Audit log: every event, every column, every filter
A reference for what is actually captured in the audit log, the eight event categories the UI groups by, and how to export an evidence packet for an investigation.
- Updated
- Updated
- Reading time
- 7 min read
- Tags
- auditcompliancehipaalogs
The audit log is the single source of truth for "who saw what, when". This is the deeper companion to the access-review article — it walks the actual page, every event type, the filters, and the export.
How events are stored
Audit entries are written via PaperTrail at the model layer for every create / update / destroy on a chart-bearing record, plus custom events for sign-ins, chart views, exports, and permission changes. Entries are immutable — the database role that the app runs as has no UPDATE or DELETE on the audit table. Every entry is scoped to your establishment and indexed on (medicalestablishmentid, created_at).
The eight event categories
Dr. Lin Yu · Provider
Opened chart · Patient · Maria Lopez
Today, 9:42am
73.21.4.118
Dr. Lin Yu · Provider
Signed and locked · Note · Visit 2026-04-21 · changed: Signed at, Status
Today, 9:51am
73.21.4.118
Sam Cole · Practice manager
Exported CSV for compliance review · Audit log · 1,247 rows
Today, 10:14am
108.4.99.12
Sam Cole · Practice manager
Granted manage_billing · User · Dana Park
Today, 10:18am
108.4.99.12
The UI groups events into: All, Views (chart opens), Edits (any field change), Creates (new records), Deletes (record destruction or soft-delete), Sign-ins (login + logout), Exports (PDF, CSV, ICS download), Permissions (role change, invite, deactivation). Each event has an icon and a color so the eye scans for category before reading text.
Columns on every row
Actor (name + role), IP address, timestamp (your timezone), resource (e.g. "Patient: Maria Lopez", "Note: Visit 2026-04-12"), action verb, changed fields (for edits — humanized labels like "Signed at" instead of signed_at), and a free-form description for custom events. The actor name and patient name are cached server-side on the entry so deleting the user later does not erase the audit trail.
Filtering and searching
Top-bar filters: event category (one of the eight above), date range, actor (autocomplete by user name), resource type (Patient, Note, Appointment, etc.). Free-text search runs across actor name, resource, and patient name. Filters compose with AND; share-link the URL to send a filtered view to a colleague or compliance officer.
Exporting an evidence packet
The Export button generates a CSV of every row matching your current filter, plus a PDF cover sheet with the filter, who exported, and a SHA-256 hash of the CSV body. The export itself is logged as its own audit event ("export · audit log · 1,247 rows") so a future audit can confirm what evidence was pulled when. Exports respect role: only users with managepracticesettings or admin overlay can export.
Retention
Audit entries retain for the life of the establishment (no TTL is applied). For practices subject to specific regulatory retention (CMS, state medical board), the audit log is the system-of-record we recommend pointing your compliance officer at. Database-level backups extend retention beyond a deletion of the establishment for the period defined in your BAA.
Things the log does not (yet) capture
Read-only access to non-chart pages (settings views) is not logged; only chart reads are. Bulk operations are logged as one entry per affected record (a 200-patient broadcast generates 200 entries). Webhook deliveries to third-party integrations are visible under Establishment → Integrations → Activity, not in the audit log itself.