Audit trail in clinic software: what EHR Standards and DPDP ask What the 2016 EHR Standards recommend, what the DPDP Rules will require, and the questions to put to a vendor.

No law in force today names "audit trail" as a requirement for a private clinic's software. The Ministry of Health's Electronic Health Record Standards for India, 2016 recommend one in detail: every action on a health record, including viewing, recorded with date, time, record and user, and records that cannot be overwritten. The DPDP Rules, 2025 will make access logging a legal minimum for every Data Fiduciary, including clinics, when rule 6 comes into force eighteen months after its publication on 13 November 2025: logs that give "visibility on the accessing of such personal data", kept for a year. A clinic choosing software now should ask for both.

What do the 2016 EHR Standards recommend for audit logs?

The data privacy and security chapter of the 2016 standards has an "Audit log" list. Each line is quoted here because vendors paraphrase it loosely:

• "All actions related to electronic health information in accordance with the standard specified in this document including viewing should be recorded."
• "All actions based on user-defined events must be recorded."
• "All or a specified set of recorded audit information, upon request or at a set period of time, must be electronically displayed or printed for user/administrative review."
• "All actions related to electronic health information must be recorded with the date, time, record identification, and user identification whenever any electronic health information is created, modified (non-clinical data only), deleted (stale and non-clinical data only), or printed; and an indication of which action(s) took place must also be recorded."

The advisory standard named is "ISO 27789:2013 Health informatics - Audit Trails for Electronic Health Records". Under integrity, the same chapter says "all alterations and deletions of electronic health information and audit logs ... must be detected", so the log itself must be tamper-evident.

The audit trail rests on a rule about data change. The standards say: "The data once entered into a health record system must become immutable." A correction creates a new record marked ACTIVE and the earlier version is marked INACTIVE; "Alteration of the previously saved data is not permitted." And: "A strict audit trail shall be maintained of all activities at all times that may be reviewed by an appropriate authority like auditor, legal representatives of the patient, the patient, healthcare provider, privacy officer, court appointed/authorized person, etc."

Access control, the other half

A log is only useful if each line points to a person. The standards say: "The solution must assign a unique name and/or number for identifying and tracking user identity and establish controls that permit only authorized users to access electronic health information." They allow emergency access when access controls "need to be suspended in order to save a life", and accept role-based or policy-based access control, naming ISO 22600:2014 as advisory. In an OPD this rules out the shared front-desk login: if three people use one password, the log says nothing about who did what.

The document's own status matters. Its executive summary says it "represents the recommendations of the Expert Committee" and describes "an incremental approach to adopting standards". We found no rule that makes conformance a condition for a clinic. Treat it as the Ministry's description of a well-built system.

What will the DPDP Act and Rules require?

Section 8(4) of the Digital Personal Data Protection Act, 2023 says a Data Fiduciary "shall implement appropriate technical and organisational measures to ensure effective observance" of the Act. Section 8(5) says it "shall protect personal data in its possession or under its control, including in respect of any processing undertaken by it or on its behalf by a Data Processor, by taking reasonable security safeguards to prevent personal data breach." A clinic is the Data Fiduciary; the software vendor is its Data Processor. Rule 6(1) of the DPDP Rules, 2025 (G.S.R. 846(E), 13 November 2025) sets what the safeguards include "at the minimum":

Rule 8(3) separately requires a Data Fiduciary to retain "such personal data, associated traffic data and other logs of the processing for a minimum period of one year from the date of such processing". The Schedule to the Act puts the penalty for failing to take reasonable security safeguards under section 8(5) at up to ₹250 crore. Rules 6 and 8 come into force under rule 1(4) eighteen months after publication; until then the Act's section 8 is also not in force under G.S.R. 843(E). Our DPDP guide for clinics has the dates.

What should a clinic ask a software vendor?

1. Is every view of a patient record logged, or only edits? The 2016 standards say viewing should be recorded; rule 6(1)(c) speaks of "accessing".
2. When a note is corrected, is the original kept as an earlier version, or overwritten?
3. Does each line of the log name a person, not a shared login? Can I give each staff member their own login and role?
4. Who can read the log: the clinic admin, the vendor's staff, both? Does vendor staff access to my data get logged too?
5. How long is the log kept, and can it be deleted by anyone in the clinic?
6. Can I export the log, and the full clinic data, in a format I can open without your software?
7. Is the security obligation written into our contract, as rule 6(1)(f) expects?

Get the answers by email and keep them. A wider list of security questions is in is patient data safe in clinic software.