PCS Cross Check — Admin, Audit & Reporting

The legal record

One document — the same one everywhere the law looks ACR

Every finalized chart renders as a clean, boxed, MOH 1881-45-style Ambulance Call Report — ministry sections, the full treatment table, captioned ECG strips and the crew's PIN-attested signatures. It is the same document at review on the tablet, in the portal, on print and in a disclosure, and blank fields render visibly, so an auditor never misses one. Corrections never rewrite history: an amendment is signed as a new numbered version, the disclosed copy is always the current version, and the original — and every version between — stays retained and openable.

The official ministry-format Ambulance Call Report: the OFFICIAL ACR read-only banner with completion stamp, the MOH 1881-45 document header with service, call number, version and standards lines, and the full demographics and clinical-information sections of a chest-pain call

The legal record as it renders: completion-stamped, version-labelled, standards-lined — and read-only forever once signed.

The official document's Clinical Treatment/Procedures Results table: fourteen time-stamped rows — assessments, serial vitals with trending pain scores, ASA, a 12-lead acquisition, IV cannulation, nitroglycerin twice, morphine and the receiving-hospital notification — each crew-attributed

The whole clinical story in one table — serial vitals trending, the nitro and morphine each carrying their pre-dose pressures, every row crew-attributed. This is what lands in front of a coroner, a college or a court, and it reads like the call.

The portal's ACR overlay on an amended chart: the version strip offering Current version (v2), Original (v0), Version 1 and Version 2, and the official document itself carrying the VERSION 2 — AMENDED COPY banner naming who corrected it, when, and why, with the note that the original and every earlier version are retained unaltered

Corrections that don't rewrite history: the supervisor opens the current version by default, the amendment banner names who, when and why — and v0 and every version between are one tap away, retained unaltered.

What makes it the legal record5 features

One renderer, everywhere — the tablet's review, the portal's document view, the printed page and the disclosed copy are the same rendered document, so no two audiences ever see a different chart.
Versioned amendments, immutable originals — once signed the chart locks read-only forever; corrections stack as signed, numbered versions with the reason on the banner, and a disclosure automatically carries the latest version with an amendment notice.
Blank fields render visibly — an empty box prints as an empty box, so what wasn't documented is as auditable as what was.
Signatures with a ledger — every signer's PIN attestation is recorded with a timestamp; the document carries who signed, and exactly when, into the record.
Every access audited — opening a chart in the portal writes the audit log before the record is released, and the log is itself append-only and hash-chained.

Audit & Admin Portal

Oversight built for supervisors Admin

A dedicated portal gives supervisors and administrators full visibility — find any chart, keep the sign-off queue moving, triage shift logs and incidents, securely release records, and see every access — all separate from the medic's tablet, with the server enforcing every role boundary.

Admin portal audit tab — recent ACRs with statuses and the awaiting sign-off badge counted on the tab

Every chart, searchable by patient, address, health card, call number or paramedic — with the sign-off queue counted right on the tab, and every search itself logged.

Awaiting sign-off queue naming who still owes a signature on each chart

The queue names exactly who still owes a signature — and the 18-hour backstop keeps it honest.

Disclosures tab with one-time secure sends, expiry times, download counters and a new secure send button

Secure release with one-time links and separately-texted codes — and the send log doubles as the service's PHIPA accounting of disclosures.

The portal’s Community Paramedicine client record with the Document file card: nine documents — date, type pill, title, size and filed date — each with Open, Edit and Remove buttons, an Add documents button and a drag-and-drop zone above, and a Show removed documents control beneath

The coordinator’s side of the same file: drag the scanned fax or the PDF from the desk straight onto the client — no visit needed. Every document with its type, date and size; Open (and it’s logged), Edit the details, or Remove with a PIN — a removed document stays recoverable for 30 days before the file is crypto-shredded. Documents get their own retention dial, 12 to 60 months, and purging them never deletes the client.

Shift Logs tab with daily vehicle checks and red flag pills for defects

The crews' vehicle checks, triaged — red pills where something needs a supervisor.

Activity log audit trail in the admin portal — reads, searches and system events with actors, resources and timestamps

Every access, search and change — recorded, filterable, and itself audited.

