Audit · immutable change history · HIPAA §164.312(b)
Audit log
Tamper-evident record of every PHI access, change, export, and authentication event. Retained 7 years per VA / HIPAA. Cryptographically chained — see hashes at right.
All sources · 24h window · UTC
142,418 events
across 218 unique actors · 8 modules · chain integrity verified 30 sec ago
PHI access
98.4k
read · 96% of events
Writes / changes
3,842
notes · orders · plans
Failed auth
14
2 flagged for review
Exports
42
CSV · OAP · billing batch
Search
Action type
Module
Result
Window
Timestamp · UTC
Action
Actor
Target
Result
2026-05-09
14:18:32
Care plan updated · care_plan/8842
+ semaglutide 0.25 mg sq weekly · uptitrate lisinopril 20→40 mg
Singh, Aliya · MD
NPI 1487201938 · IP 10.42.18.7
Patient/4419873
Marquez, Jose
200 OK
2026-05-09
14:14:08
Patient chart opened · encounter/start
Encounter workspace launched · live timer
Reyes, Maria · RN
NPI 1925441821 · IP 10.42.18.7
Patient/4419873
Marquez, Jose
200 OK
2026-05-09
14:09:42
Screener completed · PHQ-9
Score 14 (moderate) · item 9 = 0
VIDA · service account
api_key cc_pk_live_••••a921
Patient/4419873
Marquez, Jose
200 OK
2026-05-09
13:42:18
Export · OAP submission · OAP-26-04
1,408 records · ACCESS · all 4 tracks · 18.2 MB
CQID OAP · service
api_key cc_pk_live_••••e105
batch/OAP-26-04
CMS endpoint
202
2026-05-09
13:18:04
Auth · sign-in · 2FA passed
SSO via Okta · MFA push · session 8h
Reyes, Maria · RN
IP 10.42.18.7 · device MR-MBP-04
session/sess_kj4f9
200 OK
2026-05-09
12:51:42
Auth · sign-in · denied · MFA failed
3rd consecutive failure · account auto-locked 15 min
unknown · pending review
IP 174.62.84.12 · geo: NY (mismatch)
user/u_aliya.singh
401
2026-05-09
12:18:21
Note signed · encounter/8841 · 99214
SOAP note signed; locked for edits · cosign requested
Singh, Aliya · MD
NPI 1487201938
Patient/2284108
Hall, Linda
200 OK
2026-05-09
11:42:08
Bulk PHI access · caseload/maria_reyes
7 patients loaded · justified by assigned caseload
Reyes, Maria · RN
NPI 1925441821 · IP 10.42.18.7
caseload/maria_reyes
7 patients
200 OK
2026-05-09
10:18:32
Cross-tenant access · flagged · review
Glendale CBOC user accessed Phoenix VAMC patient · auto-routed to compliance
Tanaka, Jin · FNP
NPI 1408329114 · cross-facility
Patient/6018440
Patel, Saanvi
202 flag
2026-05-09
09:32:14
Care plan amended · care_plan/8804
PHQ-9 follow-up cadence: monthly → weekly
Chen, Rosa · MD
NPI 1592718442 · psych
Patient/2284108
Hall, Linda
200 OK
2026-05-09
08:14:42
System · retention sweep
3,418 records past 7y retention · archived to cold storage
system · ORAK retention
scheduled job · job_42f8
archive/retention_sweep_42f8
200 OK
2026-05-09
07:42:08
Export · billing batch · BIM-2026-05-A
218 claims · $124,800 · sent to clearinghouse
BIM · service
api_key cc_pk_live_••••71fa
batch/BIM-2026-05-A
200 OK
Showing 12 of 142,418 events · Load more · Export filtered set
WRITE · care plan
·
14:18:32 UTC
Care plan updated · Marquez, Jose
evt_01HXP4F8R2K9NMD3Q5J7TZBVCM
Event details
Type
resource.update
Resource
CarePlan/8842
Patient
Patient/4419873 · Marquez, Jose
Module
Encounter / Patient · MCPV
Reason
Direct treatment · TPO
Actor
User
Singh, Aliya · MD · PCP
NPI
1487201938
Tenant
VISN 22 · Phoenix VAMC
Source IP
10.42.18.7
Device
AS-WS-118 · MDM-managed
Diff
−
medications.evening_insulin.dose: "24 units"
+
medications.morning_insulin.dose: "24 units"
+
medications.semaglutide: {"dose":"0.25 mg","route":"sq","freq":"weekly"}
−
medications.lisinopril.dose: "20 mg"
+
medications.lisinopril.dose: "40 mg"
Chain of custody · last 5 events
care_plan/8842 created
amended · BHI added
amended · CKM track enrolled
amended · BHI cadence changed
medications updated · current
Chain integrity · cryptographic
Last verification
automated · every 5 min
✓ 30s ago
Hash algorithm
FIPS 140-3 compliant
SHA-256
Latest event hash
Anchored to
External notary · daily
Surety
Inconsistencies
last 90d
0
Each event hash incorporates the prior event's hash, forming an append-only chain. Any tamper would break the chain and trigger a Compliance ticket.
Retention & storage
Hot tier · 0-90 days
queryable in < 1 sec
12.4M events
Warm tier · 90d-2y
queryable in < 30 sec
84.1M events
Cold tier · 2-7y
queryable in < 24h
312M events
Total disk
all tiers · encrypted at rest
2.84 TB
Retention policy
VA · HIPAA · 7y minimum
7 years
Last archive job
today 08:14 · 3,418 records
✓ ok
Activity heatmap · last 24h
Events per hour. Peaks at 09–11 (caseload review) and 14–16 (encounter block).
00
06
12
18
23
low
high