Audit log

The audit log records who did what in BloomText: sign-ins, chat views, exports, and changes to members, teams, settings and patient records. It covers every organization on your account, so you can answer questions such as "who opened this family's chats last week?" without asking BloomText.

The audit log is turned on per account. Contact BloomText to turn it on. Recording starts that day; nothing from before is in the log.

Before you start

• Only your account's Owners and IT can see the audit log. Organization admins and members don't see it.
• Your account must have the audit log turned on. Until then, nothing is recorded and the Audit tab doesn't appear.

Open the audit log

1. Click Settings, the gear at the bottom of the left bar.
2. Click Account.
3. Click the Audit tab. The last 30 days show first, newest at the top. Click the Time column header to see the oldest first; click it again to go back. More events load as you scroll to the end of the list.
4. Narrow the list with the filters: date range, organization, person, action and patient. Filters combine. The Person filter also offers BloomText Support and System (API keys).
5. Click a row to see its details: the organization, the device and the IP address it came from.

What's recorded

Sign-ins and sign-outs

• Signed in, with how: password, password and SMS code, or PIN.
• Sign-in failed: a wrong password, SMS code or PIN for an existing BloomText login. At most 10 are recorded per person, per organization, per hour.
• Signed out. A session that simply expires records nothing.
• Support signed in and Support signed out, when BloomText Support signs in as one of your people to help.

Chat views

• Viewed chat: someone opened a chat with a patient in it. A person opening the same chat again within an hour isn't recorded again, and scrolling back through a chat isn't a view.

Exports

• Exported chat, as a PDF or ZIP, with the date range.
• Exported member list.
• Exported SMS logs, with the team and date range.
• Exported audit log, with the filters used and the number of rows.

Members and teams

• Changed role, with the old and new role.
• Added member and Removed member.
• Added to team and Removed from team.
• Reset password, Moved member and Deleted member account, done by BloomText Support.

Settings

• Changed setting, with the old and new value, for the organization's name, address, phone and email, SMS verification at login, hiding patient phone numbers, translation, and the STOP line. Address, phone and email changed on Patient chat branding are recorded the same way.
• Changed setting, with only the setting's name, when Patient chat branding changes Show contact card to patients, the website, the Google Maps link, the brand colour, the logo or the icon.
• Changed setting for Allow sign-in with a PIN, when an Owner or IT changes the Allow quick-login PIN switch in the account settings.
• Audit log turned on and Audit log turned off.

Patients

• Added patient, Archived patient and Restored patient.
• Edited patient, with the names of the fields that changed, such as "Phone, Date of birth". The old and new values aren't recorded.
• Imported patients, with the import file's name.
• Deleted patient and Deleted patient account, done by BloomText Support.
• Deleted message, in a chat with a patient.

Download the log as a CSV

1. Set the filters for the events you need.
2. Click Download CSV.

One file holds up to 12 months and up to 10,000 events. For more, pick a shorter date range or add a filter, and download it in parts. Each download is recorded in the log as Exported audit log.

The CSV has these columns: Time (UTC), Organization, Person, Email, Role, Action, Patient, MRN, Details, Chat, Device, IP address and Event ID.

Read the log through the API

Your developers can read the same events through the BloomText API with GET /v1/audit-events, using an API key with the audit.read scope, instead of downloading CSVs. Each event has the same action names and details as the log. See List audit events and Reporting and audit data in the developer docs.

Access history card

Owners and IT also see an Access history card when they open a patient in Directory on the web. It lists the latest views and exports of that patient's chats. The card comes to the mobile app with its next update. For the full history and the CSV, open Settings → Account → Audit on the web.

Good to know

• Message text is never recorded, in the log or in the CSV.
• Anything BloomText staff do in your account shows as BloomText Support.
• Changes made through the BloomText API show the key that made them, such as API key: HR sync for a key named "HR sync". To see only these, pick System (API keys) in the Person filter.
• Events are kept for six years, under BloomText's retention policy.
• The CSV contains patient information. Save it only where your practice keeps protected records.

Related

• Export messages and records
• See every text your organizations sent
• Security and HIPAA compliance
• Admin overview