What supervisors can do11 features

Audit & search — find any chart by patient, address, health card, call number or paramedic, and review the official document in full; every search is logged.
Awaiting sign-off & return-for-amendment — the queue names exactly who still owes a signature; return a chart to a crew member with a reason and a clear amendment banner on the tablet, and amendments come back as stacked, immutable versions.
A priority audit queue — a med-error override or a stale escalation rides straight to the top of the list, so the charts that need a supervisor first get one first.
Reporting & exports — call volume, response and on-scene times, CTAS mix, transport destinations and crew workload, all computed on the server from the live records. Export any view in five formats for your own analysis, or schedule a report to arrive on its own.
Call-density heat map — see where the calls actually are across your coverage area, built from the location already captured on each call. Useful for posting, staffing and the conversations you have to justify both.
Supervisor-authorised overrides — when a medic is blocked by a required-field rule on a real call, a supervisor can read them a one-time code instead of the crew self-attesting. The call goes to the top of the review queue carrying the supervisor's name and their stated reason.
A review queue that empties — escalations can be marked reviewed once dealt with, so the list reflects what still needs attention rather than growing forever. The escalation stays in the record's history either way.
Shift logs & incident reports — triaged daily vehicle checks with red flag pills (major defect, failed check, low fuel), plus PIN-signed incident reports viewable and downloadable as PDFs.
Two-factor secure disclosure — package a patient's record, encounters and linked 911 reports into a one-time pickup link, then text a separate access code; the recipient needs both, the link carries no PHI, and wrong codes lock them out.
The client’s document file, from the desk — drag PDFs or photos onto a Community Paramedicine client’s record, edit a document’s details, open any document (each open is logged) and remove one with a PIN — a removal stays recoverable for 30 days before the file is crypto-shredded. Documents get their own retention dial in Service settings, 12 to 60 months, and purging them never deletes the client.
Role-limited account administration — create, reset and deactivate accounts with guardrails: supervisors can't grant themselves admin or delete the last administrator, and accounts tied to records are deactivated rather than deleted, so the audit trail stays intact.

Reporting & Analytics

The numbers, without the patient records Reporting

Every finalized chart already holds the times, codes and outcomes your service reports on — the reporting layer turns them into KPIs, charts and exports without a single patient record leaving the server. Records decrypt server-side, reduce to counts and medians, and only the aggregates reach the browser. Every view, export and scheduled run writes the audit log. And every median comes with its completeness percentage, because a number without its denominator is a guess.

Reporting tab: date-range and filter controls with five-format export, KPI tiles for total calls, transport rate, CTAS 1–2 share, median response, on-scene and offload times, offload hours and medications per call, and call-volume charts by hour, day of week and trend

The KPIs a service actually reports — call volume, transport rate, CTAS mix, response, on-scene and offload medians, offload hours — over any range, with filters and five-format export, and the volume trends charted right below.

The Operational intervals card: chute, response, on-scene, transport, offload-delay and total-task rows each with eligible calls, completeness percentage, median, mean and 90th percentile — plus median response by CTAS, average task time by hour, and response-by-priority tables

Chute to offload delay, each interval with its eligible count, completeness, median, mean and 90th percentile — response by CTAS and by dispatch priority beside it. Honest numbers, ready for the annual report.

Per-paramedic activity table listing OASIS number, calls, transports, transport rate, medications, procedures, median on-scene time, incident reports, amendments and returns for each attending paramedic

Activity per attending paramedic over any range — calls, transports, medications, procedures, median on-scene, incident reports, amendments and returns — built from charts that are already signed, so nobody re-keys anything.

The Community Paramedicine reporting card over a funding year: program KPIs including 47 distinct clients seen across 211 CP visits, 29 referrals, 184 of 211 visits timed with a 38-minute median, the caseload by status right now, encounters-by-month with notes from 911 calls on their own line, how-often-clients-were-seen frequency bands, and a by-clinician workload table with a reconciliation note

The CP program's funding case, computed: distinct clients seen reported separately from visit volume, frequency bands showing how often clients are really seen, by-clinician workload — and a reconciliation note that says exactly which basis each number rests on, so a submission never overstates the program's reach.

