USE CASE · AUDIT EVIDENCE & DEFENSIBLE PROGRAMS
Walk into the audit with the evidence already assembled.
Supported screening and data queries can return dated source metadata. Separate snapshot-attestation records expose signatures where present; no claim-level signature linkage is asserted.
Source + observation dateAttestation coverage disclosedSource-specific historyMethodology versioned
✓ No PHI✓ Fonteum does not currently hold SOC 2✓ Named-source limitations✓ JSON · CSV · PDF
The enforcement reality
The audit is not whether you checked. It is whether you can prove it.
The April 2023–March 2026 CMS Care Compare table spans , with . Separately, cover . When enforcement lands, the question is not whether you ran a screen — it is whether you can produce the dated, sourced records your program actually retained.
A screenshot or a spreadsheet cell may not survive that question. Where a concrete attestation object exists, its digest can test the integrity of that identified object; it does not sign every fact in the surrounding report.
The developer pain
Reconstructing evidence months after the fact.
When the audit request arrives, teams scramble to reconstruct what a record said at decision time — but the source file has since changed, the join logic moved, and there is no log of the methodology in force back then. The evidence is rebuilt, not retrieved, and a rebuilt record is contestable.
An audit-pack export returns the named records available for the requested identifiers, plus source, snapshot, methodology, and attestation fields where supplied. Missing history or provenance fields remain explicit rather than being reconstructed.
How it works
Four properties that make a record defensible.
When
Timestamp
A response can state its observation time separately from the source release date. Availability varies by route.
What
Source + snapshot
Supported fields name their source and available source date; missing dates remain explicit rather than inferred.
How
Methodology version
Methodology versions describe processing rules. Reproduction also requires the named source release and retained inputs.
Proof
Attestation scope
Snapshot attestations expose recorded digest, signature, and chain fields where present. They do not create a deterministic signature link for every fact.
Integration & workflow
One evidence trail. Two ways in.
Developers pull a scoped audit pack over REST. Compliance teams retain its source dates and attach a snapshot attestation only when the response supplies one.
GET /api/v1/audit-pack/export
curl "https://fonteum.com/api/v1/audit-pack/export?ccn=115001&format=json" \
-H "Authorization: Bearer $FONTEUM_API_KEY" \
-H "Accept: application/json"Response
{
"data": {
"metadata": {
"schema_type": "fonteum-audit-pack-export",
"schema_version": "1.0",
"ccn": "115001",
"source_inventory": []
},
"record": {
"ccn": "115001",
"pos_qa_status": "ok"
},
"delta_log": null,
"delta_log_status": null,
"delta_log_reason": null
},
"meta": {
"request_id": "<generated request id>",
"api_version": "v1",
"data_freshness": []
}
}Export support and source coverage are route-specific. A facility or provider pack includes the named sources available for its identifiers; it is not asserted to join every registry source.
- 01Define the program: which sources you screen and enrich against, and on what cadence.
- 02Retain the UTC observation time and source date when the response supplies them.
- 03Assemble the named records available for the requested provider or facility.
- 04Attach snapshot-attestation metadata only when the pack supplies a concrete object reference.
- 05State missing sources, dates, history, and signature linkage as limitations.
Sample audit-evidence artifact
AUDIT PACK — RESPONSE TEMPLATE
Scope ............... requested CCN
Generated (UTC) ..... data.metadata.generated_at
Sources available ... data.metadata.source_inventory
Facility record ..... data.record
Delta history ....... data.delta_log (null unless requested/available)
Freshness fields .... meta.data_freshness (source-specific)
Signature linkage ... no universal provenance-row linkage asserted
Limitation .......... confirm consequential facts at the named sourceWhen an attestation is supplied, retain its object identifier, digest, and signature fields with the report. Claim-level linkage must not be inferred from a separate snapshot record.
Proof — not logos
The evidence layer is itself auditable.
Methodology
Every methodology version is published and pinned per record, so an auditor can read exactly how the figure was derived.
Ed25519
Witness coverage
Some snapshot-attestation rows carry witness signatures and chain links. Live counts and coverage limitations are published on the chain page.
100%
Public corrections
Every correction is logged publicly with a date. The defensibility comes from radical transparency, not from claiming we are never wrong.
Public-domain sources
All evidence draws on public federal records. No PHI, no scraped data, no proprietary black box an auditor cannot inspect.
“The artifact your compliance officer attaches to the response — not a vendor statement that something was checked.”
AUDIT EVIDENCE
Assemble the evidence pack before the audit asks for it.
Questions
Before the security questionnaire.
What makes this defensible in an audit?
Three things an auditor asks for are when the check ran, which source release supported it, and what integrity metadata exists. Fonteum exposes those fields where the route supplies them; no deterministic fact-to-signature link is currently asserted.
Can an auditor confirm the evidence without trusting Fonteum?
When an attestation row is supplied, an auditor can inspect its digest, signature, object identifier, and chain fields against the published public key. That check covers the identified attestation object, not every fact in the response.
What if a source changes after I pulled it?
A response can retain its source and observation dates. Row-level point-in-time reconstruction is available only for named sources that bank historical versions; a snapshot-attestation row alone does not reconstruct every source record.
What is in an audit pack?
A facility- or provider-scoped export can include the named sources available for its identifiers, along with source dates, methodology fields, and an attestation reference when present. Formats and coverage are route-specific.
Is this a SOC 2 control?
Fonteum does not currently hold SOC 2. The provenance and attestation layer maps to change-management and integrity controls, and the public correction log records every change. The audit pack is the evidence artifact your own controls can point to.
Go deeper
The provenance layer behind the evidence.
Solutions
All solutions — by use case & buyer →
Guide
Exclusion & sanctions screening — the full guide →
Trust
Methodology & versioning →
Trust
Data provenance & the attestation chain →
Trust
Public corrections log →
Capability
Point-in-time snapshots →
Resource
Download the diligence kit (one PDF) →
Data catalog
Nursing-home deficiencies and enforcement data →
Use case
Exclusion & sanctions screening →
Use case
Credentialing & provider-data enrichment →
For compliance
Fonteum for compliance & risk teams →
FONTEUM · AUDIT EVIDENCE
Build a defensible program on public data only. No PHI.