Every action logged. Every access tracked. Every export available.

What’s logged

Everything that touches a resident’s data. Non-exhaustive list:

• Access events — who read what record, when, from which device, and (with SSO) under which auth session
• Data changes — every add / edit / delete on care notes, alert profiles, resident details. Old value, new value, editor, timestamp
• Alert lifecycle — alert triggered, acknowledged, escalated, resolved, dismissed. Each transition attributed and timestamped
• Consent changes — every grant, withdrawal or modification of consent (family portal, monitoring scope, communication preferences)
• Configuration — role assignments, permission changes, alert rule edits, integration connection changes
• Authentication — successful logins, failed logins, session issuance, session termination, MFA events
• Data exports — every report or bulk export, including who requested it, what was included, and where it went

Nothing is silently mutated. Nothing happens “as the system” without a named actor.

Retention and access

Default retention:

• Starter: 30-day audit retention
• Pro: 12-month audit retention
• Enterprise: configurable (default 24 months, extendable per contract)

Retention can be increased on any tier. It cannot be reduced below regulatory minimums (typically 6 years for adult clinical records under UK NHS retention schedules; longer for specific classes).

Who can query the audit trail:

• Registered managers, information governance leads, and compliance officers by role
• Designated Clinical Safety Officers on Enterprise tier
• External auditors under a scoped, time-limited access token

The audit trail is immutable to end-users — a manager cannot delete or modify a log entry to hide an action. Corrections happen by appending a corrective entry, never by overwriting history.

Regulatory alignment

Halo’s audit trail is designed to support evidence for:

• UK GDPR Article 5(1)(f) — integrity and confidentiality (audit is the proof of appropriate technical measures)
• UK GDPR Article 30 — records of processing activities (Halo’s audit feeds your Article 30 register with real usage data)
• UK GDPR Article 33 — 72-hour breach notification (search-first triage; who accessed what during the window)
• DSPT (Data Security and Protection Toolkit) — Standard 9 (Component 3): audit and monitoring evidence
• DCB 0129 / DCB 0160 clinical safety — post-market surveillance and hazard log evidence
• CQC Regulation 17 (good governance) — records of care and decisions
• HSC(NI) 2020/07 and equivalent Northern Ireland IG frameworks

We do not claim automatic compliance with any of the above — a control is only compliant when your organisation’s IG team has completed the corresponding attestation. What we do is give you the evidence to complete it quickly.

Export and integration

Audit data can be:

• Queried in the Halo web dashboard by any user with the appropriate role, with filters for date range, resident, actor, action type
• Exported on demand as CSV or PDF for a scoped date range
• Streamed to your SIEM (Splunk, Sentinel, Datadog, Elastic) as a JSON event feed — available on Enterprise tier
• Delivered as scheduled monthly compliance reports to a nominated distribution list

We do not sell, share, or use audit data for anything other than your own compliance and safety purposes. Ever.

Related

• Alerts & Escalation — the alert side of the audit trail
• Care Notes — care record changes are audited alongside
• Compliance — full posture across UK GDPR, DSPT, ISO 27001, SOC 2, HIPAA, CQC