The 911-use-before-and-after-enrolment statistic in the Community Paramedicine report: headline tiles for 911 calls per client per 30 days before and after enrolment, the change with its likely range and the number of clients analysed, a highlighted honesty line, five checks on the number, and tables of who is counted, the change per client, calls and transports, what is not counted, and how calls were matched to clients

The hardest number in the program, and the one most easily oversold. It is computed one way for the report and for the coordinator’s per-client list, over the same number of days each side of enrolment, with the comparison window a service setting the card always names. Planned transfers, standby, cancelled calls and unsigned drafts are shown and not counted; a blank call type is counted and shown on its own line. Below five analysed clients it prints nothing but the plain counts. The honesty line — before and after enrolment, not proof of cause — and every check are rows in the export, and the per-client list behind it needs the View CP reports permission and writes the access log on every load.

The call-density card: a heat map over the coverage area with the location-completeness figure — 1,133 of 1,254 calls mapped — and a calls-by-postal-area bar chart beneath it

Where the calls actually are. Counts are bucketed into ~550 m cells on the server, so no patient record and no raw coordinate ever reaches this screen — and the same picture comes out as numbers, by postal area, underneath.

Inside the reporting layer9 features

Server-side aggregation, by design — records decrypt in the application, reduce to counts and medians, and only de-identified aggregates reach the browser. Charts are inline SVG — no CDNs, no third-party analytics.
The KPIs a service actually reports — call volume, response / on-scene / transport intervals with a completeness percentage on each, CTAS mix, dispositions, destinations, medications, procedures, age and sex distributions, calls by hour.
Call-density heat map — de-identified ~550 m grid-cell counts drawn locally over base tiles that load only when a supervisor clicks Load; the density data itself never leaves the service.
911 use before and after enrolment — for clients enrolled in the period, 911 calls per client per 30 days over the same number of days each side, with the change, its likely range, the fewer / same / more split and five checks on how far it can be trusted. It is a measurement, not a diversion claim: the honesty line and the checks are rows on every export, and below five analysed clients the rates are suppressed.
Five-format export — the dashboard, per-medic and custom reports export as CSV, XML, XLSX, DOCX or PDF, generated entirely on the server — and CSV cells are neutralized against spreadsheet formula injection.
Reports that arrive on their own — schedule the service-performance report daily, weekly or monthly; recent runs stay downloadable in the portal, and email delivery is optional.
A custom report builder — pick the range, filters, group-by and metric, and export the answer like any other view.
Per-medic activity — a view for supervisors and administrators of workload by attending paramedic, attributed the way the chart was signed.
Research-grade raw export, guarded — administrators can export record-level data, de-identified by default: names, birthdates, health cards, addresses and call numbers stripped, ages banded, and free-text never exported in any mode. Every export is audited.

Privacy that patrols itself

Breach watch — someone actually reads the audit log PHIPA

Every access is logged — but a log nobody reads protects nobody. So an automated sweep reads it for you — comparing record access against each account's own history and the patterns snooping takes: a volume outlier, an enrolled client sharing a staff member's surname, a long-quiet account suddenly reading, small-hours access. A signal is a suspicion, not a breach — most are a busy shift. A supervisor looks at each one, dismisses it in a tap, or escalates it into the breach register: the service's permanent PHIPA s.12(2) record of what happened, how it was contained, and when the required notices went out.

The Breach watch tab: six open access signals across five detectors — own-surname record access, volume outliers, a dormant-account burst, coworker-surname access and small-hours access — each with severity, a plain-language summary and a lapse countdown; below, the breach register with an open entry whose individual-notified column reads 'not yet' in red, a contained lost-phone entry and a closed misdirected-fax entry with both notification dates recorded

The whole discipline on one screen: machine suspicions with plain-language summaries and severities — each one Dismiss, Dismiss-with-note or Escalate — lapsing on their own if nobody bites; and beneath them the permanent register, where the red "not yet" pill nags until the person is actually notified, and the closed entry carries both notification dates for the annual IPC return.

