Audit Logs

Every PHI access is logged. HIPAA requirement.

Admin only feature.

View Logs

Admin → System → Audit Logs

What Gets Logged

Every action involving patient data:

  • PHI_ACCESS - User viewed patient/submission
  • PHI_CREATED - New patient or submission created
  • PHI_UPDATED - Patient or submission edited
  • PHI_DELETED - Data deleted (rare)
  • PERMISSION_DENIED - Unauthorized access attempt
  • AUTH_FAILED - Failed login attempt

Log Details

Each log entry shows:

  • Timestamp - Exact date and time
  • User - Who performed the action
  • Action - What they did
  • Resource - What data (patient, form, etc)
  • IP Address - Where they accessed from
  • User Agent - Browser/device info
  • Clinic - Which clinic (for multi-clinic orgs)

Filter Logs

Filter by:

  • Date range - Last 24 hours, week, month, custom
  • User - Specific staff member
  • Event type - Only certain actions
  • Patient - All access to specific patient
  • Resource type - Only patients, or only submissions

Search Logs

Use search box to find:

  • Patient names
  • User emails
  • IP addresses
  • Specific actions

Export Logs

Click “Export” to download as CSV.

Useful for:

  • HIPAA compliance audits
  • Security investigations
  • Quarterly reviews
  • Training documentation

Log Retention

Logs are kept for 7 years per HIPAA requirements.

Logs cannot be modified or deleted (immutable).

Common Use Cases

Compliance Audit

  1. Filter by date range (e.g., last quarter)
  2. Export all logs
  3. Review for unusual patterns
  4. Document findings

Security Investigation

  1. Filter by specific patient
  2. See who accessed their data
  3. Check if access was authorized
  4. Document any issues

User Training

  1. Filter by specific user
  2. See what actions they performed
  3. Identify training needs
  4. Track improvement

Breach Response

If PHI breach suspected:

  1. Immediately document in logs
  2. Identify scope (who, what, when)
  3. Preserve all related logs
  4. Follow incident response plan
  5. Notify required parties per HIPAA

What Logs Look Like

Example log entry:

{
  "id": "abc123",
  "timestamp": "2024-01-15T14:30:22Z",
  "event_type": "PHI_ACCESS",
  "user_id": "user-456",
  "user_email": "jane.staff@cincinnatichildrens.org",
  "resource_type": "patient",
  "resource_id": "patient-789",
  "action": "READ_PATIENT_DETAILS",
  "ip_address": "192.168.1.100",
  "user_agent": "Mozilla/5.0...",
  "clinic_id": "clinic-001",
  "metadata": {
    "patient_name": "John Doe",
    "accessed_from": "patient_details_page"
  }
}

Audit Log Best Practices

Weekly: Review logs for your team Monthly: Export logs for records Quarterly: Comprehensive compliance review Annually: Full audit log analysis

Automated Alerts

Coming soon:

  • Alert on unusual access patterns
  • Alert on failed login attempts
  • Alert on after-hours access
  • Email notifications to admin

Technical Details

Logs stored in audit_logs table.

All writes are append-only (no updates/deletes).

RLS policies ensure clinic isolation.

Backend automatically creates log entries for all PHI operations.