0 items
How?
Add the exact original files for this part of the record. Keep them unchanged; a different export or edit has a different fingerprint.
Add link and screenshots
The link is recorded, not fetched or verified.
HIPAA audit log retention
Have the checkpoint behind the log review.
HIPAA audit log retention — Have the checkpoint behind the log review. Keep exact checkpoints and your retention policy separately. A timestamp does not set the retention period.
Your photos and files stay on your device, so keep them.
EXAMPLE
Daily checkpoint hash of access-log segments for ePHI systems to show logs were not trimmed
1 Nov 2026
Authority time: 14:02 UTC · example
Bitcoin block time: 14:10 UTC · example
Last checked: 15:02 UTC · example
Bitcoin block time: 14:10 UTC · example
Last checked: 15:02 UTC · example
✓ Dated◆ Permanent
Now keep it safe: three things
- Keep your photos and files unedited. The receipt only matches the originals. Put them in an album such as “My records”.
- Save this receipt to your camera roll.
Keep the receipt file too. The image is a handy copy; checking needs the file.
- Email it to yourself.Email it to myself
Your mail app opens a draft. Attach your receipt image and receipt file. Don’t attach your photos or documents. Timevolt does not send it or know whether it was sent.
Your record, one step at a time.
Your photos and files stay on your device, so keep them.
Local preview: files are fingerprinted here. Notes and progress stay in this browser. Keep downloaded copies; browser storage is not a backup.
0 items
How?
Record the date, time, place and who you spoke to. New notes are saved separately rather than editing an old note.
How to keep notes that hold upWrite it down
By making a receipt you agree to the Terms and Privacy Policy. The Bitcoin record is permanent.
By making a receipt you agree to the Terms and Privacy Policy. The Bitcoin record is permanent.
How to keep notes that hold up
Write notes as soon as you can. Keep the original account rather than replacing it later; the venue decides what weight it gets.
- Write it down straight away, on paper or in the box on a step.
- Put the date, time and place at the top, and who you spoke to.
- Use their words where you can; separate what you saw from what you were told.
- Sign or initial a paper note, photograph it and add the photo.
- Never edit an old note. Add a new dated entry when something changes. A device save time is not independent time evidence or proof of event order.
Daily checkpoint hash of access-log segments for ePHI systems to show logs were not trimmed
Daily checkpoint hash of access-log segments for ePHI systems to show logs were not trimmed
01 · Keep the exact files
Export a bounded log segment with its sequence range. If using a chain, include the previous checkpoint in an explicit manifest.
Records to keep: Hash of the segment and the previous checkpoint (series)
Daily checkpoint hash of access-log segments for ePHI systems to show logs were not trimmed
02 · Date the file’s code
Your device fingerprints the selected file or manifest. Dated follows an independent timestamp; Permanent follows Bitcoin anchoring.
An independent time, tied to the exact bytes.
Daily checkpoint hash of access-log segments for ePHI systems to show logs were not trimmed
03 · Keep the evidence
Keep daily exports, manifests and receipts. Recompute the fingerprints and check sequence ranges in your own log-review process.
Keep the originals too. A changed or compressed copy has a different fingerprint.
Try a file. It stays here.
Make a test receipt on this device.
By making a receipt you agree to the Terms and Privacy Policy. The Bitcoin record is permanent.
or drop a file here
Real cases: why records made at the time matter.
Real cases where dated records mattered. We don’t claim a time receipt would have changed the result.
US · 2017
Keep checking access after a worker leaves
A former worker's login was used to view patient files daily for about a year. The firm did not catch it through routine checks. A report says it settled the regulator's case and agreed to a fix plan.
Based on a specialist news report of the regulator’s settlement.
Summarized on Oct 29, 2026
Read the report ›US · 2024
Access logs need routine checks for misuse
A worker viewed patient files for six months and sold the data. A report says the hospital settled with the regulator and paid a penalty. Its plan called for risk checks and tools to log and review access.
Based on a law-firm summary; the regulator’s own page was not independently reviewed.
Summarized on Oct 29, 2026
Read the case summary ›US-Pennsylvania · 2024
Missing record history can lead to search costs
People suing a hospital had to keep asking for its record-change history. A case report says the hospital had to pay their search costs. The court refused their request to win outright because they had not shown the gap harmed their proof.
Summarized on Oct 29, 2026
Read the summary ›What courts, schemes and regulators say.
Positions below refer to the cited rule or record type, not endorsement of Timevolt. This service is not represented as an eIDAS qualified timestamp provider. A non-qualified timestamp does not receive the qualified timestamp presumption.
