> ## Documentation Index
> Fetch the complete documentation index at: https://docs.encoreos.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Clinical Audit & Compliance Dashboard — Admin Guide

> Feature: CL-25 Last Updated: 2026-04-01

**Feature:** CL-25\
**Last Updated:** 2026-04-01

***

## Overview

Administrators can configure the Clinical Audit & Compliance Dashboard behavior through CL Module Settings.

## Configuration Settings

All settings are in **Clinical → Settings** under the Audit Dashboard section.

| Setting                       | Default | Range | Description                                              |
| ----------------------------- | ------- | ----- | -------------------------------------------------------- |
| Break-Glass SLA Hours         | 24      | 1–168 | Hours within which break-glass events must be reviewed   |
| Default Audit Date Range      | 7 days  | 1–365 | Default date range for audit log queries                 |
| Anomaly High-Volume Threshold | 50      | —     | Access count per user/day triggering high-volume flag    |
| Business Hours Start          | 08:00   | —     | Start of normal business hours for after-hours detection |
| Business Hours End            | 17:00   | —     | End of normal business hours                             |
| Same-Patient Repeat Threshold | 10      | —     | Repeated access count triggering same-patient flag       |

## Permissions

| Permission                              | Description                           |
| --------------------------------------- | ------------------------------------- |
| `cl.audit_dashboard.view`               | View the audit dashboard and all tabs |
| `cl.audit_dashboard.break_glass_review` | Review and close break-glass events   |

Assign these permissions via **Platform → Roles & Permissions**.

## Break-Glass Review Workflow

1. Emergency access event is logged automatically
2. Event appears in the Break-Glass Review Queue
3. Compliance officer reviews within SLA window
4. Officer adds justification notes and confirms review
5. Review is recorded as an immutable audit record

## Regulatory Calendar

Deadlines are configurable per organization. Default deadlines include:

* HIPAA Risk Assessment (annual)
* Joint Commission Survey Prep (per survey cycle)
* CARF Review (per accreditation cycle)
* 42 CFR Part 2 Audit (annual)

> **Note:** Jurisdiction-specific deadlines will be driven by PF-96 jurisdiction profiles in a future enhancement. {/* TODO(PF-96): wire jurisdiction-based deadlines */}

## Related Documentation

* User Guide: [clinical-audit-dashboard-user.md](clinical-audit-dashboard-user.md)
* Specification: [CL-25](../../../specs/cl/specs/CL-25-clinical-audit-compliance-dashboard.md)