A record you can hand to an auditor.

Every action leaves an entry.

The audit log lists who did what to which record, and when. This is the product, on a fictional clinic.

• See it in the demo: the compliance seat

The pieces of the record.

• Signed notes. A signed note keeps a SHA-256 hash of the content that was signed, with the signer and the time. An integrity check compares the hash with the current note. It is an integrity check, not a certificate-backed signature.
• A hash-chained audit log. Each new audit log entry stores a hash of its own fields and the hash of the entry before it. A changed row breaks the chain.
• Evidence links. A reviewer can link confirmed session evidence to an exact sentence in a note. Each link is append-only and ties the evidence and the note sentence to the claim it supports.
• Audit package export. A clinic can export an audit package from the records ABACare holds.
• Defense pack. A ZIP of the clinic's AI consent, provenance, review and audit records. Its manifest lists a SHA-256 hash for each file.
• Claim-defense workspace. A case gathers its facts, linked records, readiness pack and appeals in one place.

What the chain shows, and what it does not.

A changed audit row breaks the chain, so an edit shows up when the chain is checked. The chain is tamper-evident within ABACare's own database. It is evidence inside that database, not an external anchor.

A worked example, one claim from session to defense pack.

An example with invented figures, to show how the steps connect. It is not a customer result and not a prediction for your clinic.

1. Session

   An RBT records an invented session. The data is stored with the session.

2. Note

   The BCBA checks the AI draft against the session data and signs. The note keeps a hash of what was signed.

3. Evidence

   The reviewer links a session moment to the note sentence it supports. The link is written once.

4. Claim

   The claim is checked against the payer's rules and released by a person.

5. Record

   Every step wrote an audit entry. An owner or admin exports the defense pack when an auditor asks for the records.

What ABACare does today, and what it does not.

• Does: keep a SHA-256 hash for every signed note and check it against the current note.
• Does: chain new audit log entries, so a changed row breaks the chain.
• Does: export a defense pack with a manifest of file hashes.
• Does not: use a certificate-backed signature on a note.
• Does not: anchor the audit chain outside ABACare's database.
• Does not: show the whole evidence chain for one claim on a single staff screen yet.
• Does not: decide whether an auditor accepts the pack.

Questions about audit defense.

What does a signed note keep?

A SHA-256 hash of the content that was signed, with the signer and the time. An integrity check compares it with the current note.

Is the audit log tamper-evident?

Entries are hash-chained, so a changed row breaks the chain. That is evidence within ABACare's database. It is not an external anchor.

What is in the defense pack?

A ZIP of the clinic's AI consent, provenance, review and audit records. The manifest lists a SHA-256 hash for each file.

Does the defense pack settle an audit?

No. It gives you your records in a form you can check. What an auditor decides is up to the auditor.

Can I try this without real client data?

Yes. The live demo is a fictional clinic: no password and no PHI. Start free opens a sandbox on synthetic data. Self-serve real client data requires a signed BAA and verified active Type-2 organization NPI; production use also follows a separate readiness approval.