Security audit log

HIPAA asks every clinic to record security activity and review it regularly. NeatPractice keeps two logs for you, and every plan includes both, Free included.

The audit log#

Open Setup and choose Audit Log to see who did what and when:

• Sign-ins: each time someone signs in, with the address they signed in from, and each time someone who works for several clinics switches to yours without signing in again (Switched clinic).
• Failed attempts: rejected sign-ins and wrong multi-factor authentication codes, for example when signing a note.
• Access changes: invitations, removed or disabled members, role and permission changes, location access, seat changes and members changing their own sign-in email.
• Support access: when you grant or revoke vendor support access, and everything support staff do while impersonating a user under that grant.
• Settings and exports: changes to security settings, patient merges, and exports of patient information.
• Subscription changes: modules and add-ons added to or removed from your subscription (Module or add-on changed).

Filter by event type or date in the table toolbar, or pick an Actor (who did it) or Target (who it was done to). To see one person's sign-in history, pick them as the Actor and filter Event to Signed in. Click an event's date to see its details.

Choose Export CSV to download the rows that match your filters, for a periodic review or an auditor.

The PHI access log#

Choose PHI access log at the top of the audit log, or open Reports > Administrative > PHI access. It lists who viewed, exported, printed or sent each patient's records, with any break-glass reason. Pick a patient to see who opened their chart, or a user to see what they opened, and export it as CSV, Excel or PDF. See running reports.

Who can see the logs#

The audit log needs the audit log permission, which the Owner, Clinic Admin and Read-only Auditor roles have. The PHI access log needs the administrative reports permission. You can give either to another role, such as a compliance officer, in roles and permissions. Exporting the PHI access log also needs the report export permission.

How long entries are kept#

Entries cannot be edited or removed, so both logs stay trustworthy for compliance reviews. NeatPractice keeps the audit log for at least six years on every plan. Enterprise plans keep it searchable for ten years. The PHI access log is kept for as long as your clinic uses NeatPractice, and it is part of the full data export you receive if you close your account.