Audit log
An audit log is the append-only, timestamped record of every action taken on a patient’s care — who viewed a record, what a clinician decided, when a prescription was signed, which system created an order — that HIPAA requires for access to protected health information and that boards, auditors, and acquirers ask for first.
- Append-only record of every action on patient care
- Required by HIPAA for PHI access; asked for by every auditor
- Attributes agent actions and clinician decisions
- Should be exportable via API
What it has to capture
- Actor: the person, service, or agent that acted, with its identity
- Action and object: what was done to which patient, encounter, or order
- Timestamp in a consistent zone, and the source (app, API key, clinician console)
- Clinical decisions with their basis — what the clinician saw when deciding
- Access events, not just changes: who read a chart, and when
Audit logs and AI agents
When agents act, the log is what separates automation from opacity. Every agent action should carry the agent’s identity and what it was asked to do, every escalation should be recorded, and every clinician decision should be attributable to a licensed human. A program that can show that record has an answer to “who decided this” for any prescription it ever issued.
Exportability
A log you cannot export is a log you do not own. Infrastructure should make the full audit trail available through the API, so a brand can satisfy an auditor, a board inquiry, or a due-diligence request without asking the vendor for a favor — including after leaving.
Compliance handled, so you can build
Lithos runs the clinicians, pharmacies, and 50-state rules behind your care program — one API.
Frequently asked questions
How long must healthcare audit logs be kept?
HIPAA requires documentation to be retained for six years; many states set longer medical-record retention periods. Design for retention at least that long and for export at any time.
What is the difference between an audit log and an EHR chart?
The chart is the clinical record of the patient. The audit log is the record of what happened to the chart and the care — who accessed, decided, changed, and when. Both are needed.