\n<\/p>\n
Healthcare generates an enormous amount of digital exhaust. Every lookup, every exchange, every routing hop, every system\u2011to\u2011system handshake leaves behind an audit trail. Yet patients rarely see any of it \u2014 and, importantly, U.S. regulations do not<\/strong> require that they do.<\/p>\n This creates a paradox: In this article, I\u2019ll unpack the regulatory reality, explain why audit logging still matters, and show how standards like FHIR AuditEvent<\/strong> and IHE Basic Audit Log Patterns (BALP)<\/strong> provide the foundation for meaningful transparency \u2014 including future patient\u2011facing safety tools.<\/span><\/p>\n Let\u2019s start with the misconception: HIPAA\u2019s Accounting of Disclosures<\/em> sounds like it might do this, but it doesn\u2019t. It excludes:<\/span><\/p>\n Treatment<\/span><\/p>\n<\/li>\n Payment<\/span><\/p>\n<\/li>\n Healthcare operations<\/span><\/p>\n<\/li>\n Most internal access<\/span><\/p>\n<\/li>\n Most external exchange<\/span><\/p>\n<\/li>\n Most analytics<\/span><\/p>\n<\/li>\n Most quality improvement<\/span><\/p>\n<\/li>\n Most care management<\/span><\/p>\n<\/li>\n Most research<\/span><\/p>\n<\/li>\n Anything with patient authorization<\/span><\/p>\n<\/li>\n<\/ul>\n In other words, HIPAA\u2019s accounting requirement covers only a narrow slice of activity \u2014 mostly only the activity that the patient had to be directly involved in requesting or authorizing (explicit consent). Thus, this report is not all that useful.<\/span><\/p>\n TEFCA introduces something new: This is meaningful, but limited:<\/span><\/p>\n It applies only to TEFCA-governed exchange<\/span><\/p>\n<\/li>\n It reports exchange<\/em>, not use<\/em><\/span><\/p>\n<\/li>\n It does not include internal access<\/span><\/p>\n<\/li>\n It does not include non\u2011TEFCA exchange<\/span><\/p>\n<\/li>\n It does not include analytics or operational uses<\/span><\/p>\n<\/li>\n<\/ul>\n TEFCA is a step toward transparency, but not a full \u201cdata use report.\u201d<\/span><\/p>\n Because audit logs serve three critical purposes<\/strong>:<\/span><\/p>\n HIPAA, HITECH, TEFCA, CMS, and state laws all require organizations to maintain audit trails. Even if patients don\u2019t receive them, regulators may demand them.<\/span><\/p>\n Audit logs are the backbone of:<\/span><\/p>\n Insider threat detection<\/span><\/p>\n<\/li>\n Account compromise detection<\/span><\/p>\n<\/li>\n Access pattern analysis<\/span><\/p>\n<\/li>\n Breach investigation<\/span><\/p>\n<\/li>\n Forensics<\/span><\/p>\n<\/li>\n<\/ul>\n Without detailed logs, organizations cannot detect misuse or prove compliance.<\/span><\/p>\n Even though patients don\u2019t get raw logs, they will<\/strong> benefit from tools built on top of them.<\/span><\/p>\n This is where standards matter.<\/span><\/p>\n
\nAudit logs are essential for trust, accountability, and safety, but giving them directly to patients would overwhelm more than empower.<\/strong><\/span><\/p>\nPatients Don\u2019t Get Full Access Logs \u2014 And That\u2019s By Design<\/strong><\/h2>\n
\nThere is no U.S. regulation requiring healthcare organizations to give patients a detailed log of every access, use, or disclosure of their data. (Note that GDPR in the EU is far more actionable, so those in that region can skip to the next section)<\/strong><\/span><\/p>\n\n
TEFCA Changes the Landscape \u2014 But Only Slightly<\/strong><\/h3>\n
\nQHINs must support patient access to a report of where their data was exchanged <\/strong>through TEFCA<\/strong><\/em>.<\/strong><\/a><\/span><\/p>\n\n
So Why Record Detailed Audit Logs If Patients Don\u2019t See Them?<\/strong><\/h2>\n
1. Regulatory Compliance (Even If Not Patient-Facing)<\/strong><\/h3>\n
2. Security and Abuse Detection<\/strong><\/h3>\n
\n
3. Future Patient-Facing Transparency Tools<\/strong><\/h3>\n
FHIR AuditEvent + IHE BALP: The Foundation for Trustworthy Logging<\/strong><\/h2>\n