Every read of protected health information anywhere in KamoCRM is recorded as a PHI access record: who (actor), what kind of access (view, list, search, download, export, or disclose), on what record (one of 17 tracked resource types — leads, contacts, documents, loan files, chat messages, call recordings, and more), whether it was allowed or denied, from what IP, and when.
This exists to satisfy two specific HIPAA obligations: a periodic activity review, and the ability to answer an individual asking who has accessed their record (an "accounting of disclosures").
Reading the severity model
Rows aren't all equally interesting — the grid highlights them in priority order:
- Denied — a read that was refused. Always the most important signal.
- Platform staff — Kamo's own staff accessing the data, distinct from your organization's workforce.
- Bulk — downloads, exports, or disclosures, where data actually left the platform rather than just being viewed on-screen.
Everything else is a normal, allowed view by someone in your organization and isn't specially marked.
Related articles
Other guides that answer questions close to this one.
How to Review the PHI Access Trail
See every read of protected health information in your organization — for periodic review, or to answer someone asking who has accessed their record. Before you start The View Access Logs right to view; the separate…
What Turning On PHI Handling Does
The PHI compliance boundary is a tenant-wide switch: turn it on when an organization handles protected health information and Kamo acts as its business associate under HIPAA. While it's on, the platform refuses every…
How to Manage Public API Keys
Scope note: despite the card's description ("control programmatic access to your organization's data"), this doesn't manage general CRM data API access. It manages keys for exactly five named integrations: Public Chat,…
How to Turn PHI Handling On or Off
Audience correction: unlike everything else in this Security section, this is not something any organization admin — including a full Administrator role — can reach or perform. The tab itself is only visible to platform…