Security and audit is the layer the clinic owner never thinks about until they need it. A data subject demands their record. A regulator inspects. A staff dispute requires log evidence. A suspected breach needs forensic review. Hoopoe captures everything as it happens; this article walks how to access it, export it, hold it, and present it when the moment arrives.

Where it lives#

HR → Employees → [employee] → History: change history on the user record.
Module-by-module record History tab: change history on the entity (Patient, Invoice, Setting Line, etc.).
Settings → Security and audit → Active sessions: live device list, force-logout.
Platform support: data subject request execution, tenant export, legal hold, anomaly review (no self-service UI today).

The audit log#

What is logged#

Every create / update / delete on every business record.
Every read of sensitive records (clinical, financial above threshold, masked fields elevated).
Every sign-in and sign-out, captured as a UserSession row with auth method (password / passkey / OTP / social / refresh) and GeoIP. WebAuthn ceremonies log their outcome alongside.
Every override (refund above cap, discount below floor, conflict override, manager-acting-as).
Every transmission (NABIDH messages, claim submissions, automation actions).
Every role grant / revoke / role-edit.
Every data export.

What is captured per entry#

Who (user, role, team).
When (timestamp, time zone).
What (record type, record ID, action).
Before / after (the diff).
Where (IP, device, branch context).
Why (reason if provided).

Querying today#

There is no unified audit-log query UI. The supported paths:

Module record History tab for change history on that record.
DRF admin against the Historical* tables for cross-record queries.
Platform support requests for "all actions by user X last week" or "all access to patient P". Manually assembled today, single-pane screen on the roadmap.

Patient access trail for a regulator#

When a regulator asks "who looked at patient P between dates D1 and D2", today's evidence-gathering checklist:

HistoricalPatient rows for direct edits to the record.
UserSession rows that match the time window and the patient's known interaction touchpoints (booked, billed, dispensed).
RoleActionAccess and RoleFeatureAccess history for the roles in effect during D1–D2 (this tells the regulator who could see the patient, not who did).
Module r