TRUST

Audit & Evidence

Create reviewable evidence for sensitive actions, policy decisions, configuration changes and integration outcomes.

Owner: Security & Compliance Operations
Scope: Accountable service actions
Status: Published control statement

01 / CONTROL

Control model

Actor & context

Who/what acted, organization/workspace, subject/context and session assurance where relevant.

Decision

Action requested, authorization/policy result and reason category.

Configuration

Policy/configuration/model/interface version associated with the action where material.

Outcome

Timestamp, correlation, success/failure and resulting state or approval evidence.

02 / BOUNDARY

Responsibility boundary

Audit evidence is access-controlled and is not the same as a public evidence register; patient data and secrets are not published.

03 / ESCALATION

Evidence and escalation

Evidence requests are handled according to authorization, purpose and retention; the public website is not a direct audit-log export channel.

EVENT MODEL

Audit evidence answers who did what, to which object, when and why

The evidence model should distinguish authentication, access, business decisions and state changes while sharing correlation identifiers that reconstruct the end-to-end action.

Actor & session

Record the authenticated actor/workload, organization/workspace and session/device context appropriate to the event.

Object & action

Identify the affected patient/order/document/resource or configuration object and the action/decision performed.

Time & correlation

Use reliable timestamps plus request/workflow correlation so distributed events can be assembled without copying sensitive payloads into logs.

Outcome & reason

Record success/failure and, for approvals/overrides/corrections, the decision reason or reference required by policy.

EVIDENCE CHAIN

From event generation to reviewable evidence

Audit is useful only if collection, access and retention are controlled.

GenerateApplication/service emits the relevant event at the decision or state-change boundary.

NormalizeApply a consistent actor/object/action/time/correlation schema without flattening domain meaning.

ProtectRestrict write/admin access and separate audit/evidence operations from ordinary business editing where the deployment supports it.

Store & retainApply retention/archival controls appropriate to the event class and repository policy.

QueryAuthorized reviewers search by actor, object, time and correlation without gaining unrelated content access.

Export / investigateProduce a scoped evidence package for incident, dispute or compliance review with chain/context preserved.