Audit settings and the health profile
Sign-ins, refused actions and the fields each change touched are always recorded in go flow; you cannot switch that off. On top of that you decide how much more your tenant keeps. Two places control that:
- the four audit settings of each organisation, which choose what is recorded and for how long, and
- the privacy settings of each client field, which choose how closely an individual answer is protected.
Care providers can set the health care profile, which fixes the strictest values for you.
Audit settings of an organisation
Open Configurations > Organisation, choose the Profile tab and look in the Attributes table under the heading Audit. The four settings sit together there. They belong to one organisation each: they are not inherited from your group, and they do not appear when you edit the group itself. Set them for every organisation that needs them. You need the right to edit that organisation, see Organisation settings.
| Setting | What it does |
|---|---|
| Keep record history | On: the values of a record before each change are kept, so a change can be reviewed and a record restored. Off (default): nothing is kept. |
| Audit retention (months) | How long record history and access entries are kept, from 12 to 120 months. 24 by default. |
| Log who reads client data | On: opening a client is recorded, and fields set to Logged when opened are loaded only when a client is opened. Off (default): reads are not recorded, and fields set to Logged when opened work like any other field. Fields set to Always logged are protected whatever this says. |
| Audit profile | Standard (default) leaves the three settings above to you. Health care switches record history and read logging on and fixes the retention at 120 months. |
Keep record history
Switching it on starts the record history: from the next change onward, every change to the organisation's records keeps the previous values and you can restore them. Nothing is recovered for changes made before. Switching it off stops new versions being kept; versions already kept remain until the retention period ends.
Audit retention (months)
The period applies to the organisation's record history and to its Access entries in the audit log. Entries older than the period are removed by a daily clean-up and cannot be brought back. Lowering the period therefore deletes the older entries at the next clean-up. Raising it keeps the entries that are still there for longer; entries already removed do not come back. The log's other categories (sign-in, data, money and administration) keep their own period of 13 months whatever you set here.
Log who reads client data
This is the switch behind read logging. While it is on, Client record opened, Protected client fields viewed and Data synchronised to a device entries appear in the log, and the client fields set to Logged when opened leave the synchronisation. Client fields set to Always logged leave it in every organisation, and loading them is recorded, whether this is on or off.
Switching it on records reads from that moment; nothing earlier is recorded. At their next synchronisation the devices drop the answers of the fields set to Logged when opened, answers given before included, and load them only when a client is opened. If such a field was a column of the client list or searchable, its column stays empty and search no longer finds it: open the field and save it, and the editor switches Show in table and Searchable off (see Rules the editor applies). Switching it off stops new entries; the entries already recorded stay until the retention period removes them.
Audit profile
The dropdown offers Standard and Health care. See below.
Changing a setting is recorded
When a saved organisation's audit settings change in effect, the audit log records Audit settings changed (audit.settings.changed) in the Administration category, with the names of the settings that changed under Changes. Switching the health care profile on, and off again, is recorded the same way. A setting that moves only because the profile applies it counts as changed.
Country and privacy law
The audit settings do not depend on a country, but the Country of the organisation (in the same Attributes table, see Organisation settings) decides which law the data subject export and Erase a client cite: the GDPR for an organisation in the EU or the EEA, the Swiss FADP for a Swiss organisation, and no law for any other country. It changes only the citation, not what is recorded, kept, exported or erased.
The health care profile
The health care profile is for providers who must keep full records of who saw and changed patient data. Choose Health care under Audit profile. The form sets, at once:
- Keep record history on,
- Log who reads client data on,
- Audit retention (months) to 120.
While the profile is set, these three are fixed:
- A notice appears under the Attributes table: "Health care profile: record history and read logging stay on, and audit records are kept for 120 months. Choosing the profile sets these values, and they cannot be lowered while it is set."
- If you lower one anyway, a red notice lists it under "These settings are fixed while the health care profile is set:" with the reason, for example "Audit retention (months): stays 120 in the health care profile". The Save button stays disabled until the value is back, and the server refuses a save that lowers any of them.
