The PHI Access Audit
Every read of protected health information anywhere in KamoUniverse is recorded as a PHI access record: who (actor), what kind of access (view, list, search, download, export, or disclose), on what record (one of 17 tracked resource types — leads, contacts, documents, loan files, chat messages, call recordings, and more), whether it was allowed or denied, from what IP, and when.
This exists to satisfy two specific HIPAA obligations: a periodic activity review, and the ability to answer an individual asking who has accessed their record (an "accounting of disclosures").
Reading the severity model
Rows aren't all equally interesting — the grid highlights them in priority order:
- Denied — a read that was refused. Always the most important signal.
- Platform staff — Kamo's own staff accessing the data, distinct from your organization's workforce.
- Bulk — downloads, exports, or disclosures, where data actually left the platform rather than just being viewed on-screen.
Everything else is a normal, allowed view by someone in your organization and isn't specially marked.
