Correct. Everything you do in an EHR system is logged. It is part of HIPAA. Once all privacy was removed and records could be accessed by anyone (and yes that is what the "privacy" law did - whatever name a government program or law has, think the opposite), the one thing left for patients was an audit trail they could request in the event they suspected that their records had been accessed inappropriately or by an unauthorized entity.