Reference table

The audit trail

Sets out what the audit trail records for each access and change, the fields captured, and how long each entry is retained.

The audit trail records every access and every change to a record, with the person, the action, the patient, the site, the stated purpose, the outcome and the time. Each entry is written with the change it describes and held append-only.

One entry per change

One audit entry is written inside the same transaction as the change it describes. A committed change carries its audit entry, so the two commit together or leave together.

The audit entry and the change it records share one transaction, so the two commit together or fail together. A fault in the audit path fails the whole transaction closed, so a change never commits without its audit entry.

The entry commits with the change

Writing the entry in the same transaction as the change ties the two together. A reader looking back finds each committed change beside the record of who made it and when, so the history stays reconstructable.

What each entry holds

Each entry carries the actor, the action, the patient, the site, the stated purpose, the outcome and the time. An emergency access adds the stated reason.

actor identity Required	The person, the on-site bridge agent, or the internal job that acted.
action string Required	The action taken, such as a record read or a record change.
patient reference	The public patient reference, present when the entry concerns a record.
site string Required	The site the action ran at.
purpose string Required	The stated purpose of the access, drawn from an agreed set.
outcome string Required	Permitted, refused, held for context, or emergency.
reason string	The stated reason, present for an emergency access.
at timestamp Required	The moment the action ran.

Coverage

Every access and every change to a record on the platform is recorded. A read of structure that stays clear of a record is sampled.

Entry class	Coverage
Record read permitted	Every one
Access refused	Every one
Decision held for context	Every one
Emergency access	Every one, surfaced to the patient
Consent change	Every one
Record change written	Every one
Structural read	Sampled
Downtime pack produced	Every one, naming the role that requested it and the time

One read sits outside this list. Producing a downtime pack is recorded here. Reading a pack is not, because the read happens on storage the hospital nominates and administers, where the platform has no visibility. The hospital accounts for that read under its own downtime procedure. The what happens when the link drops page sets out what a pack holds.

Identifiers

An entry identifies a patient by the public reference used across logs and search. National identifiers stay within the record and off the trail.

one audit entry

$ pensieve audit show latest --record
{
  "actor": "dr-a-nair",
  "action": "record.read",
  "patient": "PEN-4K2H-9T1C-3",
  "site": "central-block",
  "purpose": "treatment",
  "outcome": "permitted",
  "at": "2026-08-18T11:40:07Z"
}

Retention

Each entry is held append-only and archived to write-once storage, so an entry stays as first written. The period follows the record the entry describes.

Entry class	Retention basis
Record access and change	Held for the retention term of the patient record it describes
Emergency access	Held for the record's retention term, and surfaced to the patient
Consent change	Held for the life of the record as part of its consent history
Financial posting	Held for the statutory financial term
Structural and administrative	Held for the operational retention term

The retention page sets out the exact period for each class.

See the audit event catalogue for each event type and what triggers it.