What the audit trail records
When a quantity, schedule, refill count, or status changes, a reviewer needs more than “last modified by.” Each change in Rx Ledger CS creates its own entry:
| Time | User | Field | Old value | New value | IP address |
|---|---|---|---|---|---|
| 10/14/2026 3:42 PM | apatel | Quantity | 20 | 30 | 203.0.113.24 |
| 10/14/2026 3:42 PM | apatel | DaysSupply | 5 | 7 | 203.0.113.24 |
Illustrative example. A snapshot of the full prescription is saved with each change, so you can see what the record looked like at any point.
Tracked fields include drug name, strength, dosage form, route, frequency, quantity, days’ supply, refills, directions, DEA schedule, status, and PDMP verification. Separately, the system logs logins, patient record views, prescription creation, and administrative changes.
Why it matters
- Diversion review — spot quantities increased after the fact, or entries changed by someone other than the prescriber.
- DEA or board inquiry — show that the record you produce is the record that was written, with every later edit accounted for.
- HIPAA access review — the Security Rule expects you to record and review activity on systems holding ePHI. Administrators see who viewed which patient records.
HIPAA safeguards in the application
- Encryption — patient identifiers and clinical fields encrypted with SQL Always Encrypted and Azure Key Vault
- Role-based access — separate Doctor, Nurse, and Admin permissions
- Session timeout — automatic sign-out after 30 minutes idle on shared workstations
- Account lockout — repeated failed sign-ins are blocked
- Stale account review — flags accounts with no recent sign-in; can deactivate them automatically
- Vendor access is logged — any emergency (“break-glass”) access by AI Analytics staff requires a written reason and is recorded in the audit trail
- Tenant isolation — each practice’s data is separated from every other customer’s
- Retention lock — controlled-substance records can’t be deleted within two years of issue (21 CFR 1304.04)
These controls support your HIPAA compliance program. They are not a certification that a practice is compliant.
Business associate agreement
AI Analytics LLC acts as a HIPAA business associate when your clinic stores PHI in Rx Ledger CS. The platform runs on HIPAA-eligible Microsoft Azure services, and a signed BAA and written security policies are available for your compliance file.
Looking for pharma manufacturing audit trail software?
Rx Ledger CS is built for prescribers and outpatient clinics. It is not a validated GxP or 21 CFR Part 11 system for drug manufacturers, laboratories, or clinical trials.