The eCR Viewer writes audit records for key user, administrative, and eCR access workflows. Audit logging is populated when the Viewer runs in DUAL or NON_INTEGRATED configurations. In INTEGRATED mode, it is the responsibility of the integrating tool to log accesses to the eCRs.
Audit logs are stored in the Viewer metadata database in the audit_log table.
The Viewer currently records audit events for:
The schema for the audit log table can be found in the database documentation.
The audit record is written in the same database transaction as the audited action whenever the action uses the standard audit wrapper. This keeps the application change and its audit event together: if the transaction rolls back, the audit record rolls back with it.
In order to comply with standards set forth by ONC, audit logs need to be retained for ten years past the lifetime of the medical record, which in our case, is the length of time the eCR is available in the Viewer.
The audit log generates a SHA-256 checksum based on author, timestamp, and message contents to determine if there are any changes to the written audit log data.
The Viewer audit log is designed to support the audit data elements described in the ONC Auditable Events and Tamper Resistance test method, including event time, user identification, patient or eCR identification, action type, and the data accessed.
The ONC Audit Reports test method describes expectations for chronological audit review and filtering by start and end date.
Audit data retention should follow ASTM E2147-18, which includes the 10-year retention requirement.
For tamper-evident records, ONC references hashing strength at least equivalent to SHA-2 in the Health IT certification criteria final rule. The Viewer uses SHA-256.