Audit Logs

Praxi maintains comprehensive, immutable audit logs of all system activity for compliance, security monitoring, and clinical governance requirements. Every action that accesses, creates, modifies, or deletes client data is permanently recorded with full attribution.

info

7-Year Retention Requirement — Under the Privacy Act 1988, state Health Records Acts, and professional standards, audit logs relating to clinical records must be retained for a minimum of 7 years. Praxi automatically retains all audit logs for this period and beyond, ensuring you can demonstrate compliance with access and disclosure requirements. :::

Why Audit Logs Are Critical

Regulatory Requirements

Multiple Australian regulations require comprehensive audit logging:

Regulation	Requirement	Implication
Privacy Act 1988 (APP 11)	Take reasonable steps to protect personal information	Must demonstrate security measures including access logging
Privacy Act 1988 (APP 12)	Provide access to personal information	Must identify who accessed what and when
Health Records Acts	Clinical record integrity	Must demonstrate records haven't been improperly altered
AHPRA Professional Standards	Accountability for clinical decisions	Must track who made clinical entries
Medicare Requirements	Claiming integrity	Must demonstrate service was provided by claimed practitioner

Practical Benefits

Beyond compliance, audit logs help you:

• Investigate complaints - Determine exactly what happened and when
• Demonstrate due diligence - Show appropriate access controls were in place
• Support legal defence - Provide evidence in malpractice or privacy claims
• Quality improvement - Identify workflow issues and training needs
• Staff accountability - Ensure appropriate use of system access

What Gets Logged

Audit logging captures:

Category	Examples
Clinical activity	Note creation, viewing, signing, amendments
Client records	Profile views, updates, consent changes
Appointments	Bookings, cancellations, status changes
Billing	Invoice generation, payments, refunds
User actions	Logins, logouts, password changes
System changes	Settings updates, permission changes

Accessing Audit Logs

Practice Owner Access

1. Go to Monitoring → Audit Trail (from the main sidebar, under Practice)
2. View recent activity across the entire organisation
3. Use filters to find specific events
4. Generate compliance reports or export as CSV/PDF

Your Own Activity (All Users)

Every user can see their own recorded activity — including who has accessed their information — on their personal privacy page at Settings → Privacy.

Who Can Access

Role	Access Level
Practice Owner, Supervisor	Full audit log access, compliance reports, exports
All other roles	Own activity only (personal privacy page)

Log Structure

Event Information

Each audit entry includes:

Field	Description	Example
Timestamp	When the action occurred	2024-01-15 14:32:45 AEST
User	Who performed the action	Dr Sarah Chen
Action	What was done	VIEW_CLIENT_RECORD
Resource	What was affected	Client: John Smith
Details	Additional context	Viewed clinical notes
IP Address	Source location	203.45.67.89
Device	Browser/device info	Chrome on MacOS

Action Types

Category	Actions Logged
Authentication	LOGIN, LOGOUT, PASSWORD_CHANGE, MFA_ENABLE
Client	CREATE, VIEW, UPDATE, DELETE, MERGE
Clinical Notes	CREATE, VIEW, EDIT, SIGN, AMEND, EXPORT
Appointments	BOOK, RESCHEDULE, CANCEL, MARK_ATTENDED
Billing	INVOICE_CREATE, PAYMENT_RECORD, REFUND
Settings	PERMISSION_CHANGE, CONFIG_UPDATE

Searching Logs

Filter Options

Filter	Purpose
Date range	Limit to specific period
User	Activity by specific person
Action type	Specific action category
Resource	Related to specific record

IP addresses are recorded on every entry and searchable in the on-screen results.

Search Examples

Find who accessed a client's record:

1. Go to Audit Logs
2. Filter by Resource: "Client: [Name]"
3. Filter by Action: "VIEW" or "All"
4. Set date range
5. Review results

Investigate unusual login activity:

1. Go to Audit Logs
2. Filter by Action: "LOGIN"
3. Filter by User: [Username]
4. Review IP addresses and times
5. Flag suspicious activity

Combined Filters

Combine multiple filters for targeted searches:

• Date range -- start and end dates
• Event type -- filter by action category (rest, login, logout, system)
• User -- filter by specific user
• Client name -- search by client name (partial match)
• Entity reference -- filter by specific record reference

Results are returned in reverse chronological order with cursor-based pagination for large result sets.

Viewing Log Details

Log Entry Detail View

Click any log entry to see:

• Full event details
• Related events (same session)
• Before/after values (for changes)
• Device fingerprint
• Geographic location (approximate)

Clinical Note Audit Trail

For clinical notes, track:

Event	Details Captured
Created	Author, template used, client
Viewed	Who, when, duration
Edited	Changes made, reason
Signed	Signer, timestamp, digital signature
Amended	Amendment text, reason, original preserved
Exported	Format, recipient, purpose

Exporting Logs

Export Options

Format	Use Case
CSV	Analysis in Excel, database import
PDF	Formal compliance report for AHPRA or legal use

Generating Exports

1. Go to Monitoring → Audit Trail (from the main sidebar)
2. Apply filters (date range, event type, user)
3. Click Export CSV for spreadsheet analysis, or Export PDF for a formal compliance report
4. The PDF report includes event summaries, suspicious activity detection, and Australian healthcare compliance metrics
5. Download the file

Export Scope

Exports are automatically scoped to your organisation. You can apply filters for date range, event type, and user before exporting. CSV exports support up to 10,000 records per download. For larger datasets, narrow the date range and export in batches.

