What level of logging do you turn on (and keep) on Windows file servers with ePHI? Do you audit? How long do you keep the data?

["H. Morrow Long" <morrow.long () YALE EDU>]

If you have Windows file servers with files containing ePHI.
As part of your HIPAA privacy/security compliance practice:

What level of logging do you turn on (and keep) on Windows file
servers with ePHI?  Do you audit?  How long do you keep the data?

- H. Morrow Long, CISSP, CISM, CEH
  University Information Security Officer
  Director -- Information Security Office
  Yale University, ITS