How the breach watch works6 features

Five detectors — access-volume outliers measured against the account's own baseline (multiples of that user's own daily median), own-surname and coworker-surname access to enrolled-client records, a dormant account suddenly reading, and small-hours access. What's a normal volume for a duty supervisor isn't what's normal for a part-timer — so the volume baseline is personal.
A signal is a suspicion, not an accusation — the UI says so on every screen. One tap dismisses with or without a note; escalation opens a register entry with the signal attached as evidence.
Signals lapse; the register never does — untouched signals age out on a service-set window so the list stays honest, while register entries are kept permanently. Suspicions expire — the s.12(2) record doesn't.
The notices, tracked — each register entry carries when the affected person was notified and when the IPC was told, with a red "not yet" until it's done. PHIPA's first-reasonable-opportunity duty, on a screen instead of a sticky note.
Breaches people report get a door too — a misdirected fax or a lost phone that no detector saw is recorded directly into the register, so the record is complete either way.
The annual statistics, already kept — the register is the source for the yearly statistical return to the Information and Privacy Commissioner; the count is a query, not an archaeology project.

The CP fax line

The fax inbox and the fax outbox — every step on the record Fax

The Community Paramedicine fax line has a desk side. The fax inbox the medics open on the tablet is a tab here, with the sent faxes, the list of checked fax numbers and the service’s fax settings beside it. Fax is the default way to send a record, with the secure link and texted access code as the alternative. Who may sort the inbox is a permission each service grants to whichever roles it chooses — office staff included, with no access to charts. A person files every fax, nothing in the inbox is ever deleted automatically, and every step records who did it.

The admin panel’s Fax tabs — Inbox with a count of 2, Sent faxes, Destinations and Fax settings — under the banner Fax is on. Faxes are sent from +1 613-555-0110; below, the Fax inbox with its Inbox, Archived and Filed, deleted & not ours views, the note that nothing is ever deleted automatically and every step records who did it, and two New faxes received 2026:09:25 09:10:33 from +1 613-555-0177 and +1 613-555-0142, one page each, waiting under 1 h, each with Open, File to client, Mark read, Archive, Delete and Not ours

The desk side of the inbox the medics open on the tablet — one list with the same actions, so whoever reaches a fax first files it and it leaves both. Each row shows when the fax arrived, how long it has waited, the number it came from, the page count and who has read it. Here a second fax from Dr. Marchetti’s office waits beside a fax that was never meant for this service. Opening either one writes the access log before the image appears.

The dialog Tell the sender it reached the wrong number: phone or fax the sender to say their fax reached the wrong place; the number is kept, encrypted, only until someone records that the sender was told, then it is erased; the sender’s number, +1 613-555-0177, in large type; the record shows Sender not yet told until this is recorded; and the buttons Sender told by phone, Sender told by fax, Told another way and Not yet — later

A fax that reached the wrong service. Not ours says what it does before it does it: “This destroys the fax image and keeps a record that it arrived. Do not forward it. Tell the sender it reached the wrong number.” The image is destroyed and never forwarded. The sender’s number is shown so someone can phone or fax them; it is kept, encrypted, only until someone records how the sender was told, and then it is erased. The record that the fax arrived outlives the image.

The Filed, deleted & not ours view of the fax inbox, with the columns Received, From, Pages, What happened, By and Sender told: three faxes received 2026:09:25 — one page at 09:10:33 from +1 613-555-0142, filed to CP-0412, in the client’s Documents, by D. Kearns at 09:10:51; one page at 09:10:33 whose sender’s number now shows only its last four digits, 0177, marked Not ours, image destroyed, not forwarded, by D. Kearns at 09:10:55, with the sender told by phone at 09:10:56; and two pages at 09:08:40 from +1 613-555-0142, filed to CP-0412 by A. Sinclair at 09:08:58 — each with what happened, who did it and when

What remains after a fax leaves the inbox: a line for each one saying what happened, who did it and when. A filed fax shows the client’s CP code and points to that client’s documents. The misdirected fax is now a record with no image — destroyed, not forwarded, and marked with how its sender was told. Once the sender was told, the number was erased; the row keeps only its last four digits. A deleted fax needs a reason and leaves the same kind of record behind; an archived one can be brought back.

The admin portal signed in as J. Delgado, Staff: the only tab is Fax, with a count of 2, and the only view under it is Inbox — the same Fax inbox with the same two New faxes, received 2026:09:25 09:10:33 from +1 613-555-0177 and +1 613-555-0142, each with Open, File to client, Mark read, Archive, Delete and Not ours

Sorting the fax tray is a permission, not a job title. Each service decides which roles hold it — here an office clerk, J. Delgado, who sees one tab, Fax, and one view, the Inbox. A role can hold it with no access to charts: the lookup used to file a fax finds the client and opens no chart, and every search is logged. Out of the box, only Administrators have it.