- You can leave the profile. Choose Standard; the three settings keep their values until you change them, and from then on you may lower them. Leaving is recorded in the audit log like any other change to these settings.
The profile also tightens field privacy, described below: with read logging always on, every field set to Logged when opened or Always logged is protected, and a protected field is not shown in lists or search.
Field privacy settings
Every client, journal and appointment field has a Privacy section in its editor: open Configurations > Templates, choose the Fields tab and open a field (the editor is described in Fields). The Fields tab of the organisation settings opens the same editor. Consent and process fields have no Privacy section, and neither have the computed client fields that go flow fills itself, such as the picture, the balances, the visits and the last visit. The section holds:
| Setting | Options | What it does |
|---|---|---|
| Data category | Identity, Contact, Booking, Financial, Health, Biometric, Special category, Other (default) | Says what kind of personal data the answer is, so the platform never has to guess what your field means. Health, Biometric and Special category are the protected categories. |
| Read logging | Not logged, Logged when opened, Always logged | Whether reading the answer is recorded. Not logged by default, but Logged when opened for a protected category. Choosing a protected category while it reads Not logged sets it to Logged when opened. |
| Retention (months) | 0 to 120 | How long the answer is kept after its client record has been deleted. Once the client has been deleted for that many months, an automatic job clears the answer from the client, its bookings and its journal entries. 0 keeps the answer with the record. |
| History | Every version, Latest value only, No history | How record history shows the answer: every version, only the current value (earlier entries show it masked), or not at all. |
| Included in data portability export | On or off | Puts the answer in the portability part of the data subject export instead of the access part. By default it follows Self managed. |
| FHIR resource | Text up to 40 characters | Shown only for the category Health. The standard health record type the answer becomes in a health care export, for example Observation, Condition or AllergyIntolerance. |
Logged when opened is logged only while the organisation logs reads (Log who reads client data on, or the health care profile). Always logged is logged in every organisation, whatever that setting says. A field that is logged at a given moment is called logged now here. For a field that is logged now, a read is recorded when a client is opened, which loads the answer, or when a record history shows it.
Retention counts from the deletion of the client record (Delete the client record, see Delete or erase?), not from the last visit. Until the client record is deleted, nothing clears the answer. The automatic job runs daily and works from the current settings, so a retention you set now also clears the answers of clients deleted longer ago than the period at its next run. Where the organisation keeps record history, the earlier versions there keep the cleared answer until the audit retention removes them. A protected field's retention can be raised but not lowered, see below.
When a change takes effect
| Setting | A change applies to |
|---|---|
| Data category, Included in data portability export, FHIR resource | Every later export, answers given before included. |
| Read logging | Reads from the moment you save; nothing earlier is recorded. A field that becomes logged now leaves the devices at their next synchronisation, answers given before included. |
| History | Every view of the history from then on, versions kept before included: the setting decides what is shown, not what is kept. |
| Retention (months) | Clients already deleted as well as clients deleted later, at the next daily run. |
Rules the editor applies
- A field whose reads are logged is stored as Sensitive. The Sensitive box is ticked and cannot be cleared while Read logging is anything but Not logged.
- It cannot appear in lists or search while it is logged now. A field set to Always logged, or to Logged when opened in an organisation that logs reads, is not part of the client list: its answer is loaded when a client is opened instead. Show in table and Searchable are therefore switched off and cannot be ticked for it, and the server refuses them. Two notices under the section explain it: one says reads of the field are logged, and one reads "A field that is logged now is not shown in lists or search."
- A field set to Logged when opened may appear in lists and search while the organisation does not log reads, because nothing is protected then. In the health care profile read logging is always on, so this never applies there.
- A protected field stays protected. A field in the Health, Biometric or Special category keeps its category. Its read logging and retention can be raised but not lowered: the weaker options are disabled, and a shorter retention shows "The retention of a protected field cannot be shortened (currently N; 0 keeps the answer with the record)." and blocks Save. For this purpose 0 counts as the longest retention of all. A notice at the foot of the section says "This field is in a protected category (health, biometric or special). It keeps its category, and its read logging and retention can be raised but not lowered."
You can change these settings wherever you may edit the field.