The hospital’s raw audit trail was recovered from a transaction journal the IT department believed had been erased.
The medication record contained four steps.
1. An order shell was created under Wanjiku’s username. 2. An administrative override opened from terminal ADM-04. 3. The clinical time was manually entered as 2:13. 4. The record was committed at 2:20:43 network time.
“Committed means the system actually saved it then?” Ruth asked.
“Yes,” Malik said.
At 2:20, Wanjiku was paying for water.
Terminal ADM-04 belonged to Gichuru’s office.
Access logs showed him leaving Room Thirteen at 2:18 and entering the administrative block at 2:19.
He could have created the false record one minute later.
The log proved the terminal and account.
It did not yet prove which hand touched the keyboard.
The medication cabinet added another weakness. It had been opened at 2:15 using the head nurse’s shared code.
The head nurse was not on duty.
The code was written inside a drawer because the keypad often locked staff out.
Senior nurses, Brian, Gichuru, and the pharmacy supervisor knew it.
Wanjiku felt exhausted by the number of small conveniences that had become holes.
Personal passwords.
Shared codes.
Unsealed master keys.
Different clocks.
Administrative overrides.
Pauline, the IT administrator, admitted she had left an ADM-04 session open because Gichuru said he was finishing a billing report.
She also acknowledged that a forwarding rule had redirected Wanjiku’s reset messages to a compliance mailbox.
When Ruth summoned Gichuru again, he claimed he used the override after the death to correct an incomplete clinical record.
“Which nurse supplied the information?”
“I do not remember.”
“Why did you enter 2:13?”
“It was on the screen.”
“Which screen?”
He could not say.
He then claimed Wanjiku had told him by phone that she administered the drug.
Phone and internal-extension logs showed no such call.
Every record that contradicted him became “incomplete”.
Ruth placed the M-27 technical-review signature in front of him.
“I gave a legal consultancy opinion.”
Bank records showed Kibo paying Gichuru’s consultancy company after several complaint closures.
“Did you declare the conflict to the county?”
No form existed.
Gichuru was not arrested that day. The court retained his passport and ordered him not to contact witnesses.
Outside, the media reported that police lacked enough evidence to charge him.
Wanjiku was furious.
“The audit shows his terminal falsified my record.”
“It shows opportunity, location, and manipulation,” Achieng said. “The prosecution still has to identify the user and connect the physical act.”
That evening, Mwangaza’s board met.
Two directors wanted Gichuru suspended.
The chair argued that suspension would look like an admission of hospital liability.
Gichuru joined by video from “sick leave” and called the override a routine correction.
A director asked for the source of the clinical time.
“Verbal handover,” Gichuru said.
From whom?
He gave no name.
The board granted voluntary leave but left his email access active.
That night somebody attempted to delete the compliance mailbox. Cloud retention prevented permanent destruction.
The regulator finally ordered Gichuru’s access suspended.
Wanjiku understood that high-level permission was not merely a password.
It was a room full of people afraid to tell an executive:
No. You cannot continue accessing the system you are accused of abusing.
Then the ambulance medic was found.
He remembered another man at the crash scene wearing a Kibo jacket. The man removed something from Jonah’s pocket and called Gichuru before the ambulance left.
Under a proper identification procedure, the medic selected Peter Mwangi, Kibo’s operations officer and Kelvin’s cousin.
Peter had been near the crash.
Gichuru’s terminal had created the record.
Brian had drawn Faith away.
The chain was tightening.
The final hand inside Room Thirteen was still hidden.