Append-Only Audit Log

Every state-changing action in the application — staff sign-ins, MFA changes, patient check-ins and meal preferences, staff invitations, and admin configuration changes — is written to an audit trail automatically, plus access to EHR records and reveals of patient identifiers. This page describes the guarantees behind that trail, for your security or compliance review.

What each entry records

Each entry records who did what, when, from where, and to which record, along with whether the action succeeded.

Why entries can’t be altered

The audit log is append-only at the database level: once an entry is written, the application itself has no ability to edit or delete it, even if application code were compromised. This is enforced by a separate database role that only has permission to insert new entries, never to change or remove existing ones — a design intended to support HIPAA’s audit-control and integrity requirements.

Hospital administrators can review a read-only view of this history for any staff member from the Admin area; see Per-User Audit History View for how that view works.