What is the purpose of audit logs in Phreesia's HIPAA compliance framework?

• A. To track who accessed PHI and when
• B. To market services
• C. To cancel appointments
• D. To store patient images

Answer: (A)

The main idea being tested is traceability of access to patient information. Audit logs in Phreesia’s HIPAA framework exist to record who accessed protected health information (PHI), when they accessed it, and what actions they took. This creates an auditable trail that supports accountability and makes it possible to detect and investigate any unauthorized access. It also helps demonstrate compliance with HIPAA’s Privacy and Security Rules, including proper access controls and the principle of reasonable and necessary use of PHI. For example, if a user views a patient chart, the log would capture the user’s identity, the exact time, and the action performed, providing evidence if an issue ever arises. While PHI is the type of data involved, the purpose of the logs is not to market services or to perform routine tasks like canceling appointments, and storing patient images isn’t the function of these access records.