Audit logging
What EDFlow records in its audit log, the record format, append-only storage with a daily hash chain, proactive monitoring rules, per-patient access reports and SIEM export.
Coverage
| Group | Recorded |
|---|---|
| Patient and family access | Sessions created and ended, rejected tokens, failed sign-ins, rate limits, identity confirmed or mismatched, device approvals, family links created, opened and revoked |
| Staff authentication | Sign-ins and failures, lockouts, MFA enrolment and resets, password changes, SSO rejections, session revocations |
| Staff access to patient data | Board views (per session every 15 minutes), each patient opened with its tab, unmasks with reasons, card issuing and pairing approvals, payload reveals, exports |
| State changes | Every manual action, overrides, result holds and releases, care-team changes, tasks, request actions, call-backs, summary publication, privacy flags, updates pauses |
| Department | Codes, delay notices, volume changes, imaging service status |
| Administration | Settings changes with before and after values, invites and roles, approvals, stations, content status, announcements, access reviews, training mode |
| Integration and API | Sources and keys, apps, credentials, scopes, write-back, disclosures to each integration |
| Privacy and platform | Audit views and exports, retention runs, legal holds, incidents, emergency revokes, support access, simulator and seed actions |
| AI | Safety conversations opened, automatic alerts, governance gates, the kill switch |
The record
Time, site, actor type (patient, family, staff, station, system, integration, platform), actor, membership and roles, action, subject, visit, outcome (success, denied, error), reason, details, device class and any support-access id. Never names, tokens, phone numbers, emails, message bodies or free text. Denied authorization attempts inside writes are logged with denied.
Integrity
The audit table is append-only: nothing updates or deletes rows except the retention job after the audit period. Each night the previous day's rows are hashed in order and chained with the prior day's digest; exports include the digests so tampering can be detected. Integration request logs are sealed into the same chain and archived with S3 Object Lock.
Monitoring
Rules raise alerts to the privacy office, for example: more than 30 patients opened by one user in an hour; a confidential visit opened by someone off its care team; more than 3 unmasks in 12 hours; failed sign-ins against one visit; support access started; a privileged role granted; a trust anchor changed; an integration reading far more visits than usual. See Privacy officers.
Access reports and export
- Per-patient access report: every access to one visit, including each integration that received its data, as CSV or PDF.
- SIEM: on-request export as CSV or NDJSON, with scheduled delivery to a hospital HTTPS endpoint or bucket in a later release. A site can't take live integration traffic unless the SIEM export or the sealed archive is active.
Audit exports need a second privacy officer's approval and are themselves audited.
Retention
2 years by default (site range 2 to 10), deleted with their digests.
Related
Dernière mise à jour le
Cette page vous a-t-elle été utile?
Availability and incidents
EDFlow service levels: the support severity matrix with 24/7 P1 response within 30 minutes, the 24-hour breach notice, maintenance windows and notice, SLOs and the HA topology they depend on, RPO and RTO, DR drills and the status page.
AI governance
How EDFlow governs AI: models and providers, zero data retention and no training, data classes C0 to C3, what leaves the tenant, human approval, the medical-device boundary, enablement gates G-AI-1 to G-AI-6, the kill switch and opting a visit out.