Healthcare Audit Logger
Comprehensive HIPAA audit logging and event tracking skill for AI agents. Generates immutable audit trails for healthcare systems, tracks PHI access, monitors authentication events, and ensures compliance with 45 CFR §164.312(b) audit control requirements.
Capabilities
- Audit Log Generation - Create HIPAA-compliant audit logs with immutable records
- Event Classification - Categorize healthcare events (access, modification, deletion, export)
- PHI Access Tracking - Log all access to Protected Health Information
- Authentication Logging - Record login, logout, and privilege escalation events
- Modification Auditing - Track who changed what, when, and why for PHI records
- User Activity Monitoring - Follow user workflows and data interactions
- Timestamp Management - Synchronized UTC timestamps with tamper detection
- Retention Policies - Manage audit log retention per HIPAA requirements (6+ years)
- Log Export - Generate compliance reports and audit summaries
- Integrity Verification - Validate audit log authenticity and non-repudiation
Usage
/healthcare-audit-logger [command] [options]
Commands
init <config-file> - Initialize audit logging for a healthcare systemlog <event-type> <details> - Log a healthcare eventlog-access <user> <resource> <action> - Log PHI accesslog-auth <user> <event> <result> - Log authentication eventlog-modification <user> <resource> <change> - Log data modificationpolicy <retention-years> - Set audit log retention policyreport [date-range] - Generate audit reportverify <log-file> - Verify audit log integrityexport <format> <output> - Export audit logs (JSON, CSV, XML)
Options
--user <id> - User identifier--resource <path> - Resource being accessed (patient ID, record ID)--action <type> - Action type (read, write, delete, export)--reason <text> - Clinical reason for access--outcome <status> - Success or failure status--timestamp <iso8601> - Event timestamp (default: now)--retention <years> - Log retention period (default: 6 years per HIPAA)
Workflow
Follow this workflow when invoked:
Step 1: Configure Audit System
Ask user to specify:
- Healthcare system type (EHR, medical records, data warehouse)
- Sensitive resources (patient records, medical images, test results)
- User roles and access levels
- Audit log storage location and format
Step 2: Design Audit Schema
Create logging schema including:
- Event types to track
- User role classifications
- Resource categories
- Access justification requirements
- Timestamp precision (milliseconds for audit accuracy)
- Log entry format (structured JSON recommended)
Step 3: Implement Audit Logging
Instrument key points:
- Authentication/authorization gates
- PHI access checkpoints
- Data modification operations
- Export/external sharing events
- System configuration changes
- Access permission changes
Step 4: Validate Compliance
Ensure audit logs capture:
- User ID - Who accessed the information (45 CFR §164.312(b)(2)(i))
- Workstation ID - Which computer was used
- Date & Time - When access occurred (UTC with timezone)
- Action Performed - Read, write, delete, export, etc.
- Resource Accessed - Patient ID, record type, data elements
- Outcome - Success or failure of operation
- Reason/Justification - Clinical or operational purpose
- Result - Changes made or information retrieved
HIPAA Compliance Mapping
| Control |
Requirement |
Implementation |
| §164.312(b) |
Audit Controls |
Implement comprehensive logging |
| §164.312(b)(2)(i) |
User Identification |
Log all user access with unique IDs |
| §164.312(b)(2)(ii) |
Emergency Access Log |
Separate tracking for emergency access |
| §164.308(a)(3)(ii)(B) |
Workforce Security |
Track privilege changes and role assignments |
| §164.308(a)(5)(ii)(C) |
Log-in Monitoring |
Log authentication attempts and outcomes |
| §164.312(a)(2)(i) |
Access Controls |
Audit access permissions and changes |
| §164.312(c)(2) |
Encryption |
Log encryption key operations |
| §164.314(a)(2)(i) |
Partner Agreements |
Log external system access |
Example Audit Log Entry
{
"event_id": "evt_20250207143556_abc123",
"timestamp": "2025-02-07T14:35:56.123Z",
"user_id": "dr_jane_smith",
"user_role": "physician",
"workstation_id": "ws_04_floor2",
"action": "read",
"resource_type": "patient_record",
"resource_id": "pat_98765", // Encrypted in production
"data_accessed": ["demographics", "lab_results", "vitals"],
"clinical_reason": "Patient follow-up appointment",
"access_result": "success",
"duration_ms": 45,
"ip_address": "10.24.5.12", // Masked in logs
"hipaa_rule": "§164.312(b)(2)(i)"
}
References
- 45 CFR §164.312(b) Audit Controls
- 45 CFR §164.308(a)(5)(ii)(C) Log-in Monitoring
- NIST SP 800-66 Rev. 2 - HIPAA Security Implementation Guidance
- NIST SP 800-92 - Guide to Computer Security Log Management
- HHS Office for Civil Rights Audit Protocols
1---2name: healthcare-audit-logger3description: This skill should be used when the user asks to "generate audit logs", "create HIPAA audit trail", "log healthcare events", "configure audit logging", "track PHI access", "maintain compliance logs", "audit log format", "healthcare event logging", "access control logging", "authentication logging", "HIPAA logging requirements", or mentions HIPAA audit trails, healthcare event logging, compliance logging, PHI access tracking, authentication auditing, or §164.312(b) logging requirements.4license: MIT5---6
7# Healthcare Audit Logger
8
9Comprehensive HIPAA audit logging and event tracking skill for AI agents. Generates immutable audit trails for healthcare systems, tracks PHI access, monitors authentication events, and ensures compliance with 45 CFR §164.312(b) audit control requirements.
