Audit Log

Overview

The Audit Log records every significant action performed in your clinic's system. Every create, update, delete, and view of sensitive data is logged with the user who performed it, their IP address, timestamp, and the exact changes made. This is essential for security monitoring, regulatory compliance, dispute resolution, and tracking unauthorized access attempts.

Viewing the Audit Log

1. Navigate to Settings > Audit Log — Click Settings and select the Audit Log tab. Only clinic admins can access this section.
2. Apply filters — Use the filter bar to narrow results:
   • Search — Type to search by user name or action description
   • Action — Filter by: create, update, delete, login, login_failed, logout, complete, check_in, status_change, approve, reject (auto-populated from your data)
   • Entity type — Filter by: patient, visit, appointment, invoice, payment, prescription, diagnosis, settings, session (auto-populated from your data)
   • User — Select a specific staff member from the dropdown to see all their actions
   • Date range — Set start and end dates
3. View log entries — Each entry shows:
   • Timestamp
   • User name (resolved automatically from the staff who performed the action)
   • Action type (create, update, delete, login, etc.)
   • Entity type (patient, visit, appointment, etc.)
   • Description (human-readable summary of what happened)
   • IP address
   • Changes made (expandable previous_state vs. new_state for entity modifications)
4. Click an entry for details — Expand to see the full JSON diff of what changed.

Frequently Asked Questions

How long are audit logs retained?

Audit logs are retained for 2 years. After that, they are archived but can be retrieved upon request for legal purposes.

Can I export audit logs?

Yes. Use the export button to download filtered audit logs as a CSV file for external analysis or regulatory submission.

Are failed login attempts logged?

Yes. Failed login attempts are logged with the attempted username, IP address, and user agent. Multiple failed attempts from the same IP may indicate a security threat.