OBSERVABILITY AND AUDIT
Logging Standards
Separate operational diagnostics from immutable business and HIPAA audit evidence.
Production stability and security notice
Development changes must preserve working functionality, Provider isolation, role-based access, HIPAA auditability, released Mobile compatibility, and integration stability. Never deploy AI-generated or unreviewed code directly to production.
Log Categories
| Topic | Standard |
|---|---|
| Operational logs | Application startup, dependency health, job execution, integration timing, and non-sensitive diagnostics. |
| Error logs | Failures with correlation context and sanitized technical details. |
| Audit logs | User actions, entity changes, support access, exports, and administrative activity. |
| PHI access logs | Purpose, decision, minimum necessary, Individual, module, and technical context. |
| Integration logs | Environment, endpoint category, transaction ID, status, and sanitized response summary. |
Safe Logging Rules
- Use request or correlation IDs.
- Never log passwords, access tokens, full SSNs, or raw PHI payloads.
- Do not use console output as the only production audit mechanism.
- Include Provider scope where appropriate.
- Use structured fields rather than ambiguous text.
- Record failures without exposing secrets to the client.