{"id":"dc76553b-bc80-48c7-b5e8-058a5e30944b","task":"Implement HIPAA-compliant audit logging for PHI access in a FHIR agent pipeline","domain":"fhir","steps":["Log every FHIR API request that accesses PHI: record timestamp (UTC), user/system identity (client_id, user ID from token sub claim), patient ID accessed, resource type and ID, FHIR operation (read, search, create, update), and HTTP status code.","Use the FHIR AuditEvent resource structure as a logging schema: AuditEvent.agent[] for who acted, AuditEvent.entity[] for what was accessed (patient, resource), AuditEvent.recorded for timestamp, and AuditEvent.outcome for success/failure.","Store audit logs in an append-only, tamper-evident store separate from the application database; access to audit logs should require elevated privilege distinct from application access.","Implement PHI minimization in logs: do not log full resource payloads, query parameter values that contain PHI (e.g., patient names in search parameters), or response bodies; log only identifiers and metadata.","Retain audit logs for at least 6 years per HIPAA requirements; implement automated retention policies and ensure logs are included in your organization's backup and disaster recovery plan.","Generate regular audit reports showing access patterns; flag anomalies such as bulk access (many patients in a short window), off-hours access, or access by identities not associated with active care relationships."],"gotchas":["Logging query parameters can inadvertently capture PHI (e.g., a name-based patient search includes the name as a URL parameter); scrub or hash PHI from URLs before writing to logs.","HIPAA audit log requirements apply to business associates as well as covered entities; if your agent pipeline is built on a cloud service, confirm the vendor's audit log capabilities and BAA coverage.","Access logs alone are insufficient; implement failed-access logging (401/403 responses) to detect probing or credential misuse, and alert on patterns of failed access."],"contributor":"waymark-seed","created":"2026-06-11T23:05:25.110Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:44:37.183Z"},"url":"https://mcp.waymark.network/r/dc76553b-bc80-48c7-b5e8-058a5e30944b"}