Strengthening Long-Term Care Audits with Cryptographically Verifiable EHR and eMAR Data

Long-term care (LTC) providers operate in one of the most highly regulated environments in healthcare. Every medication order, administration, reconciliation, and pharmacy return contributes to the resident’s medical record and may later become evidence during surveys, audits, legal proceedings, or internal investigations.

Yet most facilities still rely on traditional audit logs maintained by individual applications. While these logs are valuable, they generally depend on the integrity of the system that generated them. Demonstrating that records have remained unaltered across multiple systems can become difficult months or years after an event occurred.

Stratosphere PACT (Proof & Attestation Compliance Toolkit) addresses this challenge by providing independently verifiable proof that clinical events existed at a specific point in time and have not been modified since they were recorded.

The Challenge of Distributed Clinical Records

Medication management in a skilled nursing or assisted living facility involves several independent systems and organizations.

A single medication order may involve:

• The facility’s EHR
• The eMAR
• A pharmacy management platform
• Automated dispensing systems
• Nursing documentation
• Laboratory systems
• Billing systems
• External pharmacies

Each system produces its own event history. During an audit, compliance staff often spend considerable time collecting records from multiple sources, verifying timestamps, and demonstrating that the sequence of events accurately reflects resident care.

Although each application may maintain audit logs, auditors frequently must trust that the underlying databases have remained unchanged.

PACT introduces an additional layer of assurance by creating tamper-evident evidence that spans all participating systems.

A Unified Clinical Event Ledger

Rather than replacing existing EHR or eMAR platforms, PACT acts as an independent evidence layer.

As clinical events occur, participating applications submit canonical event records to PACT through secure APIs or integration engines such as HL7 interfaces. PACT normalizes these events into a consistent format while preserving the originating system identifiers.

Examples include:

• Medication ordered
• Order modified
• Medication discontinued
• Pharmacy verification
• Medication dispensed
• Medication received
• Medication administration
• Missed dose
• Medication refusal
• PRN administration
• Medication reconciliation
• Medication returned to pharmacy
• Medication waste
• Controlled substance count
• Resident discharge

Each event receives a cryptographic fingerprint generated from its canonical contents.

Because the fingerprint is deterministic, any future modification—even changing a single character—produces an entirely different cryptographic hash.

Medication Reconciliation as a Verifiable Timeline

Medication reconciliation is one of the most audit-intensive clinical workflows.

Residents frequently transition between hospitals, rehabilitation centers, long-term care facilities, physician offices, and pharmacies. Each transition introduces opportunities for medication discrepancies.

Traditional reconciliation depends on comparing medication lists across systems.

PACT extends this process by preserving a cryptographically verifiable sequence of reconciliation events.

For example:

1. Hospital discharge medications are imported into the facility EHR.
2. The attending physician reviews and modifies medication orders.
3. Pharmacy verification occurs.
4. The medication becomes active within the eMAR.
5. Nursing staff administer scheduled doses.
6. Subsequent physician changes update the medication profile.
7. Discontinued medications are documented.
8. Remaining medication is returned to the pharmacy.
9. Final reconciliation occurs upon discharge or transfer.

Each step becomes part of a continuously verifiable evidence chain.

During an audit, compliance personnel can demonstrate not only what actions occurred, but also that the sequence itself has remained intact since it was originally recorded.

Aggregating Medication Events Across Systems

Medication management generates events from multiple independent applications.

Rather than treating these as isolated audit logs, PACT aggregates them into a single chronological evidence stream.

A simplified workflow may resemble the following:

Medication Order

The physician enters an order within the EHR. An HL7 ORM message or equivalent API event is generated and submitted to PACT.

Pharmacy Processing

The pharmacy receives the order, validates it, dispenses medication, and generates fulfillment events.

These events are independently submitted to PACT while preserving pharmacy identifiers and timestamps.

Medication Administration

The nurse administers the medication using the eMAR.

Administration details—including resident, medication, dosage, route, administration time, clinician, and outcome—are recorded as separate immutable events.

Order Changes

Dose adjustments, holds, discontinuations, or physician modifications become additional events rather than replacements for previous records.

The historical timeline remains preserved.

Medication Returns

Unused medication returned to the pharmacy generates return events documenting:

• Medication identifier
• Quantity returned
• Return reason
• Date and time
• Receiving pharmacy
• Associated resident
• Original medication order

These return events become linked within the same evidence chain.

Instead of producing disconnected audit records, PACT establishes a comprehensive chronology covering the medication’s lifecycle—from prescription through administration and final disposition.

Independent Cryptographic Evidence

PACT does not rely solely on database timestamps.

Every clinical event contributes to an append-only cryptographic data structure (a Merkle Mountain Range), where each event affects subsequent cryptographic roots. At configurable intervals, these roots can be anchored to a public blockchain such as Bitcoin.

This creates independently verifiable evidence that:

• The event existed before the anchor time.
• The event has not been altered since.
• Missing, modified, or substituted records are detectable.
• Evidence can be verified independently without relying solely on the originating application.

This approach allows healthcare organizations to demonstrate integrity rather than merely asserting it.

Supporting Regulatory Audits

During surveys or compliance reviews, facilities often must produce documentation supporting:

• Medication administration records
• Medication reconciliation activities
• Controlled substance management
• Physician orders
• Pharmacy communications
• Resident transfers
• Clinical documentation timelines

PACT enables organizations to generate evidence packages that include:

• Original clinical event metadata
• Event timestamps
• Cryptographic proofs
• Verification paths
• Evidence attesting that records remain unchanged since their original capture

Because the evidence is cryptographically verifiable, auditors can independently validate the integrity of the records without requiring privileged access to production databases.

Integrating with Existing Clinical Systems

PACT is designed to complement—not replace—existing healthcare infrastructure.

Organizations can integrate PACT with:

• Electronic Health Records (EHR)
• Electronic Medication Administration Records (eMAR)
• Pharmacy management systems
• HL7 integration engines
• Laboratory systems
• Clinical documentation platforms
• Internal compliance applications

Facilities continue using their existing workflows while PACT silently builds a tamper-evident evidence layer in the background.

Moving Beyond Traditional Audit Logs

Healthcare organizations have invested heavily in EHR and eMAR technologies that accurately document resident care. The next step is ensuring those records remain independently verifiable throughout their lifecycle.

By aggregating medication orders, pharmacy activity, administration records, medication reconciliation, and return-to-pharmacy events into a unified cryptographic evidence chain, PACT enables long-term care providers to strengthen regulatory readiness, streamline investigations, and increase confidence in the integrity of their clinical data.

For organizations seeking stronger audit readiness without disrupting existing clinical workflows, PACT provides an additional layer of trust—one built on verifiable evidence rather than assumption.