The short answer
Log every access to a patient record, not just changes. Reading a record is the event that matters for most investigations, and systems that log only writes cannot answer the question that actually gets asked.
Keep the log outside the reach of the users it tracks, and make it searchable by patient, by user and by date range.
What to record
- Which user, by named account rather than a shared login
- Which record, and which part of it
- When, to the second, in a consistent time zone
- What action: viewed, created, amended, printed, exported
- Where from, including device or location where available
- Why, where your process requires a reason for access
The last one is the most contentious and the most useful. Requiring a reason for access outside a care relationship changes behaviour more than logging alone.
Make it queryable
| Question that gets asked | What the log must support |
|---|---|
| Who has seen this patient's record? | Search by patient |
| What has this user accessed? | Search by user, date range |
| Did anyone access this outside a care relationship? | Join against appointments or caseload |
| Was this record exported? | Action type recorded distinctly |
| Who changed this value? | Field-level history |
A log stored but not searchable satisfies nobody. The first serious investigation is when this gets discovered, and by then the format is fixed.
Protect the log itself
An audit trail that administrators can edit proves nothing. Write it append-only, keep it in a separate store where practical, and restrict who can read it to the people whose job it is.
That last point matters. The log contains sensitive information about patients and about staff, and unrestricted access to it creates its own problem.
Retention and volume
Access logs grow quickly and retention is usually set by regulation or policy rather than by convenience. Decide the period, and design the storage so meeting it does not become a cost problem.
Archive older entries to cheaper storage rather than deleting them early, and make sure the archive is still searchable, because investigations frequently concern events some time ago.