The Fax destinations list and its rule — the only fax numbers anyone at this service can send records to; nobody types a fax number when sending; a new or changed number cannot be used until someone confirms it and records how — with 1 destination: Dr. Helen Marchetti, Lakeview Family Health Team, +1 613-555-0142, Verified by D. Kearns on 2026:09:24, “Phoned Lakeview reception (613-555-0140) and read the number back”, with Re-check, Edit and Retire, and Add destination above

The protection against a record landing on the wrong machine. A fax only ever goes to a number on this list — never one typed at send time — and a new or changed number cannot be used until someone confirms it is right and records how. Here D. Kearns phoned the clinic’s reception and read the number back; the list keeps who checked it, when and how. Change a number and it has to be verified again.

The Sent faxes list, newest first, with the note that only Delivered means the receiving machine confirmed it, and the columns Queued, From, To, Records, Pages, Status, Last change and Sent by: a fax of 1 record, 3 pages, from +1 613-555-0110 to Dr. Helen Marchetti, Lakeview Family Health Team, +1 613-555-0142, queued 2026:09:25 09:11:04 by D. Kearns, Delivered at 09:11:27; and below it a fax of 1 record, 3 pages, from the same number to the same physician and number, queued at 09:09:07 by A. Sinclair, Delivered at 09:09:28

Every fax the service sends, from the iPad or the desk, lands in this one list with its real status. Here both reached Lakeview: the visit record A. Sinclair sent from the iPad, and a record D. Kearns sent from the admin panel. Only “Delivered” means the receiving machine confirmed it. When the platform cannot tell whether a fax went through, it does not guess, and it never sends the fax again on its own — a second send would be a second disclosure. The fax is parked as Outcome unknown until a person checks the fax provider’s sent list and records what it shows, confirming with their PIN, and a fax id they enter is checked with the provider before it is accepted.

Fax settings under Fax is on. Faxes are sent from +1 613-555-0110: the service legal name, Demo Paramedic Service, which prints on every fax; the service phone number, 613-555-0100, which prints on every fax and document; unfiled-fax alerts with the first after 4 hours and the second after 24; the note that nothing is ever deleted or archived automatically; and the service’s fax number, +1 613-555-0110, for sending and receiving, labelled CP line, read-only and assigned by the platform operator

Each service faxes from its own number, under its own name. The legal name and phone number set here print on every fax and on every document that can leave the platform, so a recipient knows who sent it and who to call. A fax left unfiled is flagged to everyone who manages the inbox after the first window, and to CP coordinators and supervisors after the second — the service sets both, here 4 and 24 hours. The alerts are on screen, and nothing in the inbox is ever deleted or archived on its own.

How the fax line works8 features

One inbox, two doors — the Fax tab in the admin panel and an Inbox button beside Key Nav on the CP tablet open the same list with the same actions. It is the Community Paramedicine line, for the program’s documents.
Filed by a person, to the client — find the client by name, health card or CP code, give the fax a type, a title and a date, and it moves into that client’s documents and leaves the inbox. The encrypted file moves as it is, never decrypted to be filed, and opening a fax writes the log before the image is shown.
Every way out of the inbox is logged — mark read (it stays), file, archive (which can be undone), delete (a reason is required; the image is destroyed and a record kept) and not ours, each under the person who did it.
Not ours, never forwarded — the image is destroyed and never forwarded; the sender’s number is shown so staff can tell them, how they were told is recorded, and then the number is erased. A record that the fax arrived outlives the image.
Only checked numbers, one channel per send — fax is the default and the secure link + access code the alternative, never both. A fax goes only to a verified number from the service’s list; a changed number must be verified again, and a disclosure revoked before its fax goes out is never sent.
No automatic re-send — a fax whose outcome is unknown is parked until a person checks the provider’s sent list and records the result with their PIN; a fax id is checked with the provider before it is accepted.
A fax to nobody’s number — a fax that arrives on a number no service owns reaches only the platform operator. No service can see it.
The provider’s copy — the fax provider’s copy of a received fax is deleted only after the platform’s encrypted copy has been stored and read back to check it.

