Office admin

Security and the audit trail

The 2FA switch that can lock people out, session limits, and turning a tamper-evident log into an actual compliance routine.

8 min · Administrators · lesson v1

These two cards are where a practice's HIPAA posture stops being a policy document and becomes something you can show somebody.

Security

  1. Security carries chips telling you the deployment posture — secure mode or demo mode, dev headers on/off — then three settings:

    • Require two-factor authentication for every login
    • Session timeout — deployment default, or 15 minutes, 30 minutes, 1 hour, 4 hours, 8 hours, 12 hours
    • Minimum password length (new accounts) — 8 to 64

    Screenshot pending capture

Session timeout is a judgement about where your screens are. A shared desk in a waiting room wants 15 minutes; a clinician's private office does not. Under deployment secure mode it can only be tightened, never loosened.

Compliance

  1. Compliance — chipped display-only — a human reviews; nothing is auto-actioned — turns the audit trail into a routine:

    • Unusual-access threshold (distinct charts per person per day)
    • Declared audit retention (years — HIPAA minimum 6)
    • Allow audit-log export (CSV)

    Screenshot pending capture

The unusual-access report runs for a chosen UTC day and lists Person, Type, Distinct charts, Total events, Status — flagging anyone at or over your threshold.

What counts is defined precisely, and it is worth reading before you set a threshold: chart opens, demographic edits and portal-link issuance — including denied attempts — while searches and non-patient resources do not.

Audit-log export (CSV) covers a date range — inclusive days, up to 92 days or 50,000 rows — and exports audit metadata only, never clinical content. The export is itself audited: this export is itself in the audit log (audit.exported).

If export is switched off, the server refuses it outright rather than failing quietly.

Retention, honestly

The retention field records the practice's declared policy. It does not delete anything, and the card says so twice. Audit records are append-only.

That is the right behaviour — an audit trail you can prune is not an audit trail — but it means the number is a statement of intent, not an enforced lifecycle. Know that before you tell a surveyor otherwise.

Below Compliance sits Audit search: who did what, when, with quick views for Sign-ins & security, Failed sign-ins, Chart access and Everything today.

Reading it is itself recorded, which is why it starts empty rather than auto-running.

A monthly rhythm that works: run the unusual-access report for a few days, use Chart access to spot-check anything odd, and export the month for the compliance file if your practice keeps one.

What usually goes wrong

Requiring 2FA before people have enrolled. The warning tells you exactly how many. Believe it.

Setting a 12-hour session on a shared front-desk machine. That is an unattended chart for most of a day.

Believing retention purges. It doesn't.

Never running the report. A tamper-evident log nobody reads is a technical achievement, not a compliance control.

Check yourself

No score, no account — just make sure you can answer these before you move on.

  1. You tick Require two-factor authentication for every login and get a warning about active accounts. What is it telling you?

    Show the answer

    How many people are about to be locked out — {n} active accounts have no authenticator enrolled and will be unable to sign in until they enroll. It even says what to do: have them enroll before saving. Saving anyway on a Monday morning is a memorable mistake.

  2. The retention setting says six years. Does the system delete audit records after six years?

    Show the answer

    No. The card is explicit — Declared policy only — no audit record is ever deleted by this setting, and audit records are append-only and nothing is deleted. It records what you have declared, which is what a survey asks for. Actual purging is a deliberate future piece of work.

  3. What exactly does the unusual-access report count?

    Show the answer

    Audit events addressed to a specific patient record (chart opens, demographic edits, portal-link issuance — including denied attempts); searches and non-patient resources don't count. It flags people at or over your threshold, and nothing is blocked automatically — a human reviews.