Audit trails that hold up: PHI access logging your compliance officer will actually use

When regulators ask questions, marketing does not answer them. Compliance officers do—with evidence. The evidence is not “we care about security.” It is a chain of records: who accessed PHI, when, from where, with what authorization, and whether that access matched policy. If your audit trail is a spreadsheet that admins can edit, or a log stream that nobody can export, or a vendor dashboard that only shows the last seven days, you are one incident away from a very bad month.

This essay goes deep on what “audit trail” should mean beyond a checkbox: immutability, attribution, retention, export, AI-specific logging, and how to test vendor claims before contract signature. It is long because shortcuts here are expensive.

Minimum viable audit story

At minimum, you need user identity, timestamp, resource identifier, action (read/write/export), and result (success/failure). For healthcare systems, you also need context: patient, encounter, and whether access was break-glass or routine. Without context, you cannot answer “why did this nurse open this chart?”

Logs should be centralized and tamper-evident: append-only storage, cryptographic chaining, or WORM-style retention—whatever your architecture supports. If the vendor can silently delete rows, you do not have audit evidence; you have a diary.

Role policy and separation of duties

Access should match role. If everyone is admin, your audit trail is meaningless. Separation of duties matters: who can create users, who can reset MFA, who can export bulk data, and who can approve break-glass access. Those approvals should be logged too.

AI and the expanded boundary

When AI features process audio or text, logging must expand: what audio or text left the boundary, to which subprocessor, what model version, what returned, and when outputs were reviewed by a clinician. If you cannot produce that trace, you cannot explain a bad outcome to a patient or a board.

Silence in logging is not privacy—it is unaccountability.

Retention, export, and legal hold

Your policy should define retention for logs as clearly as for PHI. Legal hold should freeze relevant records without deleting adjacent events. Export should be available in standard formats your counsel can hand to counsel—not a proprietary viewer that only works on Tuesdays.

Operational drills beat vendor promises

Run a quarterly drill: simulate a suspected inappropriate access, time how long it takes to produce a complete chain of evidence, and note gaps. If the drill takes three weeks and five tickets, your audit trail is not operational—it is aspirational.

• Can you export a patient’s access history for the last 12 months in one request?
• Can you prove immutability—or at least detect tampering?
• Are AI inference calls logged with the same rigor as human reads?
• Do break-glass events require approval and auto-expire?

teleclinicos is designed so auditability is not an afterthought: logging, access, and AI flows are part of the same compliance story. If you want a technical review with your security lead, we can walk through it line by line.