Audit logging
What EDFlow records in its audit log, the record format, append-only storage with a daily hash chain, proactive monitoring rules, per-patient access reports and SIEM export.
Coverage
| Group | Recorded |
|---|---|
| Patient and family access | Sessions created and ended, rejected tokens, failed sign-ins, rate limits, identity confirmed or mismatched, device approvals, family links created, opened and revoked |
| Staff authentication | Sign-ins and failures, lockouts, MFA enrolment and resets, password changes, SSO rejections, session revocations |
| Staff access to patient data | Board views (per session every 15 minutes), each patient opened with its tab, unmasks with reasons, card issuing and pairing approvals, payload reveals, exports |
| State changes | Every manual action, overrides, result holds and releases, care-team changes, tasks, request actions, call-backs, summary publication, privacy flags, updates pauses |
| Department | Codes, delay notices, volume changes, imaging service status |
| Administration | Settings changes with before and after values, invites and roles, approvals, stations, content status, announcements, access reviews, training mode |
| Integration and API | Sources and keys, apps, credentials, scopes, write-back, disclosures to each integration |
| Privacy and platform | Audit views and exports, retention runs, legal holds, incidents, emergency revokes, support access, simulator and seed actions |
| AI | Safety conversations opened, automatic alerts, governance gates, the kill switch |
The record
Time, site, actor type (patient, family, staff, station, system, integration, platform), actor, membership and roles, action, subject, visit, outcome (success, denied, error), reason, details, device class and any support-access id. Never names, tokens, phone numbers, emails, message bodies or free text. Denied authorization attempts inside writes are logged with denied.
Integrity
The audit table is append-only: nothing updates or deletes rows except the retention job after the audit period. Each night the previous day's rows are hashed in order and chained with the prior day's digest; exports include the digests so tampering can be detected. Integration request logs are sealed into the same chain and archived with S3 Object Lock.
Monitoring
Rules raise alerts to the privacy office, for example: more than 30 patients opened by one user in an hour; a confidential visit opened by someone off its care team; more than 3 unmasks in 12 hours; failed sign-ins against one visit; support access started; a privileged role granted; a trust anchor changed; an integration reading far more visits than usual. See Privacy officers.
Access reports and export
- Per-patient access report: every access to one visit, including each integration that received its data, as CSV or PDF.
- SIEM: on-request export as CSV or NDJSON, with scheduled delivery to a hospital HTTPS endpoint or bucket in a later release. A site can't take live integration traffic unless the SIEM export or the sealed archive is active.
Audit exports need a second privacy officer's approval and are themselves audited.
Retention
2 years by default (site range 2 to 10), deleted with their digests.
Related
Last updated on