The Compliance Officer reviews access patterns, attests periodic access reviews and verifies that consent records match what patients signed.
Accountability over convenience
Every PHI read and write should be reconstructable from the audit trail. Their job is to catch the access that shouldn’t have happened — not to block care.