HIM 530 Module 4 Access Monitoring Short Paper Example

Before the Patient Complains: Detecting and Deterring Insider Snooping at Osprey Point Health

[Student Name]

Southern New Hampshire University

HIM 530: Information Protection & Security in HIM

Module Four Short Paper

[Instructor Name]

[Date]

The organization, setting and figures below are a composite written as a model document. No real employer, client, colleague or patient is described.

Before the Patient Complains: Detecting and Deterring Insider Snooping at Osprey Point Health

Osprey Point Health learned about both of last year's snooping incidents the same way: a patient called to complain. In one, a registration clerk read her former husband's record during a custody dispute. In the other, three nurses opened the record of a local television anchor admitted after a car accident. The hospital's audit logs contained evidence of both within minutes of the access, but no one was looking. The risk analysis rated insider snooping at 12, a moderate risk. This paper designs a program to find inappropriate access before patients do.

Patterns of Inappropriate Access

Inappropriate access follows recognizable patterns. Employees look up family members, former partners, neighbors and coworkers. They look at patients in the news. They look up their own records instead of using the patient portal. And some access records for gain, such as selling information about accident victims. Jiang and Bai (2019) found that more than half of reported health information breaches traced to causes inside organizations, including unauthorized access by staff. Because insiders use legitimate credentials, the problem is not stopping them from logging in but noticing when an access has no connection to their work.

What Audit Logs Record

Every modern record system keeps audit logs showing which user viewed or changed which part of which record, when and from where. Adler-Milstein et al. (2020) point out that the same logs now feed research on clinical work because they capture each click with its time and user. For privacy monitoring, the same detail allows reviewers to reconstruct exactly what an employee saw. The challenge is volume: Osprey Point's record system logs millions of events each week, nearly all of them appropriate, so reviewing logs by hand is impossible without a way to focus attention.

Rule-Based Alerts

The simplest approach uses rules that flag high-risk patterns. Osprey Point will start with six: an employee accessing a record with the same last name and address; an employee accessing a coworker's record; an employee accessing their own record through the clinical system; access to records flagged as high profile; access to a patient with no current relationship to the employee's department; and access by an employee who has given notice of resignation. Rules are easy to explain and catch many family and coworker cases, but they miss unusual patterns that no rule anticipated and can generate many false alarms.

Statistical and Learning Methods

Research offers ways to find suspicious access that rules miss. Boxwala et al. (2011) built statistical and machine learning models using features of each access, such as whether the patient and employee shared a department or address and how the access compared with typical patterns, and showed that the models could identify suspicious accesses for review. Menon et al. (2014) applied collaborative filtering, the technique behind many recommendation systems, to learn which employees normally access which patients and to flag accesses that did not fit. These methods do not decide guilt; they rank accesses so that reviewers spend time on the most unusual. Osprey Point will evaluate a privacy monitoring tool that uses such methods and pilot it in parallel with the rules for three months, comparing what each finds. The comparison will count true violations each approach catches, false alarms each generates and the analyst hours each consumes, so the decision to buy rests on local evidence rather than a vendor's demonstration.

Triage and Investigation

Alerts must lead to a fair, consistent process. A privacy analyst reviews each alert within two business days and checks for a documented work reason, such as an order, a note or an assignment. Accesses with a clear reason are closed. The rest go to the employee's manager with a request for explanation, and unexplained or inappropriate accesses are referred to the privacy officer for investigation, which includes an interview and a full review of the employee's access history. Every step is documented. The employee's right to explain is essential, since some accesses that look suspicious, such as a nurse checking a patient transferred from her unit, turn out to be legitimate.

Sanctions and Breach Assessment

HIPAA requires covered entities to apply appropriate sanctions to workforce members who violate privacy policies, and Osprey Point's sanctions policy sets levels from retraining for an accidental access to termination for access for personal gain or repeated snooping. Each confirmed case also triggers a breach risk assessment, which considers the nature of the information, who accessed it, whether it was actually viewed and further disclosed and how the risk was mitigated. Because snooping usually involves intentional viewing, most confirmed cases will require notification to the patient, and all are logged for annual reporting to federal regulators if they affect fewer than 500 people.

Deterrence

Detection works best alongside deterrence. Every login screen will display a banner stating that access is monitored and must be for work purposes. Records of high-profile patients, employees and patients who request extra privacy will require a break-the-glass step, in which the user must state a reason before viewing, which both deters curiosity and creates a clear record. Annual training will include anonymized local cases, including last year's incidents, and the privacy office will publish quarterly counts of confirmed violations and sanctions without names, so staff know that monitoring is real.

Measures

The program will be judged by the share of confirmed violations detected by monitoring rather than by complaint, with a target of 90%; the time from access to detection; the number of alerts reviewed within two business days; and the rate of confirmed violations per thousand employees over time, which should fall as deterrence takes hold.

Conclusion

Insider snooping is common, hard to see and easy to find in audit logs once someone looks. Combining simple rules with statistical methods, reviewing alerts through a fair process, applying consistent sanctions and deterring access with banners, break-the-glass prompts and visible results would let Osprey Point find inappropriate access before its patients do, and would show staff that curiosity has consequences.

References

Adler-Milstein, J., Adelman, J. S., Tai-Seale, M., Patel, V. L., & Dymek, C. (2020). EHR audit logs: A new goldmine for health services research? Journal of Biomedical Informatics, 101, Article 103343. https://doi.org/10.1016/j.jbi.2019.103343

Boxwala, A. A., Kim, J., Grillo, J. M., & Ohno-Machado, L. (2011). Using statistical and machine learning to help institutions detect suspicious access to electronic health records. Journal of the American Medical Informatics Association, 18(4), 498-505. https://doi.org/10.1136/amiajnl-2011-000217

Jiang, J. X., & Bai, G. (2019). Evaluation of causes of protected health information breaches. JAMA Internal Medicine, 179(2), 265-267. https://doi.org/10.1001/jamainternmed.2018.5295

Menon, A. K., Jiang, X., Kim, J., Vaidya, J., & Ohno-Machado, L. (2014). Detecting inappropriate access to electronic health records using collaborative filtering. Machine Learning, 95(1), 87-101. https://doi.org/10.1007/s10994-013-5376-1