Methods and systems for analyzing accessing of medical data
Various aspects described herein relate to presenting electronic patient data accessing information. Data related to a plurality of access events, by one or more employees, of electronic patient data can be received. A set of access events of the plurality of access events can be determined as constituting, by the one or more employees, possible breach of the electronic patient data. An alert related to the set of access events can be provided based on determining that the set of access events constitute possible breach of the electronic patient data.
1. A computer-implemented method for displaying an indication of non-compliant access to an electronic medical record (EMR) on a user interface, the method comprising:
receiving, by one or more processors of a patient privacy monitoring system, access data from at least one EMR access log, at least one EMR, and human resources (HR) data associated with one or more employees of a healthcare organization, the at least one EMR access log comprising a plurality of access events;
filtering, by the one or more processors, the plurality of access events based on one or more whitelist events, the one or more whitelist events indicating one or more acceptable access events;
constructing, by the one or more processors, fingerprint data for the one or more employees based on the plurality of filtered access events, the fingerprint data representing one or more patterns of access by the one or more employees based on the access data associated with the one or more employees;
determining, by the one or more processors, at least one access event of the plurality of filtered access events that constitutes a potential breach by:
detecting the one or more patterns of access by the one or more employees based on the fingerprint data; and
determining whether the at least one access event is inconsistent with the one or more patterns; and
generating, by the one or more processors, a first user interface displaying an alert, wherein the alert comprises a description of the at least one access event, wherein the alert facilitates further investigation by causing the first user interface to display additional information of the at least one access event.
2. The computer-implemented method of claim 1 , the determining the at least one access event of the plurality of filtered access events that constitutes the potential breach including:
applying one or more rules to the fingerprint data to determine that the at least one access event is the potential breach.
3. The computer-implemented method of claim 2 , the one or more rules corresponding to one or more tags, each of the one or more tags indicating one or more detectable events in the fingerprint data.
4. The computer-implemented method of claim 3 , the one or more tags including at least one negative tag indicating the potential breach or at least one neutral tag that alone does not indicate the potential breach.
5. The computer-implemented method of claim 1 , the fingerprint data including at least one of: a daily encounter collection list of the one or more employees, an EMR access collection list of accesses of an EMR for multiple time periods throughout a day, a daily list of accesses of the EMR, a patient encounter collection list, or a synthetic department access collection list.
6. The computer-implemented method of claim 5 , wherein the synthetic department access collection list is based at least in part on detecting a type of EMR data that is most frequently accessed by the one or more employees.
7. The computer-implemented method of claim 1 , the filtering further comprising:
excluding, by the one or more processors, one or more of the plurality of filtered access events that correspond to the one or more whitelist events, the one or more whitelist events including at least one legitimate authorized access event.
8. The computer-implemented method of claim 7 , wherein the one or more whitelist events include at least one of an appointment entry, a procedure or medication entry related to ordering a procedure or a medication for a patient, an allergy information update, a patient check-in, or a primary care provider modification.
9. The computer-implemented method of claim 1 , wherein the HR data includes personal information of the one or more employees.
10. A computer system for displaying an indication of non-compliant access to an electronic medical record (EMR) on a user interface, the system comprising:
one or more processors; and
one or more computer readable storage media storing instructions which, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
receiving access data from at least one EMR access log, at least one EMR, and human resources (HR) data associated with one or more employees of a healthcare organization, the at least one EMR access log comprising a plurality of access events;
filtering the plurality of access events based on one or more whitelist events, the one or more whitelist events indicating one or more acceptable access events;
constructing fingerprint data for the one or more employees based on the plurality of filtered access events, the fingerprint data representing one or more patterns of access by the one or more employees based on the access data associated with the one or more employees;
determining at least one access event of the plurality of filtered access events that constitutes a potential breach by:
detecting the one or more patterns of access by the one or more employees based on the fingerprint data; and
determining whether the at least one access event is inconsistent with the one or more patterns; and
generating a first user interface displaying an alert, wherein the alert comprises a description of the at least one access event, wherein the alert facilitates further investigation by causing the first user interface to display additional information of the at least one access event.
11. The computer system of claim 10 , the determining the at least one access event of the plurality of filtered access events that constitutes the potential breach including:
applying one or more rules to the fingerprint data to determine that the at least one access event is the potential breach.
12. The computer system of claim 11 , the one or more rules corresponding to one or more tags, each of the one or more tags indicating one or more detectable events in the fingerprint data.
13. The computer system of claim 12 , the one or more tags including at least one negative tag indicating the potential breach or at least one neutral tag that alone does not indicate the potential breach.
14. The computer system of claim 11 , the filtering further comprising:
excluding one or more of the plurality of access events that correspond to the one or more whitelist events, the one or more whitelist events including at least one legitimate authorized access event.
15. A non-transitory computer readable medium storing instructions which, when executed by one or more processors, cause the one or more processors to perform operations for displaying an indication of non-compliant access to an electronic medical record (EMR) on a user interface, the operations comprising:
receiving access data from at least one EMR access log, at least one EMR, and human resources (HR) data associated with one or more employees of a healthcare organization, the at least one EMR access log comprising a plurality of access events;
filtering the plurality of access events based on one or more whitelist events, the one or more whitelist events indicating one or more acceptable access events;
constructing fingerprint data for the one or more employees based on the plurality of filtered access events, the fingerprint data representing one or more patterns of access by the one or more employees based on the access data associated with the one or more employees;
determining at least one access event of the plurality of filtered access events that constitutes a potential breach by:
detecting the one or more patterns of access by the one or more employees based on the fingerprint data; and
determining whether the at least one access event is inconsistent with the one or more patterns; and
generating a first user interface displaying an alert, wherein the alert comprises a description of the at least one access event, wherein the alert facilitates further investigation by causing the first user interface to display additional information of the at least one access event.
16. The non-transitory computer readable medium of claim 15 , the determining the at least one access event of the plurality of filtered access events that constitutes the potential breach including:
applying one or more rules to the fingerprint data to determine that the at least one access event is the potential breach.
17. The non-transitory computer readable medium of claim 16 , the one or more rules corresponding to one or more tags, each of the one or more tags indicating one or more detectable events in the fingerprint data.
18. The non-transitory computer readable medium of claim 17 , the one or more tags including at least one negative tag indicating the potential breach or at least one neutral tag that alone does not indicate the potential breach.
19. The non-transitory computer readable medium of claim 15 , the filtering further comprising:
excluding one or more of the plurality of access events that correspond to the one or more whitelist events, the one or more whitelist events including at least one legitimate authorized access event.
20. The non-transitory computer readable medium of claim 15 , wherein the HR data includes personal information of the one or more employees.