Risk register · R-024
A terminated workforce account remained active
The access review found one account still enabled after the workforce member’s final day.
Work / Lab
Operational specimen · Protexa
An audit answer is only as strong as the chain behind it.
Select a scenario, then walk from finding to requirement, owner, evidence, and audit record. The records are illustrative. The underlying model is implemented in Protexa.
Interactive evidence-chain specimen
45 CFR § 164.308(a)(3)(ii)(C)
Termination procedures
Implement procedures for terminating access to electronic protected health information when employment ends.
Assigned work · T-118
IT administrator
Disable the account, revoke active sessions, and record the completion time against the finding.
Uploaded artifact · EV-441
Identity-provider revocation log
System record shows the account disabled and all sessions revoked. The artifact is attached to the control record for review and export.
Generated trace · AP-026
Decision is ready to defend
The finding, governing requirement, assigned remediation, source evidence, and reviewer decision are linked in one trace.
Chain status 5 of 5 linked
Risk register · R-031
Emergency access procedure has not been tested
The procedure exists, but no exercise verifies that authorized staff can reach ePHI during an outage.
45 CFR § 164.312(a)(2)(ii)
Emergency access procedure
Establish procedures for obtaining necessary electronic protected health information during an emergency.
Assigned work · T-126
Security officer
Run a tabletop exercise, document participants and results, then route the record for independent review.
Expected artifact
Exercise record is still missing
Upload the completed scenario, attendance record, observed result, and corrective actions before review can begin.
Trace status
Not ready for the auditor
The governing requirement and owner are linked, but the chain stops at evidence. Protexa exposes the missing proof before an audit does.
Chain status 4 of 5 linked
Vendor register · V-014
A service provider handles ePHI
The vendor relationship requires documented assurance that protected information is appropriately safeguarded.
45 CFR § 164.308(b)(1)
Business associate safeguards
Obtain satisfactory assurance that the business associate will appropriately safeguard electronic protected health information.
Assigned work · T-109
Privacy officer
Confirm the agreement, security review, renewal date, and services covered before approving the vendor record.
Artifact bundle · EV-398
Agreement and security review
Signed agreement and assessment are present. The reviewer is checking whether the service scope matches the vendor record.
Trace status
Awaiting reviewer decision
All source material is linked. The chain becomes audit-ready when the assigned reviewer records approval or returns a specific exception.
Chain status 4 of 5 linked
What is real
The implementation boundary
Assessment responses, gap identification, remediation tasks, evidence records, human review states, parent-linked decision traces, and audit-bundle exports.
Completed audit-pack archives receive a SHA-256 hash. Trace lineage inside the bundle is represented by structured nodes and parent IDs.
Record identifiers, organizations, people, dates, and scenario details on this page are fabricated. No customer or patient data is used.
The interface is the argument: every conclusion should carry its source.
Protexa turns assessment state, remediation work, evidence, and human decisions into an exportable record an auditor can inspect.