Activity review, on each system's own cadence

Audit controls generate the logs. This is the standard that requires someone to read them, and it is the half almost nobody does, because nothing announces the failure.

The policy is composed from your clinic’s facts

Your activity review policy covers what gets reviewed, audit logs and access reports and system activity, how often, rendered from your own recorded cadence, who performs the review, what a review looks for, how it relates to your audit controls policy, and documentation with retention.

The most cross-checked control in the platform

Ten requirements, several reconciling across records:

• Your inventory of loggable systems covers at least as many entries as you have PHI vendors.
• Every inventory entry has been reviewed within its own configured cadence, weekly, monthly, or quarterly, each with its own staleness window.
• A quarterly summary is attested and current within ninety days.
• No anomaly has sat open longer than thirty days.
• Escalations resolve into their downstream records, sanction events, incidents, or remediation tasks, within their windows.
• No scheduled review event is overdue.
• The policy is active, adopted, reviewed within twelve months, with facts that have not drifted.

The per-entry cadence is what makes this real. A system set to weekly review goes stale after seven days, not ninety, so a single blanket “we review quarterly” cannot cover a system that needs closer watching.

What this is, and what it is not

The system tracks that review records exist, on schedule, per inventory entry, and that anomalies and escalations resolved. It does not read your logs, and it cannot tell you whether the reviewer actually looked carefully or caught what was there. A recorded review is a person saying they looked.

What it does prevent is the review quietly stopping. Cadence windows expire, anomalies age, scheduled events come due, and each of those becomes visible rather than forgotten.

What an investigator gets

An inventory of the systems that hold PHI and produce logs. A dated review history per system, on its own cadence. Quarterly summaries. An anomaly trail showing what was found and how it resolved. Evidence that examining actually happens, which is the half of this obligation with nothing to show in most clinics.