The HIPAA Security Rule technical safeguards require covered entities and business associates to implement audit controls. 45 CFR 164.312(b) is about recording and examining activity in the information systems that hold electronic protected health information (ePHI).
What 45 CFR 164.312(b) asks for
Implement hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use electronic protected health information.
Receipt-field mapping
request_hashRecords the activity as a SHA-256 hash, without storing the ePHI content itself
model + outcomeWhat the system did and which model produced it
policy_appliedWhich access or handling policy was in force at the time
timestampWhen the activity occurred
reviewer_id (when present)The person who examined or authorised the activity
signature + public_keyTamper-evident record that can be examined after the fact
attestation_id + prev_attestation_idHash chain that supports examining activity across a sequence
A receipt is a mechanism that records activity and stays examinable, signed at the time it happened, and it carries a hash of the input rather than the ePHI itself. Designed for the audit-control standard at 45 CFR 164.312(b). Aqta issues signed evidence, not a HIPAA certification.
Read 45 CFR 164.312 on eCFR or read the full open spec at github.com/Aqta-ai/attestation-spec.
← Back to the verifier