Can you tell us who accessed what, if it ever came to that?

Two different layers, and it is worth understanding which is which.

At the system level we log authentication, administrative actions, file access on monitored systems, and access to cloud services, and those logs feed our security monitoring. That tells you which account did what and from where.

Inside your practice management, case management, or line of business application, the audit trail belongs to that software. Most business-critical applications have one. What we do is make sure it is switched on, because it frequently is not by default, and that its records are retained long enough to be useful rather than rolling over in thirty days.

Both layers are defeated by the same thing: shared logins. If four people at your front desk use one account, every log you own says that account did it, and you cannot answer the question that matters. That is a common finding and a genuinely awkward one to fix after the fact, because the answer is individual accounts and some staff will initially find it inconvenient. It is worth the friction, and in a regulated environment it is not really optional.