- Shipped
- August 3, 2026 at 3:04 PM UTC
- Author
- Kamo
- Commit
- fb89b3d
Until now PHI access was recorded only to a log stream with 14-day retention against a six-year obligation, and with no query surface. An accounting of disclosures under §164.528 is a query; stdout cannot be queried. Indexes are chosen for the three questions actually asked: everything that touched one record, everything one workforce member touched in a window, and everything in one tenant in a window (the §164.308(a)(1)(ii)(D) activity review). REVOKE UPDATE/DELETE is the database half of append-only; @PreUpdate/@PreRemove on the entity is the application half. Either alone is weak — the entity guard is bypassed by raw SQL, a grant can be re-added — but together the running application cannot quietly rewrite an audit row. Best-effort: CockroachDB lets a table owner retain privileges, so a failure is logged rather than fatal. Table verified present with all 14 columns and all three indexes before the entity was pushed, so no service can build against a mapping with no table.