Audit & Compliance
The audit trail of data access and modifications, compliance framework status, and data retention schedule.
Recent audit trail
Observed| Timestamp | Actor | Action | Resource | Result |
|---|---|---|---|---|
| 2026-10-14 20:15:33 | PayRX Care Team | READ | Clinical measurement (weight)(M-0421) | Allowed |
| 2026-10-14 20:12:18 | Employer Admin | READ | Workforce KPI dashboard | Allowed (aggregated) |
| 2026-10-14 20:10:05 | Benefits Director | READ | Clinical outcomes (aggregated) | Allowed (aggregated, n=839) |
| 2026-10-14 20:08:47 | Employer Admin | READ | Individual member record(M-0421) | Denied (RBAC) |
| 2026-10-14 20:05:22 | PayRX Admin | UPDATE | Financial assumptions | Allowed (logged) |
| 2026-10-14 19:58:14 | PayRX Care Team | CREATE | Message (outbound)(M-0388) | Allowed |
| 2026-10-14 19:55:03 | Auditor | READ | Access log (Oct 2026) | Allowed (read-only) |
| 2026-10-14 19:50:41 | Benefits Director | EXPORT | Vendor performance report | Allowed (aggregated) |
| 2026-10-14 19:45:29 | Employer Admin | READ | Department filter (n=8) | Suppressed (below 11 minimum) |
| 2026-10-14 19:42:15 | PayRX Pharmacy | SYNC | Prescription records (batch) | Completed (1,000 records) |
All access events are logged with user identity, timestamp, action, and resource. Logs are retained for 7 years and available to auditors on request.
Compliance framework status
ObservedCovered-entity / business-associate roles defined. BAAs executed with all subcontractors. De-identification methodology documented.
Genetic information privacy requirements apply to wellness program. No genetic data collected or used.
Disability-related privacy requirements apply to health program participation. Medical information kept confidential and separate from employment decisions.
SOC 2 Type II audit planned. Security, availability, and confidentiality controls being documented. No certification claim until audit complete.
Accessibility review in progress. Targeting WCAG 2.1 AA compliance for all user-facing surfaces.
State-level privacy laws (CCPA/CPRA, etc.) being evaluated for applicability to employer health program data.
Data retention schedule
ObservedNo unverified compliance claims
This platform does not claim HIPAA compliance, SOC 2 certification, or any other certification unless documentation is on file. Compliance items shown as "Verified" have supporting evidence; items shown as "Pending" are in progress and should not be represented as complete.
Employee Privacy Protected by Design
Employer reporting is designed to present aggregate workforce and health-program insights without exposing individual clinical records. Small-group reporting restrictions help reduce the risk of employee identification.
Aggregated information is not described as HIPAA-de-identified unless applicable de-identification requirements have been satisfied and verified.