10
11## Capabilities
12
131. **Audit Log Generation** - Create HIPAA-compliant audit logs with immutable records
142. **Event Classification** - Categorize healthcare events (access, modification, deletion, export)
153. **PHI Access Tracking** - Log all access to Protected Health Information
164. **Authentication Logging** - Record login, logout, and privilege escalation events
175. **Modification Auditing** - Track who changed what, when, and why for PHI records
186. **User Activity Monitoring** - Follow user workflows and data interactions
197. **Timestamp Management** - Synchronized UTC timestamps with tamper detection
208. **Retention Policies** - Manage audit log retention per HIPAA requirements (6+ years)
219. **Log Export** - Generate compliance reports and audit summaries
2210. **Integrity Verification** - Validate audit log authenticity and non-repudiation
23
24## Usage
25
26```
27/healthcare-audit-logger [command] [options]
28```
29
30### Commands
31
32- `init <config-file>` - Initialize audit logging for a healthcare system
33- `log <event-type> <details>` - Log a healthcare event
34- `log-access <user> <resource> <action>` - Log PHI access
35- `log-auth <user> <event> <result>` - Log authentication event
36- `log-modification <user> <resource> <change>` - Log data modification
37- `policy <retention-years>` - Set audit log retention policy
38- `report [date-range]` - Generate audit report
39- `verify <log-file>` - Verify audit log integrity
40- `export <format> <output>` - Export audit logs (JSON, CSV, XML)
41
42### Options
43
44- `--user <id>` - User identifier
45- `--resource <path>` - Resource being accessed (patient ID, record ID)
46- `--action <type>` - Action type (read, write, delete, export)
47- `--reason <text>` - Clinical reason for access
48- `--outcome <status>` - Success or failure status
49- `--timestamp <iso8601>` - Event timestamp (default: now)
50- `--retention <years>` - Log retention period (default: 6 years per HIPAA)
51
52## Workflow
53
54Follow this workflow when invoked:
55
56### Step 1: Configure Audit System
57
58Ask user to specify:
59- Healthcare system type (EHR, medical records, data warehouse)
60- Sensitive resources (patient records, medical images, test results)
61- User roles and access levels
62- Audit log storage location and format
63
64### Step 2: Design Audit Schema
65
66Create logging schema including:
67- Event types to track
68- User role classifications
69- Resource categories
70- Access justification requirements
71- Timestamp precision (milliseconds for audit accuracy)
72- Log entry format (structured JSON recommended)
73
74### Step 3: Implement Audit Logging
75
76Instrument key points:
77- Authentication/authorization gates
78- PHI access checkpoints
79- Data modification operations
80- Export/external sharing events
81- System configuration changes
82- Access permission changes
83
84### Step 4: Validate Compliance
85
86Ensure audit logs capture:
87- **User ID** - Who accessed the information (45 CFR §164.312(b)(2)(i))
88- **Workstation ID** - Which computer was used
89- **Date & Time** - When access occurred (UTC with timezone)
90- **Action Performed** - Read, write, delete, export, etc.
91- **Resource Accessed** - Patient ID, record type, data elements
92- **Outcome** - Success or failure of operation
93- **Reason/Justification** - Clinical or operational purpose
94- **Result** - Changes made or information retrieved
95
96## HIPAA Compliance Mapping
97
98| Control | Requirement | Implementation |
99|---------|-------------|-----------------|
100| §164.312(b) | Audit Controls | Implement comprehensive logging |
101| §164.312(b)(2)(i) | User Identification | Log all user access with unique IDs |
102| §164.312(b)(2)(ii) | Emergency Access Log | Separate tracking for emergency access |
103| §164.308(a)(3)(ii)(B) | Workforce Security | Track privilege changes and role assignments |
104| §164.308(a)(5)(ii)(C) | Log-in Monitoring | Log authentication attempts and outcomes |
105| §164.312(a)(2)(i) | Access Controls | Audit access permissions and changes |
106| §164.312(c)(2) | Encryption | Log encryption key operations |
107| §164.314(a)(2)(i) | Partner Agreements | Log external system access |
108
109## Example Audit Log Entry
110
111```json
112{
113 "event_id": "evt_20250207143556_abc123",
114 "timestamp": "2025-02-07T14:35:56.123Z",
115 "user_id": "dr_jane_smith",
116 "user_role": "physician",
117 "workstation_id": "ws_04_floor2",
118 "action": "read",
119 "resource_type": "patient_record",
120 "resource_id": "pat_98765", // Encrypted in production
121 "data_accessed": ["demographics", "lab_results", "vitals"],
122 "clinical_reason": "Patient follow-up appointment",
123 "access_result": "success",
124 "duration_ms": 45,
125 "ip_address": "10.24.5.12", // Masked in logs
126 "hipaa_rule": "§164.312(b)(2)(i)"
127}
128```
129
130## References
131
132- **45 CFR §164.312(b)** Audit Controls
133- **45 CFR §164.308(a)(5)(ii)(C)** Log-in Monitoring
134- **NIST SP 800-66 Rev. 2** - HIPAA Security Implementation Guidance
135- **NIST SP 800-92** - Guide to Computer Security Log Management
136- **HHS Office for Civil Rights Audit Protocols**
137
majiayu000