Audit Trail
The audit trail is a comprehensive, tamper-proof record of every action taken within SystmOne. It supports accountability, patient safety, clinical governance, and compliance [1].
Key Message
Every action is recorded. Audit entries cannot be deleted, modified, hidden, or tampered with [1].
What Is an Audit Trail?
An audit entry captures the five Ws of every system action [1]:
WHO
User ID ⋅ full name ⋅ role or designation
WHAT
Action performed (view, create, edit, delete, mark in error)
WHEN
Precise timestamp & event date
WHERE
Location in system (node/module and patient record)
WHY
Reason provided for corrections and significant changes
This permanent log supports clinical governance, medicolegal protection, and regulatory compliance.
Why the Audit Trail Exists
| Purpose | How the Audit Trail Supports It |
|---|---|
| Accountability | Every action is traceable to an individual user |
| Patient safety | Enables investigation of documentation and medication errors |
| Clinical governance | Provides evidence of procedure adherence and protocol compliance |
| Medicolegal protection | Supports complaint handling with a complete timeline |
| Quality assurance | Identifies patterns in errors or inappropriate access |
| Regulatory compliance | Supports MOH requirements, ISO 27001 9.4.5 / 12.4, and ISO 9001 [2] |
| Data security | Detects unauthorized access and suspicious activity |
What Gets Recorded
The audit trail captures every meaningful interaction with patient data:
- Login and logout events
- Patient record access and viewing
- Documentation created, modified, or marked in error
- Prescriptions issued or amended
- Appointments booked, moved, or cancelled
- Test and procedure orders placed
- Data exports or printing
- Demographic changes
- System configuration changes (administrators)
Patient Context
Each entry also records the patient identifier (IC number) affected, the result (success or failure), and before/after values where applicable.
Error Corrections Are Permanently Logged
When you correct a mistake, the audit trail does not erase the original action — it adds to the story. This is one of the most important behaviors to understand.
| Correction Action | What the Audit Trail Records |
|---|---|
| Mark In Error | User, timestamp, reason provided, original entry content, patient affected |
| Reinstate entry | User, timestamp, entry reinstated, justification |
| Registration changes | Before/after values (IC, name, DOB) and approval details |
| Medication amendments | Original prescription details, changes made, coordination notes |
| Appointment changes | Original booking, updated details, reason, user who modified |
| Late entry documentation | Actual event date vs. entry date, backdate reason |
When Is the Audit Trail Reviewed?
| Scenario | What Is Reviewed | Purpose |
|---|---|---|
| Patient complaint | Record access and changes | Investigate alleged breach or error |
| Documentation discrepancy | Changes to specific entries | Verify correction procedures were followed |
| Medication error investigation | Prescription history and amendments | Establish timeline and responsibility |
| Security incident | Unusual access patterns, failed logins, after-hours access | Detect unauthorized access attempts |
| Quality assurance review | Correction frequency and patterns | Identify training and system improvements |
| Regulatory audit (MOH, ISO) | Evidence of compliance and traceability | Demonstrate adherence to requirements |
| Medicolegal case | Complete record of clinical actions and decisions | Provide evidence for legal proceedings |
Compliance and Legal Requirements
The audit trail supports:
- ISO 27001 9.4.5 / 12.4: Control 9.4.5 requires logging and monitoring [2]
- ISO 9001: requires traceability and accountability
- MOH medical record standards: require documentation of changes to patient records
- Personal Data Protection Act (PDPA) [3]: requires auditing of personal data access and changes
- Malaysian Medical Council guidelines [4]: professional standards for record keeping
- ISO 27789: dedicated EHR audit trail standard [1]
- DKICT-V5: KKM ICT security policy for audit log access control
Key Takeaway
How to think about the audit trail
- Every action in SystmOne is permanently recorded and cannot be altered or deleted
- The audit trail captures who did what, when, where, and (for corrections) why
- Error corrections add to the audit story — they never erase the original action
- Review happens during complaints, errors, security incidents, quality reviews, regulatory audits, and medicolegal cases
- Full audit reports are role-based and restricted to authorized reviewers
Contributor
Dr Fuad Jaafar
Facilitator, CCMS • KK Bandar Maharani
Feedback