HIPAA Security Rule, 45 CFR 164.312(b) and (c)
Audit controls: implement mechanisms that record and examine activity in systems with ePHI. Integrity: protect ePHI from improper alteration or destruction; electronic mechanism to corroborate ePHI not altered is addressable. No technique named.
The rule does not mention timestamps, hashing or third-party anchoring; a time receipt is an optional supporting control, not a requirement. Six-year retention comes from 164.316(b)(2)(i) for documentation, and sources differ on applying it to raw logs.
Source summary as of 2026-10-28. Check the current source and applicable local rules.
Read the sourceFederal Rules of Evidence 902(13) and 902(14)
Records from an electronic process, and data copied from a device authenticated by a process of digital identification, can be self-authenticated by a qualified person's certification. Committee note: identical hash values attest that original and copy are exact duplicates.
Hash comparison is recognized for showing a copy matches an original. Admissibility and weight remain for the court; the timestamp adds when, not accuracy.
Source summary as of 2026-10-28. Check the current source and applicable local rules.
Read the sourceHHS OCR enforcement (Security Rule)
Resolution agreement cites 164.308(a)(1)(ii)(D) (information system activity review).
OCR cases focus on whether logs were reviewed and controls existed, not on proving log immutability by timestamp.
Source summary as of 2026-10-28. Check the current source and applicable local rules.
Read the sourceState trial court discovery
Court sanctioned late disclosure about an EHR audit trail; treated lack of prejudice as limiting remedy.
Single trial-level order; no statement on timestamped hashes.
Source summary as of 2026-10-28. Check the current source and applicable local rules.
Read the sourceOther ways to do this
Prices change. Check each provider’s site for current prices and service details.
Related workflows.
Proves / Doesn’t prove
Proves
A completed time receipt shows that the exact selected file existed by the independently witnessed time. You can check whether a later copy has the same bytes. It does not establish creation time, authorship, identity, event order, location or the truth of the contents.
Doesn’t prove
Does not prove the logs were complete or accurate when written, who wrote or accessed anything, that a system captured every access, or that the organization meets HIPAA; it only fixes the bytes you hashed to a time.
A receipt cannot show the log was accurate or complete when written. A missing receipt alone is not evidence of tampering.
These are the bounds of a completed proof. The local tester does not establish any time. The chosen court, scheme or regulator decides what to accept.
Questions, answered plainly.
Your file stays on your device. During normal receipt creation, your device sends a randomized code made from its fingerprint, plus encrypted recovery data. It doesn't send the plain fingerprint or the random value that opens the code. Keep the original file and the complete receipt for checking. Privacy Policy.
Does HIPAA require me to timestamp my logs?
No. The Security Rule asks for audit controls and protection against improper alteration, but names no technique. A time receipt is an extra control you can choose to add.
Source summary as of October 30, 2026. Check the current source and its scope.
Context for this answerDo you see my access logs or patient data?
Your file stays on your device. During normal receipt creation, your device sends a randomized code made from its fingerprint, plus encrypted recovery data. It doesn't send the plain fingerprint or the random value that opens the code. Keep the original file and the complete receipt for checking.
What exactly does the receipt prove about my logs?
A completed time receipt shows that the exact selected file existed by the independently witnessed time. You can check whether a later copy has the same bytes. It does not establish creation time, authorship, identity, event order, location or the truth of the contents.
What does it not prove?
It doesn't prove the logs were complete when written, who did what, or that your system captured every access. It also doesn't prove HIPAA compliance or decide any dispute.
Why chain each day to the previous checkpoint?
Hashing each segment together with the prior checkpoint means changing one old day breaks every later checkpoint, and a missing day shows as a break. Anchoring the chain head to an outside clock stops someone from quietly rebuilding the whole chain.
Source summary as of October 30, 2026. Check the current source and its scope.
Context for this answerHow is this different from immutable (WORM) storage or CloudTrail validation?
Those prevent or detect changes inside your own cloud account. A time receipt is dated by an independent timestamp authority and Bitcoin, so you can show a dated record that doesn't depend on trusting your own systems. They work well together.
Source summary as of October 30, 2026. Check the current source and its scope.
Context for this answerWill an auditor or court accept it?
That's up to them. Courts recognize hash values for showing a copy matches an original, but the receipt is supporting evidence about when, not about accuracy.
Source summary as of October 30, 2026. Check the current source and its scope.
Context for this answerHow often and how much does it cost?
See the Pricing page for current US-dollar plans and allowances. Fast is paused. Purchases open when receipts open.
Source summary as of October 30, 2026. Check the current source and its scope.
Context for this answerThe file tester runs on your device. It does not issue a timestamp or take a payment.
Keep the records you already have.
Keep your original files and any existing official records while the receipt service is being prepared.