We are developing software and interested in the following matter: Is having email addresses and usernames of our users in file logs a HIPAA violation or not?
1. We are not going to store passwords in the log files just usernames and email addresses.
2. These file logs are used internally only.
I don't see any issue in accordance to this list https://www.hipaajournal.com/hipaa-compliance-checklist/ however it would be better to know for sure.