The PHI Access Audit

Every read of protected health information anywhere in KamoCRM is recorded as a PHI access record: who (actor), what kind of access (view, list, search, download, export, or disclose), on what record (one of 17 tracked resource types — leads, contacts, documents, loan files, chat messages, call recordings, and more), whether it was allowed or denied, from what IP, and when.

This exists to satisfy two specific HIPAA obligations: a periodic activity review, and the ability to answer an individual asking who has accessed their record (an "accounting of disclosures").

Reading the severity model

Rows aren't all equally interesting — the grid highlights them in priority order:

1. Denied — a read that was refused. Always the most important signal.
2. Platform staff — Kamo's own staff accessing the data, distinct from your organization's workforce.
3. Bulk — downloads, exports, or disclosures, where data actually left the platform rather than just being viewed on-screen.

Everything else is a normal, allowed view by someone in your organization and isn't specially marked.