HIPAA requires that not only is every change logged, but also who looks at a particular record.


>Many organizations have rules/regulations that require timestamps on every table.
>
>You never know when it can help, even on the smallest of tables. A while back someone with admin rights modified a row (manually) in Management Studio, in a config table with about a dozen entries. Someone noticed that the spelling on a report for a discount promotion name was wrong. (About a year prior, I had convinced the DBA to put a trigger on every table to update the LastUser and LastUpdateDate.)
>
>So obviously we could see whodunnit it and when.
>
>Having a timestamp is like paying insurance premiums. ;)
>
>What I've always advocated (or actually built, it I was able to) is this:
>
> Either an identity PK or a GUID
>CreatedByID
>ModifiedByID
>CreatedDate
>ModifiedDate