Mira™ Compliance.

Every chart access logged. Queryable by patient, user, date range, or IP.

HIPAA's Access Report requirement under 45 CFR 164.528 allows patients to request an accounting of disclosures. The Mira™ audit trail goes further: it logs every access to a patient record by any authenticated user — not only disclosures to third parties, but every internal chart view, documentation entry, and record export. Each event captures the user identity (name and system ID), the patient record accessed, the action taken, the timestamp (UTC), and the originating IP address.

The audit log is immutable. Records cannot be modified or deleted through the application interface. Queries are available to compliance officers through the admin panel — filter by patient, by user, by date range, or by any combination. Exports are available in CSV format for use in investigation reports, surveyor requests, or legal discovery.

The AI audit log is a separate, co-located stream. Every AI feature invocation is logged alongside the standard PHI access events: feature name, prompt length, latency, opt-in status, and the patient and org IDs involved. The prompt body and model response are never logged — only the metadata needed for compliance verification.

• – Logs every chart access — not only third-party disclosures — with user, timestamp, IP
• – Immutable records: no modification or deletion through the application interface
• – Queryable by patient, user, date range, IP, or any combination; CSV export available
• – AI audit events co-located: feature, prompt length, latency — never prompt body or response

60-day notification countdown starts on incident logging. Not on investigation close.

Under 45 CFR 164.412, a covered entity must provide breach notification to affected individuals no later than 60 calendar days after the date of discovery of the breach — not 60 days after the investigation is complete, not 60 days after legal review, not 60 days after the breach is confirmed. The clock starts at discovery. Organizations that treat the 60-day window as beginning at the end of their investigation process are misreading the regulation and accepting avoidable enforcement risk.

The Mira™ breach workflow starts the clock when an incident is created in the system. The discovery date is recorded at creation and cannot be backdated. The 60-day deadline appears on the incident record, on the breach queue, and in the daily compliance digest for any open incident approaching the 30-, 45-, and 60-day marks. The workflow tracks the required notification elements: affected individuals, affected PHI categories, the nature of the incident, steps taken, and the date individual notification was sent.

• – Discovery date recorded at incident creation — cannot be backdated
• – 60-day deadline calculated per 45 CFR 164.412 and surfaced on the incident record and queue
• – Escalation alerts at 30, 45, and 60 days for all open incidents
• – Tracks required notification elements: affected individuals, PHI categories, incident nature, steps taken, send date

SOC2 Type II audit in progress. Target completion 2026 Q4.

SOC2 Type I evaluates whether controls exist and are designed appropriately at a point in time. SOC2 Type II evaluates whether those controls operated effectively over a defined period — typically six to twelve months. Mira™'s Type I audit is complete. The Type II observation period is running. The Type II report is targeted for completion in 2026 Q4.

The controls under audit span the five Trust Service Criteria relevant to a healthcare SaaS platform: Security (CC6, CC7, CC8, CC9), Availability (A1), Confidentiality (C1), Processing Integrity (PI1), and Privacy (P1–P8). The audit is conducted by an accredited CPA firm under AICPA attestation standards. Mira™ does not self-certify SOC2 compliance.

Current control documentation — including the security policy, access control procedures, incident response procedures, and vendor management framework — is available to prospective customers under a mutual NDA. The SOC2 status page in the admin panel shows the current audit phase and the projected Type II completion date so compliance teams can track progress without a support request.

• – SOC2 Type I complete; Type II observation period running; Type II report targeted 2026 Q4
• – Five Trust Service Criteria: Security, Availability, Confidentiality, Processing Integrity, Privacy
• – Conducted by accredited CPA firm under AICPA attestation standards — not self-certified
• – Current control documentation available under mutual NDA; admin panel shows live audit phase