Key points
- HIPAA requires audit controls that record and examine activity, unique user identification, and regular review of audit logs and access reports.12
- Least privilege gives each role only the records and actions its job needs. In a clinic that is five or six roles, written on one page.
- Every AI draft, edit, approval and signature carries a name and a time in the log.
- wai enforces role-based least privilege in the database and logs every message, draft, approval and signature for the clinic to export.6
Summary
Give each role only the records and actions its job needs, with a personal login for everyone, and keep an audit log of every view, draft, approval and signature that a named lead reviews monthly. HIPAA requires audit controls and regular activity review, and the ICO expects the same discipline under UK GDPR's security principle.14
Any question about a record answered in under a minute, from who opened it to who approved the message that went out. With clear roles and a complete log in place, each new AI draft and approval lands inside rules the clinic already trusts.
See it in your clinicThirty minutes on your own patients and doctors.
Request a demoSee a patient thread in wai with its full event log, showing who drafted, edited and approved each message, and the export an auditor would ask for.
| Role | Sees | Can do | Check in the monthly log review |
|---|---|---|---|
| Front desk | Contact details, bookings, message threads, payments | Edit and approve operational replies, book, take deposits | Opened clinical notes, approved a clinical reply |
| Clinician | Full records of the patients they treat | Edit and sign notes and letters, answer clinical questions | Opened records of patients outside their care |
| Billing lead | Codes, invoices, claims and payment history | Confirm codes, prepare claims, chase invoices | Opened full notes beyond the coded summary |
| Operations lead | Operational reports, the event log, rotas | Approve sensitive replies, manage roles | Bulk exports, role changes, leavers still active |
| Clinic owner or administrator | Settings and the event log | Grant and remove access | Every role change, reviewed by a second person |
| Vendor engineers | Production data only through their own credential | Support and fixes, as agreed in the contract | Every access, shown in the vendor's report |
Where access rules do their work
A study in JAMA Internal Medicine reviewed 1,138 breaches affecting 500 or more people that US providers reported to HHS between October 2009 and December 2017, and attributed 603 of them, 53.0%, to the organisations' own mistakes or neglect.5 Unauthorised access or disclosure made up 284 cases, 25.0% of the total.5
Within the internal causes, 74 cases involved staff taking records home or forwarding them to personal accounts, and 39 involved staff opening records without authorisation.5 Clear roles and a reviewed log catch exactly these, and each AI draft and approval sits inside the same rules as a person opening a chart.
What the rules ask for
Under the HIPAA Security Rule, access control must allow access only to the people or software programs granted access rights, unique user identification is a required specification, and audit controls must record and examine activity in systems that contain or use electronic health information.1
A covered entity must regularly review records of system activity, such as audit logs, access reports and security incident tracking reports, and must name a security official responsible for the policies.2 It should have procedures for granting, reviewing and modifying each user's access, and for ending access when someone leaves.2 Required documentation is kept for 6 years from creation or last effective date.3
In the UK, the ICO frames the same duty through the security principle. It asks organisations to weigh the number of staff they have and the extent of their access to personal data, and to identify a person with day-to-day responsibility for information security.4
Least privilege, role by role
The table sets a starting map, where the front desk works from bookings, messages and payments and the clinician from the full records of their own patients.
Write the roles on one page before switching any AI tool on, set the system to match, and give every person their own login so each entry in the audit log names a real person.
Treat the vendor as a role too. Ask how its engineers reach production data, under whose credentials, and whether that access is logged, and keep the answer in the procurement checklist next to the contract.
What a useful log records
For every event, the log records the account that acted, the action, the record and the time. For AI work it also keeps the draft itself, so the clinic can see what the tool proposed, what the person changed and who approved or signed the final version.
That trail gives approval before a patient message sends its force, because the record shows who approved what, and when. The clinic exports the log for an auditor or a complaint in a format it reads on its own.
Reviewing the log in thirty minutes a month
A monthly review checks the patterns in the table's last column. The ones that matter most are accounts still active for people who have left, records of staff or well-known patients opened by someone outside their care, and bulk exports.
Each quarter, the security lead checks every account against the role map and removes what is no longer needed. Leavers lose access on their last day, and findings go into the clinic's usual incident route with a note of what was changed.
How wai handles access and the log
In wai, role-based, least-privilege access for clinic staff is enforced in the database itself. Our own engineers reach production data through a separate credential, never a clinic's.6
Every message, draft, approval and signature is written to an event log, and the clinic can export it.6 wai drafts, and the team approves or the clinician signs, so each step carries a name and a time. Data is encrypted with AES-256 at rest and TLS 1.3 in transit.6
Where to start
This week, write the role map and give every shared login a personal replacement. Ask each AI vendor to show its role settings and an exported audit log, and to explain how its own staff reach your data.
Book a thirty minute monthly log review for the first quarter and record each one in the clinic's AI governance register. From then on, any question about a record has its answer in under a minute.
Bring your staff list. We set up roles in wai with you and show the event log and its export, in fifteen minutes.
Frequently asked questions
Does HIPAA require audit logs?
How long should a clinic keep its audit logs?
HIPAA requires Security Rule documentation to be kept for 6 years.3 Many clinics align log retention with that period, and the clinic's adviser confirms the period under local law.
Should the front desk see clinical notes?
The front desk sees what it takes to book, message and take payment. Clinical questions pass to a clinician with the thread attached.
Who should review the audit log?
A named security lead, with a clinician for anything involving clinical records. HIPAA requires a named security official responsible for the security policies.2
Is an AI draft logged if it is never sent?
Yes. In wai every message, draft, approval and signature is written to the event log, so the clinic can see what was proposed as well as what was sent.6
Can vendor staff see our patient records?
Ask every vendor this in writing. At wai, engineers reach production data through a separate credential, never a clinic's.6
Sources
- 1Electronic Code of Federal Regulations45 CFR 164.312, technical safeguardsRead 14 October 2026Read source
- 2Electronic Code of Federal Regulations45 CFR 164.308, administrative safeguardsRead 14 October 2026Read source
- 3Electronic Code of Federal Regulations45 CFR 164.316, policies and procedures and documentation requirementsRead 14 October 2026Read source
- 4Information Commissioner's OfficeA guide to data securityRead 14 October 2026Read source
- 5JAMA Internal Medicine, 2019Evaluation of Causes of Protected Health Information Breaches, Jiang and BaiRead 14 October 2026Read source
- 6wai, 2026Security at waiRead 14 October 2026Read source
Know who saw every record, in under a minute.
Fifteen minutes with a clinician who uses wai daily, on roles, approvals and the event log your auditor will ask for. We reply within one working day.
Partner with us
See it on your own patients, then build it with us
Thirty minutes on your own patients, doctors and rules, in your market. We reply within one working day, and the clinics that partner with us early shape what we build next.
See what wai does between the visits