Audit log, emergency access & disclosures

See who opened, changed, printed or sent a patient’s information

Admin → Audit Log is where your privacy officer answers “who looked at this chart?” and “what did this person do?”. Hero records chart views, changes, sign-ins, permission changes, outbound messages, prescriptions, lab and referral activity, eligibility checks and billing actions. While a chart is open, Hero also records when someone prints from the browser or copies text out of it (never the copied text itself). Opening or exporting the audit log is itself recorded.

All activity

The first tab lists everything recorded in the practice for a period, newest first.

1. Choose the dates. From and To start on the last seven days. Choose 31 days or fewer; for a longer period Hero says to request an archived report.
2. Narrow it down (optional). Who (Everyone or one person; physicians are marked (physician)), Patient (Any patient opens the patient search), and Source (All sources, Access & security, Billing, Encounters, Prescriptions, Laboratory, Referrals, Outbound comms, Eligibility, Logins, Permissions). The action chips Viewed, Added, Changed, Deleted, Printed, Copied and Other narrow by type of action; tick Emergency access only to see what was opened under emergency access.
3. Read and sort. Columns are Time, Who, Patient, Action, Record and Source; click a column heading to sort by it. The action carries a failed or emergency tag when that applies, and a change lists the fields that changed. Human readable (the default) names each record in plain words; Detailed adds the technical name and the network address it came from.
4. Click Export CSV to download the same filtered list as a spreadsheet file.

If more activity matches than one view can hold, Hero says so: narrow the dates or filters, or request an archived report for the full list. A patient shown as Not in this practice belongs to another practice.

Patient activity and Staff activity

• Patient activity: Select patient, then see everyone who accessed or acted on that chart. Filter by From, To and Source; Clear resets the filters.
• Staff activity: Select a staff member to see everything that person did, including their sign-ins and permission changes.

Archived reports

A report compiles the complete activity trail for a period, including activity already moved to long-term storage. As the page says, archived data may need to be restored first, so a report can take several hours; it keeps running in the background.

1. Under Request an audit report, choose the Report type (Patient-centric or Staff-centric), the patient or staff member, and From and To (up to 400 days).
2. Click Queue report. It appears in Report history as Queued, Running or Waiting on archive restore; you can Cancel it while it runs.
3. Download it. A Completed or Partial report shows its event count and a CSV button. A Failed report says why.

A practice can have five reports in progress at once; a sixth is refused until one finishes.

Check that nobody has altered the audit log

Hero regularly seals the audit log, so a later change to an entry, a removed entry or an edited seal can be detected. The card at the top of Admin → Audit Log shows your practice’s latest check and the nightly system check.

Check now checks your practice’s last 31 days. Below the result, Nightly system check: reads no changes found, changes found or did not finish, with its time. Audit entries cannot be edited or deleted from Hero; the check looks for any change made outside it.

Let named staff open a chart in an emergency (“break the glass”)

Some staff cannot open patient charts at all, for example a front-desk role without chart access. With Emergency chart access, staff you name can open a chart they normally cannot see during an emergency: they give a reason, access ends on its own after the time you set, every chart they open is flagged in the Audit Log, and the people you choose get an urgent to-do.

1. Turn the feature on. Open Admin → Additional Features, find Emergency chart access, switch it on and click Save Changes. It is off by default.
2. Set the terms. In Admin → Security, under Emergency chart access, choose Access they get (Nurse by default), How long it lasts (1 hour by default) and Who is told (practice administrators by default). See Security settings.
3. Name who may use it. In Admin → Staff / Assistants, edit the staff member and, under Customize granular permissions, turn on “Open a chart they normally cannot see during an emergency, with time-limited access the practice is told about.” It is in no role profile, and only the practice owner or an administrator can give it. It is for individual staff accounts; physicians do not use it.

Using emergency access

1. Open the chart. Under “You don’t have access to this page”, a named staff member sees Need this chart for an emergency? with how long access lasts and who will be told. Click Use emergency access.
2. Say why. Under Why do you need it? write a short reason (at least 10 characters), for example “Patient arrived unresponsive; need allergies and medications.”
3. Click Open chart now. The chart opens. For the time your practice set, you work with the access level it chose, across the practice, and every chart you open is recorded.
4. Watch the reminder. A pill at the bottom of the screen reads “Emergency access ends in … min. Every chart you open is recorded.” Click End now when you are done; otherwise it ends on its own. A new emergency needs a new reason.

What the practice sees

• A to-do for each person chosen in Who is told, marked urgent and linked to the chart: “Emergency chart access used by …”, with the reason given, when access ends (practice time), and a pointer to Admin → Audit Log → All activity with Emergency access only.
• The Audit Log tags every chart view under emergency access emergency (see All activity).

Show who a patient’s information was sent to, and why

When a patient asks for an accounting of disclosures, the chart’s Disclosures panel (Accounting of disclosures (HIPAA)) lists who their information was sent to, how, why, what and by whom. Most entries appear on their own; you add the ones made outside Hero.

1. Turn it on. In Admin → Additional Features, switch on Disclosure history and click Save Changes. It is off by default.
2. Open the panel. In the vertical chart layout (Switch to vertical layout on the chart header), the patient information panel on the left ends with a collapsed Disclosures section; click it to load the list. Practice administrators and physicians can see it, and so can staff with either “Share patient chart records with outside recipients through secure, expiring links.” or “View HIPAA access logs.”

What is listed on its own

Faxes that went out, shared chart links that were emailed or opened (with the recipient’s opens and downloads), referrals, messages and calls to outside providers, immunization registry reports and look-ups, insurance appeals, lab orders, electronic prescriptions, insurance claims, public health reports, and health record files a clinician sent by Direct secure message. Each entry shows the recipient, when (practice time), a description such as Faxed document (3 pages) (never clinical details), how, why, where it came from, its status and who sent it (or automatic).

• Only disclosures that left the practice are listed: a failed, cancelled or still-queued send disclosed nothing.
• A fax sent for a referral, an outside-provider message or an appeal is listed once, under that source.
• Files the patient sent themselves from the portal are not listed: the patient already sees them in their own portal activity.

Record a disclosure made outside Hero

1. Click Record a disclosure. Staff need the chart-sharing permission above; audit log access alone only reads the list.
2. Fill in Sent to (person or organization), Address, fax or email (optional), How (Mail, Fax, Email, Secure portal, Electronic, Verbal (phone or in person), Released in person, Other), Why (Treatment, Payment, Health care operations, Patient request, Legal, Public health, Research, Other), About the purpose (optional), and What was disclosed (for example visit notes from 2025 and the latest lab results).
3. Click Save. The entry shows as Recorded by staff.

An entry you recorded by mistake is never deleted: click Mark as entered in error, give the reason, and Confirm. It stays in the list, struck through, with the reason. Only hand-recorded entries can be marked this way.

Export for the patient

Export downloads the list as a spreadsheet file (disclosures.csv). If a source has very many entries, the panel shows only the most recent ones and says “Only the most recent disclosures are shown for some sources. Export for the full list.” With nothing yet, it reads “No disclosures recorded yet. Faxes, shared chart links, referrals and other sends appear here on their own; record anything shared outside Hero by hand.”