Security & Compliance

Clinic Audit Logs: How to See Who Changed What in a Patient Record

Antony Dick·Founder & CEO, CuraVerto·3 September 2026·Updated 28 October 2026·6 min read
The 60-second version

Know who changed what, with facts not guesses.

Settle the argument with a record.
1
Pick what you want to know
One tap jumps to that part.
What gets recordedCan it be edited?Honest limits
2
See the simple version
Plain words, one picture.
  • Every action is loggedWho acted, what they did, to which record, and when.
  • Before and afterWhere a route supplies snapshots, the old value sits next to the new one.
  • Rows cannot be editedThe audit table rejects updates and deletes. A correction is a new entry.
  • Admins can filter itAn admin filters their own clinic's log by user, action, record and date.

A log shows what was done through the software. On its own it is not DPDP compliance.

3
See it on your own clinic
A real person sets it up with you.

Send us a question about a record or a billing change you want to be able to trace, and a real person from our team will answer it.

Ask us on WhatsApp
₹50,000per year excluding GST, on the ART plan
Append-onlythe audit table rejects updates and deletes
Not a certificateone supporting tool, not DPDP compliance
Want the detail? Read the full guide (6 min) ↓

Every clinic eventually has the same argument: a bill total is lower than expected, a patient's phone number changed, a prescription was approved by someone who was not the treating doctor. An audit log, a record of who did what and when, settles it with facts. This post explains what an audit trail should capture in a clinic, what CuraVerto's audit log records today, how it connects to the accountability ideas in India's Digital Personal Data Protection Act 2023, and what it does not do.

What an audit log is, and what it is not

An audit log records who acted, what they did, to which record, and when.

What it is
  • A chronological record of actions taken in the system
  • A view of what a record looked like before and after
What it is not
  • The clinical record: the chart tells you what the doctor found
  • A backup: a backup restores data, the log explains how it got to its current state

Three places a clinic needs it most

Patient records, money, and access are where disputes start.

  1. STEP 1
    Patient records
    Edits to demographics, medical history and prescriptions. The log is the evidence if a doctor or patient disputes them.
  2. STEP 2
    Money
    Discounts, credit bills, and billing changes. Most billing disputes are really questions of who applied what and when.
  3. STEP 3
    Access and permissions
    Who was given the ability to do what. The audit trail is how you check it was used as intended.

What CuraVerto's audit log records

One row per action: the clinic, the acting user, the action, the record affected and a timestamp.

Audited today
  • Patient creation and updates
  • Medical or intake changes
  • Branch transfers
  • Prescription submission, approval and rejection
  • Staff discounts
  • Credit bills
  • Doctor commission changes

The list is not exhaustive of every click in the product, and we would rather you know that than assume it.

Append-only at the database level

The audit table rejects any update or delete of an existing row, so corrections are new entries.

What this does and does not protect against
That protects the trail from accidental edits and from casual tampering through the application. It is not a claim of protection against someone with direct administrative access to the database itself, which is a different threat and is handled by access controls on the infrastructure.

Viewing the log

A user with the admin role can open the activity log for their own clinic, newest entries first.

Filter by
  • Event type
  • Acting user
  • Action text
  • Record type
  • Date range
  • ₹50,000
    ART plan, per year excluding GST. Audit Logs is an ART and HMS feature.
  • ₹10,000
    HMS, per sanctioned bed per year: Audit Logs included
  • ₹25,000
    CMS, per year: Audit Logs not part of the plan

The view is scoped to that clinic's tenant, so one clinic never sees another's entries.

How this relates to the DPDP Act, and where to be careful

An audit log supports DPDP accountability. It is not, on its own, compliance.

What a log helps with
  • Showing what happened to personal data, and who did it
  • Responding to a patient's request
  • Investigating an incident
Separate obligations no log can satisfy
  • Consent
  • Notice
  • Retention
  • Breach handling
  • Processor agreements

The DPDP Act 2023 places obligations on a Data Fiduciary, which includes a clinic that decides why and how patient data is processed. Being able to show what happened to personal data, and who did it, supports the accountability the Act expects, for example when responding to a patient's request or investigating an incident. An audit log is a useful piece of evidence for that. It is not, on its own, compliance. Consent, notice, retention, breach handling and processor agreements are separate obligations that no log can satisfy. For a full walkthrough, see the DPDP post below, and take the free readiness check to see where your own clinic stands.

Honest limits

Three limits to know before you rely on any audit log.

  1. STEP 1
    Coverage follows the code
    Only actions that the software audits appear, so ask a vendor which actions are covered, not just whether a log exists.
  2. STEP 2
    Logging never blocks care
    A failed audit write is recorded in the server log but does not block the clinical or billing action it belongs to, by design. That favours availability over completeness.
  3. STEP 3
    Software only
    A log shows what was done through the software. It cannot show what someone read over a colleague's shoulder or copied from a printout.

Frequently asked questions

What does CuraVerto's audit log record?
Each entry records the clinic, the acting user, an action name, the type and identifier of the affected record, a details field that holds before and after snapshots where the action supplies them, the IP address and browser user agent where available, and a timestamp.
Can an administrator edit or delete audit entries?
Not through CuraVerto. The audit table rejects updates and deletes of existing rows at the database level, so a correction appears as a new entry rather than a change to an old one.
Which CuraVerto plan includes Audit Logs?
Audit Logs is an ART and HMS plan feature: ART is ₹50,000 per year and HMS is ₹10,000 per sanctioned bed per year, excluding GST. It is not part of the CMS plan at ₹25,000.
Does an audit log make a clinic DPDP compliant?
No. It helps a clinic show who did what to personal data, which supports accountability, but DPDP compliance also covers consent, notice, retention, breach response and processor arrangements. CuraVerto's audit log is one supporting tool, not a compliance certificate.
Related reading

Frequently asked questions

See who changed what, without asking around

CuraVerto's Audit Logs record who acted, on which record and when, in an append-only trail your clinic administrator can filter. It is part of the ART plan at ₹50,000 per year and the HMS plan at ₹10,000 per sanctioned bed per year, excluding GST.

See CuraVerto pricing →Check your clinic's DPDP readiness freeChat on WhatsApp

Prefer not to use WhatsApp? Leave your number and we will call.

We use your name, clinic and number only to contact you about CuraVerto. If you say how you heard of us, we keep that with your request. See our privacy policy.

More from the blog

Security & Compliance
Do You Need DLT Registration for WhatsApp Reminders in India? (2026)
Security & Compliance
Schedule H and H1 Compliance for Digital Prescriptions in India
Security & Compliance
Role-Based Access in Clinic Software: Who Should See What (India, 2026)