Compliance Reports

Standard Reports

Report	Content	Frequency
Access Summary	Who accessed what records	Monthly
Login Activity	Authentication patterns	Weekly
Clinical Access	Note views and changes	Monthly
Permission Changes	Security-relevant changes	On demand
Failed Access	Denied access attempts	Daily review

Generating Reports

1. Go to Reports → Compliance → Audit Reports
2. Select report type
3. Set parameters
4. Generate and export

Audit Evidence

For compliance audits, export:

• Retention policy documentation
• Disposal certificates
• Hold records
• Decision logs
• Exception reports

Audit Chain Verification

Praxi protects audit log integrity with cryptographic hash chains. Each audit record's hash incorporates the previous record's hash, creating a tamper-evident chain. If any record is modified or deleted, the chain breaks and the system detects it.

Verifying the Chain

1. Go to Monitoring → Audit Trail (from the main sidebar)
2. Click Verify Chain Integrity
3. Set the date range to verify
4. The verification report shows:
   • Total records verified
   • Valid and invalid record counts
   • Any chain breaks detected (with timestamps and details)
   • Verification timestamp

tip

Run chain verification periodically (monthly is recommended) and before any compliance audit. The verification report serves as evidence that your audit trail has not been tampered with. :::

Security Monitoring

Suspicious Activity Detection

Praxi automatically analyses audit logs to detect suspicious activity patterns. The suspicious activity report covers the last 7 days by default and flags:

Pattern	Severity	Description
Multiple failed logins	Critical	Repeated failed login attempts for an account
Unusual access times	Warning	Access outside normal working hours
Bulk data access	Warning	Excessive record views in a short period
Policy violations	Varies	Access attempts that violate permission rules

Reviewing Suspicious Activity

The suspicious-activity analysis is included in the compliance PDF export from the Audit Trail (Monitoring → Audit Trail → Export), covering totals, users affected, and severity breakdown. Review it as part of your regular compliance checks and document any investigation findings.

Alert Notifications

Choose whether you receive security alert notifications under Settings → Organisation → Notifications (the security alerts preference).

Privacy Considerations

Accessing Client Records

When reviewing audit logs that show client record access:

1. Ensure legitimate business need
2. Document reason for review
3. Limit access to necessary information
4. Do not disclose unnecessarily

Staff Privacy

Audit logs contain staff activity data:

• Use for legitimate compliance purposes only
• Do not use for performance management without policy
• Inform staff about audit logging practices
• Follow employment law requirements

Retention and Archival

Retention Periods

Log Type	Retention	Basis
Clinical access	7 years minimum	Health records legislation
Authentication	7 years	Security best practice
Billing	7 years	Tax and Medicare requirements
System changes	7 years	Compliance documentation

Archival Process

After active retention:

1. Logs compressed and archived
2. Moved to secure cold storage
3. Access restricted to compliance team
4. Destruction scheduled per policy

Log Integrity

Audit logs are protected by multiple security measures to ensure they can be relied upon for compliance and legal purposes:

Protection	Implementation	Purpose
Immutability	Write-once storage, no delete/edit APIs	Prevents tampering with historical records
Encryption at rest	AES-256-GCM with IV + authentication tag	Protects audit data from unauthorised access
Cryptographic signing	SHA-256 hash chains	Detects any modification to log entries
Redundancy	Multi-region replication	Protects against data loss
Access control	Separate from main database (audit schema)	Prevents accidental or malicious deletion
Timestamping	NTP-synchronised, timezone-aware	Ensures accurate chronology
Attribution	User ID, session ID, IP address	Provides full accountability

warning

Log Tampering — Any attempt to modify, delete, or falsify audit logs is automatically logged and triggers security alerts. Audit log tampering may constitute criminal conduct and professional misconduct. :::

Legal and Compliance Requests

Responding to Requests

For subpoenas or formal requests:

1. Verify request legitimacy
2. Consult legal counsel
3. Scope the request appropriately
4. Export relevant logs
5. Document the disclosure
6. Retain copy of request and response

Audit Log for Legal Matters

Logs can demonstrate:

• Who had access to records
• When records were accessed or modified
• Changes made to information
• Compliance with access policies

Client Access Requests (APP 12)

Under Australian Privacy Principle 12, clients have a right to access their personal information, including knowing who has accessed their records.

Responding to Access Requests

When a client requests to know who has accessed their records:

1. Go to Audit Logs
2. Filter by Resource: "[Client Name]"
3. Set date range as requested
4. Export relevant entries
5. Review for any necessary redactions (staff names may be withheld in some circumstances)
6. Provide to client within 30 days

What to Include

Include	May Withhold	Must Not Include
Date/time of access	Staff member names (consult legal advice)	Internal security alerts
Type of access (view, edit)	IP addresses	System diagnostic data
What was accessed	Device information	Other clients' information

Best Practices

1. Review regularly - Weekly review of alerts and unusual activity
2. Train staff - Ensure team knows logging occurs and why
3. Document policies - Clear audit log access and review policies
4. Investigate promptly - Address security alerts within 24 hours
5. Retain appropriately - Follow minimum 7-year retention periods
6. Protect integrity - Never attempt to modify or delete logs
7. Regular audits - Monthly sampling of audit logs for anomalies
8. Staff awareness - Brief staff that all access is logged (deterrent effect)

Troubleshooting

Missing Log Entries

If expected entries aren't appearing:

1. Check date/time filters
2. Verify user permissions
3. Check action type filter
4. Ensure event occurred (not just attempted)
5. Contact support if confirmed missing

Performance Issues

For large log queries:

1. Narrow date range
2. Use specific filters
3. Export and analyse offline
4. Schedule reports for off-peak times

Related

• Compliance Overview
• Data Retention
• Permissions
• Signing Notes

Was this page helpful?