sign-outs at close. Any visitor still shown as on site at the end of the day should be investigated, not ignored.
• Review contractor visits. Compare who signed in against who was booked. Unexpected visitors are the ones to ask about.
• Train reception. Staff should know what to say to a visitor who wants to write down more than is needed, and what to do if a visitor asks to see the log.
• Keep the screen or sheet private. Position the kiosk or tablet so that others cannot read it from the queue.
• Test the emergency list. Run a drill using the visitor record, and see whether it is accurate and quick to open.
• Review the vendor relationship. Revisit the BAA and risk analysis when you add features, sites or integrations.

Our perspective

We build visitor management software, so we see the same pattern in healthcare sites, logistics depots and offices. The log starts as a security measure. Then someone needs it for an audit, or for a fire drill, and finds that the binder cannot do either job.

We think the best visitor log is the one that asks for the least and is the most reliable. That means no free-text boxes where health details can creep in, an automatic time stamp, a sign-out that does not depend on memory, and a list that you can open on your phone at the assembly point. It also means being honest about the limits of software. No product makes you compliant. It gives you the records and controls; your policy, training and agreements with vendors do the rest.

We also suggest treating the visitor record and the evacuation record as one. The people you need to find in an emergency are the same people your log already knows about. Our evacuation roll-call feature works from that live record, and our page on evacuation management explains the process step by step.

— Flipmind

Using EntryWatch for healthcare sign-in

EntryWatch is a visitor management system that lets visitors, contractors and staff sign in on a self-service kiosk or by QR code, without queuing at reception. It keeps a real-time, auditable record of entries, prints badges, notifies hosts by email, SMS, Teams or Slack, handles digital forms and document expiry, and supports multiple sites and kiosks. You can read how this applies to clinics and hospitals on our healthcare visitor access page, or see the full visitor management system.

All features are included free for founding customers until 2027. You can see the details on the Founding plan page. Kiosk stands and badge printers are available to resell through our hardware page. Before you put any PHI in any cloud tool, including ours, confirm your BAA position in writing and complete your own risk analysis.

Frequently asked questions

Is a visitor log required by HIPAA?

HIPAA requires facility access controls, and visitor control is named as an addressable specification under them. That means you must assess it and either implement it or document an equivalent. The rule does not prescribe a specific log format, so your own policy defines it.

Can a patient sign-in sheet in the waiting room be HIPAA compliant?

Yes. HHS says providers may use sign-in sheets if they apply reasonable safeguards and limit what is collected. Ask for the minimum, such as name and time, and use a format that stops later patients reading earlier entries.

Do I need a BAA for an electronic visitor log?

If the vendor creates, receives, maintains or transmits PHI for you, it is a business associate and you need a BAA. If your log never holds PHI, the answer may differ, but you should document that decision. Ask your privacy officer or counsel if you are unsure.

What should I never write on a visitor log?

Avoid diagnoses, treatment types, reasons for a patient’s admission and any detail that links a visitor to a specific condition. Name, organization, host, purpose category and times are usually enough.

How is a visitor log different from a HIPAA audit log?

A HIPAA audit log tracks activity in electronic systems, such as who opened a patient record. A visitor log tracks people entering the physical site. Both help you show accountability, but they cover different safeguards.

Sources

• 45 CFR 164.310, Physical safeguards (eCFR)
• May physician’s offices use patient sign-in sheets? (HHS)
• Incidental Uses and Disclosures (HHS)
• Guidance on HIPAA and Cloud Computing (HHS)
• FAQs on Patient Visitation (HHS)
• Sharp HealthCare visitor policy

Recommended

• 13-Section Visitor Policy Template: Ready to Use for HR and Facilities
• Contactless Visitor Access for Healthcare
• Launch a Health Declaration Form in Your VMS This Week, No Extra Staff
• Visitor Induction Video That Records Completion for Safety Managers