- Contact: [email protected] | [email protected]| (+1-267-501-4333)
Our comprehensive audit logging system captures ALL data categories across your entire business - from patient records to financial transactions.
| Field | Description | Purpose |
|---|---|---|
| user_id | Who performed the action | Accountability |
| user_role | Role of the user (admin, doctor, accountant, cashier) | Segregation of duties |
| action | VIEW / INSERT / UPDATE / DELETE / EXPORT / PAYMENT | Action type |
| table_name | Which table was accessed (patients, billing, inventory, etc.) | Data category |
| record_id | Which specific record was accessed | Record identification |
| old_value | Before image (for UPDATE/DELETE) | Full audit trail |
| new_value | After image (for INSERT/UPDATE) | Change tracking |
| ip_address | IP address of the user | Location tracking |
| session_id | PHP session ID | Session tracking |
| created_at | Timestamp of action | Timeline evidence |
| reason | Purpose of access (treatment, payment, operations) | Justification |
| patient_id | Link to patient for HIPAA accounting requests | HIPAA compliance |
| financial_transaction_id | Link to financial transaction | SOX compliance |
| old_financial_value | Previous amount | Financial audit trail |
| new_financial_value | New amount | Financial audit trail |
| journal_entry_type | debit/credit/reversal/adjustment | Double-entry accounting |
| debit_account | Account being debited | SOX compliance |
| credit_account | Account being credited | SOX compliance |
Audit controls required for all systems containing ePHI. Must record and examine activity. 6-year retention. Business Associate Agreements required.
Financial audit trails for all accounting transactions. Need before/after values, journal entries, approval workflows, segregation of duties.
Right to access, rectification, erasure. Record of processing activities (ROPA). Data protection impact assessments. Standard Contractual Clauses for transfers.
Meaningful consent required. Breach notification. Accountability principle - documented safeguards. Provincial rules (Ontario PHIPA) require explicit privacy policies.
Mandatory HDS (Hébergement de Données de Santé) certification for hosting French health data. End-to-end encryption. Strict data localization.
Strict data localization. 25-year health data retention (UAE). Cross-border transfer restrictions. Tamper-proof audit trails required.
Notifiable Data Breaches scheme. Prohibition on identifiable health record export. 13 Australian Privacy Principles (APPs).
13 Information Privacy Principles (IPPs). Mandatory breach notification. Reasonable security safeguards required for all health information.
| Regulation | Retention Period | Requirements | '
|---|---|---|
| HIPAA (US) | 6 years | Audit logs must be retained for 6 years from creation |
| SOX (US) | 7 years | Financial audit records must be retained for 7 years |
| GDPR (Europe) | As needed | Retain as long as processing purpose exists + limitation period |
| UAE Health Data Law | 25 years | Health data must be retained for 25 years after last visit |
| France HDS | 10 years | Minimum 10-year retention for healthcare records |
| Australia My Health Records | 30 years | My Health Record data retention requirement |
| Canada PIPEDA | As needed | As long as necessary for identified purposes |