Purpose: Define once, enforce everywhere. The Orchestrator unifies audit logging across heterogeneous systems so every read, write, export, and admin action is recorded with consistent fields, retention, and provenance, ready for investigations and OCR inquiries.
Policy Model
- Unified schema: Normalized event attributes (actor, subject/patient, action, object, channel, location, outcome) aligned to FHIR
AuditEvent. - Coverage rules: What to log by app/endpoint (EMR views, API calls, bulk exports, DB queries, admin actions), plus field-level enrichment (purpose-of-use, request context, session/device posture).
- Retention & redaction: Tiered retention, WORM options, privacy redaction/minimization for non-essential payloads, and cryptographic integrity checks.
- Versioning: Policy lifecycle with draft → approve → deploy, change control, and rollback history.
Integration & Automation
- Connectors: EMR/clinical apps, FHIR servers, API gateways, integration engines, DB audit extensions, file/object storage, and SaaS logs.
- Policy distribution: Push policies/agents to endpoints; heartbeat monitoring and drift detection (endpoint policy ≠ central policy).
- Conformance tests: Synthetic transactions verify that required events are captured with complete fields.
Governance & Evidence
- Coverage dashboard by system/endpoint with traffic vs. logged-event ratios and gaps.
- Immutable evidence packs: active policy, endpoint inventory, conformance results, and sample events.
- Attestations for system owners; exception queue for non-compliant endpoints.
Investigation Hand-Off
- Normalized logs stream to the Audit Event Hub & Investigator for timeline analysis, VIP watch rules, and user/patient-centric views.
- Policy-at-time-of-event stamping to support defensibility during audits or litigation.
Value
- Security/Privacy: Complete and consistent audit footprint across the estate.
- Compliance: Faster OCR responses with ready-to-export binders.
- IT/Architecture: Reduce custom log plumbing; one policy surface.