SMF type 80 (RACF decisions) - SMF type 102 (DB2 access) - SMF type 110 (CICS transactions) - Application audit logs for PHI access events - 6-year retention of audit records (HIPAA minimum)