How to Review the PHI Access Trail

See every read of protected health information in your organization — for periodic review, or to answer someone asking who has accessed their record.

Before you start

The View Access Logs right to view; the separate Export Access Logs right to export.

Steps

1. Go to Settings → System Security → PHI Access Audit.
2. Four stat tiles summarize activity: Total accesses, Denied attempts, Platform staff access, Exports.
3. Filter by Member ID, Record type (Lead, Contact, Document, Loan File, and more), Record ID, Access type (View/List/Search/Download/Export/Disclose), Outcome (Allowed/Denied), Accessed by (Any / Platform staff / your workforce), and a date range.
4. Rows are visually flagged — Denied attempts (red) outrank everything else, then Platform staff access (amber), then Bulk actions like downloads/exports/disclosures (blue).
5. Switch the timestamp column between your local timezone and UTC using the toggle at the top — switch to UTC before quoting a timestamp in a report, to keep it unambiguous.

To see who accessed one specific record

Rather than filtering this whole grid, open that record directly and choose Access history from its menu — you'll land on the same audit view scoped to just that record, titled "Who has accessed this record". This is the exact accounting an individual is entitled to request.

To export

Click Export accounting (requires the separate Export Access Logs right). If the export can't be written to the audit trail itself, it's refused rather than silently succeeding — nothing is disclosed if that happens.