Read logging
Most audit trails record only what people change. Read logging records who looked at client data. When it is on, opening a client leaves an entry in the audit log, where you can check who looked at which client, and the most sensitive answers are fetched only at the moment a client is opened. Fields set to Always logged are protected in every organisation, whether or not it logs reads.
Switching it on
Read logging is off by default and is set per organisation. Switch on Log who reads client data in the audit settings. The health care profile switches it on and keeps it on. While it is off, none of the entries below are recorded, with two exceptions: a data subject export is always recorded, and so is the loading of a field set to Always logged (see Protected fields).
Switching it on records reads from that moment; reads made before were not recorded and cannot be recovered. Switching it off stops new entries; the entries already recorded stay until the organisation's Audit retention (months) removes them.
What is recorded
The entries belong to the Access category of the audit log. The Action column shows each in words; point at it to see its key.
| Shown as | Recorded when | Details |
|---|---|---|
Client record opened (client.read) | A client is opened in the dashboard: the client dialog opens for an existing client, from the Clients page, from a session's participants or anywhere else. One entry per client, per user session, per 15 minutes. | Viewed at: the time it was opened |
Protected client fields viewed (client.read.sensitive) | The protected fields of a client are loaded as the client is opened, or a record history shows the values of protected fields. A field set to Always logged is recorded even while the organisation does not log reads. | Fields: the keys of the fields that were shown, never the answers |
Data synchronised to a device (sync.deliver) | Synchronisation delivers client or participant records of the organisation to a device. One entry per delivery. | Clients and Participants: how many; Full range: whether it was a full download (a first sync, a reload of everything, a tenant switch or a full appointment window) |
Client data exported (client.export) | A data subject export is built. Always recorded. | Format and Parts: the file format and the parts it holds |
Own activity viewed (user.activity.read) | Someone opens My activity. | None |
Only these are recorded. Seeing a client's name in the scheduler, in an order or in a list is not a read of its own, apart from the delivery counts in Data synchronised to a device.
How views are sent
The dashboard sends a view along with the next synchronisation, or within about half a minute. A view made while you are offline waits on your device and is sent when the connection returns and you are signed in. Two views of the same client by the same person within 15 minutes count once. The entry shows the time on your device, never a time later than when it arrived.
Protected fields
Protected fields are client fields whose reads are logged now. Each field's Read logging decides when that is, and you set it in the field's privacy settings:
| Read logging | Protected |
|---|---|
| Not logged | Never. The field works like any other. |
| Logged when opened | Only while the organisation logs reads (Log who reads client data is on, or the health care profile is set). While it is off, the field works like any other. |
| Always logged | In every organisation, whatever its Log who reads client data setting. |
Logged when opened is the default for fields in the categories Health, Biometric and Special category.
A protected field behaves differently from an ordinary one:
- Its answers are not synchronised to devices. They are on nobody's device, never in a list, and cannot be searched. That is why the field editor switches Show in table and Searchable off for such a field, and the server refuses them.
- When you open a client, a thin progress line reads "Loading protected fields". The fields stay locked, which means read-only, until the answers arrive. A new client has nothing to load, so its fields are open at once.
- Each protected field shows a lock icon beside it. Its tooltip reads "Reading this field is logged".
- If loading fails, a warning reads "The protected fields could not be loaded. They stay unchanged when you save." with Retry.
- When you save a client, only the protected answers you changed are sent. An answer you did not touch, or could not load, is kept exactly as stored.
- An answer you edit while offline stays on your device until the next successful synchronisation, and is then removed from it again.
A field set to Logged when opened is protected only for as long as the organisation logs reads, so switching Log who reads client data on or off changes which fields are protected. While it is off, such a field works like any other field: it is not hidden and nothing is recorded about reading it. A field set to Always logged stays protected.
Checking who read client data
Open Analytics > Audit log. You need the Audit log right on your tenant (see Audit log).
- In Category, choose Access. The list now shows the entries described above.
- Narrow it with Users (who read), the date range and, when your tenant has more than one organisation, Organisation. The Record column names the client that was opened.
- Expand a row to see its Details, for example Viewed at or the Fields that were shown.
Judge each read against what you know, for example whether the person had a booking with that client or a reason such as a phone enquiry. go flow does not make that comparison for you at present, and there is no place in go flow to record your conclusion: follow your own procedure for unusual reads.
The review view
The review view is not shown in the dashboard at present. The Audit log page has no Review tab, so the dashboard does not list the reads that no appointment explains, reads cannot be marked as OK or escalated, and earlier verdicts cannot be listed. Reads are still recorded as described above; check them in the audit log as shown in Checking who read client data.
Any verdicts given while the review view was shown stay in the audit log as Access reviewed (audit.review), in the Administration category, with the Outcome (ok or escalated) in Details.