Audit log: every event, every column, every filter
A reference for what the audit log captures, the event filters and date ranges the page offers, and how to save the entries on screen as a CSV.
- Updated
- Updated
- Reading time
- 7 min read
- Tags
- auditcompliancehipaalogs
The audit log is the single source of truth for "who saw what, when". This is the deeper companion to the access-review article — it walks the actual page, every event type, the filters, and the export.
How events are stored
Audit entries are written via PaperTrail at the model layer for every create / update / destroy on a chart-bearing record, plus custom events for sign-ins, chart views, exports, and permission changes. Entries are immutable — the database role that the app runs as has no UPDATE or DELETE on the audit table. Every entry is scoped to your establishment and indexed on (medical_establishment_id, created_at).
The event filters
Dr. Lin Yu · Provider
Opened chart · Patient · Maria Lopez
Today, 9:42am
73.21.4.118
Dr. Lin Yu · Provider
Signed and locked · Note · Visit 2026-04-21 · changed: Signed at, Status
Today, 9:51am
73.21.4.118
Sam Cole · Practice manager
Exported CSV for compliance review · Audit log · 1,247 rows
Today, 10:14am
108.4.99.12
Sam Cole · Practice manager
Granted manage_billing · User · Dana Park
Today, 10:18am
108.4.99.12
A row of filter buttons narrows the log to one kind of event: All, Views (chart opens), Edits (any field change), Creates (new records), Deletes (record destruction or soft-delete), Forms sent (documents and intake sections sent to a patient), Sign-ins, Exports (files that left the clinic, including documents downloaded from a chart or the portal) and Permissions (role changes, invites, deactivation). Each event has an icon and a color so the eye scans for category before reading text.
Columns on every row
Actor (name + role), IP address, timestamp (your timezone), resource (e.g. "Patient: Maria Lopez", "Note: Visit 2026-04-12"), action verb, changed fields (for edits — humanized labels like "Signed at" instead of signed_at), and a free-form description for custom events. The actor name and patient name are cached server-side on the entry so deleting the user later does not erase the audit trail.
Filtering and searching
Above the list: the event filter buttons, a search box and a date range. The search box looks across the actor, the patient, the IP address and the resource ("Search actor, patient, IP, or resource"). The date range is Today, Last 7 days, Last 30 days, All time or Custom range, which asks for the two days. They combine: an entry has to match the event filter, the search and the date range. When nothing matches, the page says "No matching activity" and suggests widening the filter or clearing the search. The list loads 50 entries at a time; Load more brings in the next page.
Exporting the log as a CSV
The Export CSV button saves the entries on screen as a CSV file: the ones that match your current filter, search and date range, and as many pages as you have loaded with Load more. The columns are When, First of, Actions, Actor, Role, Action, Resource, Source, Patient, IP, Description and Changed Fields. The export is CSV only; EnWella does not add a cover sheet or a file hash, so keep the file where you keep your other compliance records. The export is logged as its own audit event, so a later review can see that it happened and who ran it. Only admins can export.
Retention
Audit entries retain for the life of the establishment (no TTL is applied). For practices subject to specific regulatory retention (CMS, state medical board), the audit log is the system-of-record we recommend pointing your compliance officer at. Database-level backups extend retention beyond a deletion of the establishment for the period defined in your BAA.
Things the log does not (yet) capture
Read-only access to non-chart pages (settings views) is not logged; only chart reads are. Bulk operations are logged as one entry per affected record (a bulk message to 200 patients generates 200 entries). Webhook deliveries to third-party integrations are visible under Establishment → Integrations → Activity, not in the audit log itself.
Was this article helpful?