The Disclosure Log

The disclosure log records every time information was passed on in your organization: who passed on what, to whom, on what basis, and what the disclosure rules decided. Where the PHI access audit answers "who has looked at this record", the disclosure log answers "who has been told about it".

What gets recorded

One disclosure event is written for each send or share:

• SI members are recorded every time. Every message, email, text message, call, meeting, task, calendar event or lead note an SI member sends through its tools writes one event.
• People are recorded when they deliberately pass something on: a share, a forward or a release. Ordinary work, such as replying in a conversation you are part of, is not a disclosure.

Each event says:

• Shared by: the person or SI member who passed it on.
• Channel and Action: how it went out (chat, email, call and so on) and what kind of step it was (send, reply, forward, share, release).
• Recipients: each member, team, department, the whole organization, an outside contact, or the public.
• Sources: the records it drew on, such as a conversation, an email thread, a lead, a note or a document. Each source shows whether it was Cleared for the recipients, whether it is Confidential, and the basis that cleared it, for example Took part, Already had access or Need to know (open work on it).
• Decision: what the disclosure rules decided, below.
• Output and Reason: where it went, and the rule or reason behind the decision.

The organization's disclosure posture (Strict, Need to know or Open) and its enforcement mode (Audit or Enforce) at that moment are kept on the event too, so an old event still reads correctly after the settings change.

What each decision means

• Allowed: every source was cleared for every recipient, and it went out.
• Allowed with a warning: it went out, but some recipients were not cleared for every source. In Enforce mode the sender was warned first and chose to go ahead.
• Denied: stopped, and nothing was sent. For example, a Confidential record shared outside its audience, or information going to an outside contact that nobody can release to them.
• Release required: held, and nothing was sent. A source was not cleared for a recipient, and the person who owns that information has to release it first.
• Released after approval: it needed a release, the owner approved it, and it went out.
• Overridden: the rules would have stopped it, and someone allowed to overrule them let it go.
• Would deny and Would need release: recorded only in Audit mode. The send went ahead, and Enforce mode would have denied it or held it for a release.

The log colours these so the ones worth reading stand out: stopped (Denied, Release required) in red, Would deny, Would need release and Allowed with a warning in amber, and Released after approval and Overridden in blue. A plain Allowed is not marked.

Audit and Enforce

Every organization starts in Audit mode. In Audit mode the disclosure rules change nothing anyone or any SI member does: everything goes out as it would have, and the log records what Enforce mode would have done.

That makes the "Would" rows the report to read before you switch to Enforce. The tiles at the top of the log count the last 30 days: Would deny, Would need release, and Would withhold (reads), which counts the times an SI member looked something up that Enforce mode would have kept from it. If those numbers show sends you want to keep, adjust the posture, who works on what, or the labels on your records before switching. After the switch, the Denied and Release required tiles count what was actually stopped.

In Enforce mode the log is part of every send. The event is written before the information goes out, and if it cannot be written, nothing is sent: an SI member is told to try again, and a person sees an error.

What it never holds

The log records identifiers and labels, never the content. It says that a message went to three people and drew on two conversations; it never holds the message, the conversations, or anything quoted from them.

Nothing in the log is ever deleted. The product has no way to change or remove an event, for administrators either. An account of who was told what is only useful if it is complete, and a question about a confidential decision can come up years later. Because the log holds no content, keeping it exposes nothing new.

Who can read it

• View Access Logs opens the whole log, the Disclosure history of any record, and every SI member's disclosures.
• Export Access Logs is needed, as well, to export it.
• An SI member's supervisor sees that SI member's own disclosures on its workbench, even without View Access Logs: who it told, through which channel, the decision and the basis, and how many records it drew on and how many were not cleared, but never which records. Seeing the records themselves needs View Access Logs.

Every look at the log is itself recorded, refusals included, and so is every export. For the screens, see How to Review the Disclosure Log. For who has opened protected health information, see The PHI Access Audit.