Intelligence · Audit Replay Timeline
Replay any compliance event. From the evidence itself.
Reconstruct what happened, when, in what order, by whom. Every incident investigation, audit response, and forensic exercise — answered from timestamped evidence.
HIPAA mapping
What this satisfies in the Security Rule.
2 citations, each with the specific Audit Replay Timeline behavior that satisfies it. The mapping is the receipt — what you can show an auditor without assembling anything new.
§164.312(b)Audit controls
Implements hardware, software, and procedural mechanisms to record and examine activity in information systems containing ePHI. The Replay Timeline is the examination layer over the recording layer.
§164.316(b)(2)Time limit
Six-year retention of audit data. The full retention window is replayable; not just the most recent activity.
What it does
From investigation hours to investigation minutes.
When something goes wrong — an incident, a complaint, an audit inquiry, a workforce dispute — the question is always the same: what happened, in what order, by whom. Most practices answer the question by piecing together fragments. Calendar entries, email threads, the EHR's audit log, the front-desk's paper signals. The reconstruction takes hours; the result is rarely complete; gaps in the timeline become defensibility gaps.
The Audit Replay Timeline reconstructs the event from the platform's evidence directly. Every recorded action — every login, access, edit, message, form submission, BAA state change, training completion, role change, alert — feeds the timeline with timestamp and attribution. Pick a window, pick a focus (workforce member, patient record, vendor, incident); the timeline assembles. The reconstruction is minutes, not hours, and the evidence chain is complete by architecture.
The replay isn't just events; it's reconstructed state. At any point in the timeline, the platform shows what was true: which roles existed, which BAAs were active, which policies were in force, which training had been completed. State at time-T is recoverable, not just events around time-T.
How it works
7 mechanisms keep Audit Replay Timeline working.
Unified audit ingestion.
Every module emits audit events into a unified stream. Authentication events from the Personnel module. Record access from Patient Management. Messaging events from Secure Messaging. State changes from BAA tracking. Training completions from Workforce Training. Form submissions. Alert generations and resolutions. The Replay Timeline reads from the unified stream.
Focus-based assembly.
Pick a focus — workforce member, patient record, vendor, office, system, alert — and the Replay assembles events matching that focus across the time window. The assembly is a query, not a manual reconstruction. Most investigations that historically took hours complete in minutes.
State reconstruction at any point.
In addition to event sequences, the Replay supports state reconstruction. “What was true on date X” is a supported query. The platform's data model is designed for state reconstruction — event sourcing where appropriate, snapshot storage where event sourcing is impractical.
Cross-module correlation.
A single incident often spans modules. A workforce member's suspicious access pattern shows in the Personnel ePHI Audit; their corresponding messaging activity shows in Secure Messaging; their alert response shows in the Alert log. The Replay correlates across modules with the workforce member as the binding focus.
Filtering and search within the timeline.
Once a timeline is assembled, filter by event type, role, severity, content category, or free-text search. The filtering happens within the assembled timeline; refinement is fast.
Audit-defensible export.
The exported timeline is structured for auditor consumption — chronological event listing with timestamps, attribution, and context. PDF and CSV formats are both supported. The export includes the assembly query (focus, window, filters) so the methodology is reproducible.
Chain-of-custody preservation.
Audit events are immutable. The Replay reads from immutable records; the assembled timeline is faithful to the underlying evidence. Practices defending against allegations of evidence manipulation benefit from this — the chain of custody is architectural.
Who this is for
Built for the practices that need it most.
Practices investigating an incident.
A workforce member's account showed unusual activity. A patient record was accessed outside expected patterns. An alert fired but the investigation was deferred. Each investigation is a Replay query; the answer comes from evidence, not investigation effort.
Practices responding to OCR or audit inquiries.
When an auditor asks “show me the state of your encryption policy on date X” or “show me the access pattern to patient Y's record over the last 90 days,” the answer is a Replay. The shift from “we'll need to research that” to “here's the evidence” changes the audit dynamic.
Practices in HR or workforce dispute contexts.
Workforce disputes (“I never accessed that record” / “I completed that training”) are answered by the Replay. The Replay's evidence is timestamped, attributable, and authoritative.
Practices recovering from a breach.
Post-breach forensic analysis benefits from the Replay's cross-module correlation. The blast radius investigation — what was accessed, when, by whom, what was the exfiltration window — is faster and more complete than manual log analysis.
Connected to
No module is an island.
Audit Replay Timelineworks because it's connected. Every signal feeds another module; every closure becomes evidence somewhere else.
Defense layer
ePHI Audit Logs
The audit log is the primary evidence source; the Replay assembles timeline views over it.
Learn moreSystem layer
Autonomous Compliance Engine
Task closures are events in the timeline; investigations often start from a closed task.
Learn moreSystem layer
Live Diagnostics
Any past score state can be replayed from the underlying events; full reconstruction of “what changed” between two past dates.
Learn moreWhat you get
6outcomes you'll feel in week one.
Investigation in minutes, not hours.
Assembly is a query, not a manual reconstruction.
Cross-module correlation.
Single focus across the full platform's audit data.
State reconstruction.
“What was true on date X” is a supported query.
Audit-defensible exports.
Structured, attributed, reproducible.
Six-year window.
Full retention period replayable.
Chain-of-custody by architecture.
Immutable evidence, faithful timelines.
How far back can I replay?
Can I replay events from before we joined Patient Protect?
Is the Replay Timeline restricted to specific roles?
What if the timeline shows something I disagree with?
Can I see ongoing replays in real time?
Is this Pro-only?
Continue exploring
Related features in the platform.
Defense
ePHI Audit Logs
Immutable per-session, per-tab audit trail. OCR-ready by default. No assembly required when the auditor calls.
Learn moreSystem
Autonomous Compliance Engine
Auto-generates work from your SRA. Closes when conditions are met. No manual check-offs. No missed deadlines.
Learn moreSystem
Live Diagnostics
A single composite score across every module on the platform. Updated in real time. Present it to auditors, board members, your team — it's always now.
Learn moreNext step
Replay any compliance event. From the evidence itself.
Most Pro practices run their first replay during incident triage or audit inquiry. The shift from hours to minutes happens immediately.
No contracts. No consultants. Starting at $99/mo.