Security & PHIPA

Built to pass your security review

Every safeguard below is in the product today — not on a roadmap. The platform database is hosted in Canada, encrypted and isolated per service, with every access logged.

Encrypted at rest (AES-256-GCM)on every route that touches health information — the database only ever holds ciphertext, hosted in Canada.

Two-factor sign-insupervisors and admins add an authenticator app in about a minute — scan a code, done. A service can make it mandatory for everyone, and anyone who turns it on is walked through setup at their next sign-in.

Locked out? Still coveredprintable single-use backup codes that work with no signal, and any duty supervisor can read a one-time code down the phone to a medic whose phone died mid-shift. Both are single-use, time-limited and recorded against the supervisor who issued them.

Encrypted off-site backupsthe database is backed up nightly, encrypted so that the server itself cannot read its own backups — only the key held off-site can. Restores are rehearsed, not assumed.

Searchable without exposing PHIblind-index (keyed-HMAC) matching over encrypted fields, so a name lookup never decrypts the database.

Per-service isolationone service can never see another service's records.

PHI never travels in a URLbetween the browser or iPad and the platform, records and health-card lookups move only in encrypted POST bodies over HTTPS.

Brute-force lockoutfive failed PIN attempts locks the signer for 15 minutes; signing PINs are never stored in the clear.

Clean hand-off between medicsevery open patient panel is force-closed at sign-in, so the next crew never sees the last patient.

Charts for clinical roles only, enforced server-sidescheduling and office staff are hard-blocked from charts — a scheduler can never open one. A service can let office staff sort the CP fax inbox, whose client lookup opens no chart.

Every access auditedreads, searches, signatures, overrides and disclosures are all logged — and viewing the audit log is itself audited.

A tamper-evident audit logevery entry is hash-chained to the one before it, and the log is append-only at the database level — rows cannot be edited or deleted, not even by the application. Periodic head hashes are written outside the database, so the chain can be checked against a witness the server does not control.

Backups that are restore-tested, not just takenthe nightly encrypted backup is restored end to end and the result written down — tables compared, the audit chain re-verified inside the restored copy, and the encrypted patient data decrypted to prove it is still readable. A backup nobody has restored is a hypothesis.

Nightly integrity checksan automated sweep re-verifies the chart hashes and looks for anything that should be encrypted and is not — a write path that skipped encryption would otherwise be invisible, because unreadable and readable data look identical on screen.

Session controlan administrator resetting a password ends that person's live sessions everywhere, immediately — not at the next expiry. Sessions are capped and re-checked on every request.

Retention and disposal, per recordretention is set by the service and enforced by the database, with legal holds that survive it. Disposal is deliberate and recorded — nothing is quietly deleted on a timer.

Disclosure by designsingle-use, expiring, revocable pickup links with the access code texted separately; the disclosure log doubles as your PHIPA accounting of disclosures.

Proven at scale

A million charts, and the bedside answer still lands in milliseconds

When a medic arrives at a patient, the platform checks whether that person has been seen before — previous 911 calls, and whether they are an active Community Paramedicine client. That lookup is worthless if it is slow, and dangerous if it is wrong. So it was measured against a million charts, seeded with the platform's own encryption, on the ordinary two-core server the platform runs on — with the live application running beside it.

Lookup	Median	99th percentile	Worst seen
By health card, against a 700,000-chart service	0.72 ms	2.52 ms	6.72 ms
By name + date of birth	0.62 ms	1.83 ms	3.94 ms
Full panel — CP check, match and prior-chart summary	1.43 ms	4.30 ms	8.36 ms
…with the access-audit rows written before the answer is released	1.80 ms	4.71 ms	8.42 ms

Under load it holds. With twenty concurrent workers sustaining 1,835 lookups per second against the million-chart service, a second service's worst full-panel answer was still 24.7 ms — three orders of magnitude more pressure than a real fleet applies, and the bedside answer stays instant.

Fast is only half of it. The same run put 23 adversarial cases through the matcher and all 23 held: McDonald never returned a MacDonald chart, twins sharing a birthday stayed ambiguous rather than being merged, one service could never see another's records, unfinished drafts stayed invisible, and an allergy added by a later correction still surfaced. A recognition system that guesses is worse than none — so it is built to return nothing rather than the wrong patient.

Oversight for supervisors — and numbers for the budget meeting.