# Audit Log & Activity Tracking
The audit log provides a tamper-evident record of every significant action taken in the system.
---
What is Logged
| Category | Actions Logged |
|---|---|
| Authentication | Login, logout, failed login, 2FA events, password reset |
| Patient Data | Create, update, delete, view (for sensitive fields) |
| Appointments | Create, update, cancel, complete, no-show |
| Clinical | Prescription create/edit/delete, lab orders, session notes |
| Billing | Invoice create, payment, refund, discount applied |
| Staff | User create, role change, deactivate, permission change |
| Settings | Clinic settings changes, template edits |
---
Accessing the Audit Log
Settings → Audit Log.
---
Filtering the Log
| Filter | Options |
|---|---|
| User | Select a staff member |
| Action | CREATE / UPDATE / DELETE / VIEW |
| Resource | Patient / Appointment / Invoice / etc. |
| Date Range | From — To |
| IP Address | For security investigations |
---
Log Entry Fields
Each log entry shows:
- Timestamp — exact date and time.
- User — who performed the action.
- Action — type of operation.
- Resource — affected record type and ID.
- Before / After — JSON snapshot of changed fields.
- IP Address — from which the request originated.
- User Agent — browser/app identifier.
---
Investigating Suspicious Activity
If you suspect unauthorized access:
- Filter by the suspected user and recent date range.
- Look for actions at unusual hours.
- Check IP addresses — a foreign or VPN IP is a red flag.
- If confirmed breach: deactivate the user immediately and change the clinic's admin password.
---
Retention Policy
Audit logs are retained for 24 months by default. Contact ClinIT support to adjust the retention window.
---
Staff Login Logs
A simplified login-specific view is available under Settings → Staff Login Logs, showing only authentication events with device details.