The access log
Who opened or downloaded a patient's record, when, and what they took. Where to read it, how to filter it, and how long it is kept.
Every time a staff member opens a patient's record, Pippa writes an entry. Every time someone downloads data, Pippa writes another one that also says what was in the download. Those entries are appended as separate records and retained by the account-deletion path. New archive and restore transitions are also logged, atomically with the roster change. Read and export logging is currently best effort; a logging failure can leave a gap.
Clinic admins read them at Access log in the left-hand navigation.
An entry says that Dr Chen opened Sam's record on Tuesday at 2:41pm. It does not contain a single word of what was in that record: no meals, no notes, no messages, no scores. The log still contains patient identifiers and must be protected. Share only the authorized scope when responding to a records request or conducting a review.
What an entry looks like
Four columns: when, who, whose record, and what.
- Opened the record. A staff member viewed the patient's data, with the parts they opened named: the history, the team chat, the shared journal, the scores, a meal photo.
- Archived / restored. A clinician changed their own roster relationship. Each transition is a separate entry; consent and clinical access are unchanged.
- Downloaded. Someone exported data. These rows carry a Downloaded badge and name the files and the row count, for example Downloaded meals, measures · 412 rows. This is the only row type describing data that left the clinic's controls, which is why it is the only one badged.
Filtering it
The filter bar narrows by patient, by staff member, by action (reads, downloads, archives, or restores), and by a date range. Dates are UTC, so a range that has to be exact at the edges should be widened by a day.
The filters live in the page address, which means an answer is a link: bookmark the query you run every quarter, or paste it to a colleague and they see exactly what you saw.
Opening a patient page reads a dozen different things at once, and each read is logged separately. On screen those collapse into a single visit with a quiet request count, so a week of work reads as a week of work rather than a wall of duplicates. Nothing is dropped: the count is shown, and the CSV below is still one line per logged entry.
The log covers the whole clinic, but consent is still per clinician. If a colleague accessed a patient who has not signed with you, you will see the entry and the name, and the name will not be a link, because opening that record is not something your consent allows.
Taking a copy
Download these rows saves what is on screen as a CSV, with the filters you applied and one line per logged entry (ungrouped, unlike the table). Use it for a records request, an internal review, or an auditor who wants the trail rather than a screen share.
Downloading the access log is itself a disclosure, so it writes its own entry into the log. That is deliberate: a trail with a hole in it where someone copied the trail is not a trail.
Who can see it
- Clinic admins see the whole clinic's log at Access log.
- Counsellors and therapists do not. If you need a copy, ask your clinic admin. What you do see, for your own patients, is the download line in each patient's History tab, so a care team always knows when a teammate took a copy.
- Pippa support can read a clinic's log when you ask us to, for example when you or a patient asks who has been in a record and you want it confirmed independently.
- The log is hidden in patient view, along with the navigation item that opens it. It lists other patients by name, so it does not belong on a shared screen.
How long it is kept
Access entries survive account deletion. The current purge path does not implement a six-year expiry for these rows. The applicable retention schedule must be documented in clinic policy and agreements; HIPAA does not set a universal medical-record retention period. See Data lifecycle for what else is retained and why.
Open the access log, set the range to the last quarter, filter to Downloaded only, and read the list. It is usually short, and it is the cheapest version of "is anyone taking copies we did not expect?" that exists.