GSoC 2026 Project Proposal: Extend Audit Log Module in OpenMRS

1. Project Overview

During GSoC 2025, the Audit Log Web Module was developed to integrate Hibernate Envers into OpenMRS 2.7.0+. This allowed for the tracking of Create, Update, and Delete (CUD) operations. While this established a strong foundation, the current implementation only covers a fraction of the auditing requirements needed for international EMR compliance (such as HIPAA in the US or GDPR in Europe).

The goal for this year is to transition the Audit module from a “change tracker” to a comprehensive security and compliance tool by implementing “Read” auditing and tracking critical system-level events.

2. The Problem

Currently, the module doesn’t capture several critical actions

• View Access: module captures who edited a patient’s record, but it does not show who only viewed it.

• System Security: login attempts/failures, account lockouts, and session timeouts are not logged.

• Administrative Actions: changes to global properties, module installations, and data exports are not captured.

3. Proposed Key Features for GSoC 2026

3.1 Read (View) Auditing

The module will be enhanced to capture read/view access events, current module capture the create and edit events. but does not capture the view events.

3.2 User & Session Security Auditing ✅

To strengthen system-level security auditing, the following authentication and session events should be logged,

• system start and stop

• user login

• user logout

• session timeout (including inactivity and F10 forced logout)

• account lockout

• Node authentication failure

3.3 Patient & Clinical Workflow Auditing

Beyond basic CUD tracking, the module will log

• patient record viewed

• patient record created

• patient record updated

• patient record deleted

• scheduling events (create/update/cancel appointments)

• clinical queries executed

• orders placed, modified, or discontinued

• signature created and validated

3.4 Security Administration Events

• security administration events

• installing new versions, upgrades, and system configuration changes

• loading new versions of codes and knowledge bases

• changes to the system date and time

4. Technical Requirements & Skills

• Java, Spring, Spring Events, Spring AOP & Hibernate: Deepening the use of Interceptors or Spring AOP for read-tracking.

• OpenMRS Core: Understanding the authentication and authorization workflows.

• REST API: Expanding the existing auditlogweb endpoints.

5. References & Inspiration

• Starter task: https://openmrs.atlassian.net/jira/software/c/projects/AUDIT/issues?jql=project%20%3D%20%22AUDIT%22%20AND%20status%20%3D%20%22To%20Do%22%20ORDER%20BY%20cf%5B10019%5D%20ASC

• PCC Audit Tool example: PCC EHR Audit Log

• US EHR certification (ONC): Focuses on “Who, What, When, and Where” for every PHI access.

Project Updates and Discussion of Weekly Meetings :

Weekly Blogs :

Weekly Meeting Notes :

1. Week 1 ( 22/05/2026)

   1. Attendees : @Manoj Rathnapriya @Wikum Weerakutti @phantomx

   2. We got to know each other, this is more of a introduction call.

   3. Discussed about the Project timelines, when we going to do and how we going to do the project.

   4. Making weekly blogs regarding the project work and updates which is major part of GSoC rules, so we discussed on that of how to create and where to create blogs

2. Week 2 ( 05/06/2026)

   1. Attendees : @Manoj Rathnapriya @Wikum Weerakutti @phantomx

   2. Discussed on project updates, like how’s the Security Audit implementation going on.

   3. We discussed on the query for hibernate envers regarding the existing ticket.

   4. Discussion on start creating the weekly blogs .

3. Week 3 ( 12/06/2026)

   • Attendees : @Manoj Rathnapriya @Wikum Weerakutti @phantomx

4. Week 4 (19/06/2026)

   1. Attendees : @Manoj Rathnapriya @Wikum Weerakutti @phantomx

5. Week 5 ( 26/06/2026)

   1. Attendees: @Manoj Rathnapriya @phantomx

   2. We discussed on Read Audit Part and Security Auditing updates.

   3. Mainly talked about the challenges faced on read auditing and how we are using the cache method and BlockingQueue way to solve the duplicate read logging and also not effect the original fetch or get request .

6. Week 6 ( 03/07/2026)

   1. Attendees : @Manoj Rathnapriya @Wikum Weerakutti @phantomx

   2. Discussed on the project updates and about the midterm evaluation guidelines of how I should be prepare and what all I need to do .

   3. Talked about the future works in our bucket which is Administration Events Auditing and creating the REST API for all those.

   4. Also discussed on auditing the scheduling events but for now we dropped this idea.

7. Week 7 ( 10/07/2026)

8. Week 8 ( 17/07/2026)

   1. Attendees : @Manoj Rathnapriya @Wikum Weerakutti @phantomx

   2. Discussed on admin audit actions means which action to include in this and which to not.

   3. We got to know, we need to add the REST APIs for Read Audit part too.

9. Week 9 (24/07/2026)

10. Week 10 (31/07/2026)

    1. Attendees : @Manoj Rathnapriya @phantomx

    2. Discussed on the project update so far and the guideline for the documentation work.