Methods and systems for analyzing accessing of medical data
Various aspects described herein relate to presenting electronic patient data accessing information. Data related to a plurality of access events, by one or more employees, of electronic patient data can be received. A set of access events of the plurality of access events can be determined as constituting, by the one or more employees, possible breach of the electronic patient data. An alert related to the set of access events can be provided based on determining that the set of access events constitute possible breach of the electronic patient data.
1. A computer-implemented method for displaying an indication of non-compliant access to an electronic medical record (EMR) on a user interface, the computer-implemented method comprising:
receiving, by one or more processors, electronic data from one or more of a plurality of data sources, the electronic data comprising access data associated with a plurality of EMRs;
identifying, by the one or more processors, a plurality of access events by a plurality of employees to one or more EMRs of the plurality of EMRs;
detecting, by the one or more processors, commonalities among the access events of two or more employees of the plurality of employees that have accessed one or more EMRs of the plurality of EMRs in the electronic data, machine-learning commonalities in the electronic data, or network analyzing commonalities in the electronic data, wherein the commonalities are determined based on computing statistical inferences between the plurality of access events;
clustering, by the one or more processors, a portion of the plurality of access events based on detecting commonalities among two or more employees of the plurality of employees that have accessed one or more EMRs of the plurality of EMRs in the electronic data;
based on the clustering, determining, by the one or more processors, at least one pattern of access associated with one or more employees of the plurality of employees;
detecting, based on the at least one pattern of access and by the one or more processors, at least one access event of the plurality of access events that is inconsistent with the at least one pattern of access;
determining, by the one or more processors, that the at least one access event constitutes a possible breach of the EMR based on the at least one access event being inconsistent with the at least one pattern of access; and
transmitting, by the one or more processors and to a display of a first user interface, an alert associated with the at least one access event,
wherein the alert comprises an indicator of the at least one access event and wherein interacting with the indicator causes a display of additional information corresponding to the at least one access event facilitating further investigation of the at least one access event.
2. The computer-implemented method of claim 1 , wherein the alert is selectable by a user via the first user interface.
3. The computer-implemented method of claim 2 , further comprising:
receiving, by the one or more processors, a selection of the alert by the user; and
generating, by the one or more processors, a second user interface in response to the selection of the alert, wherein the second user interface displays a set of data points representing the plurality of access events, including the at least one access event, in association with corresponding employees and times of access.
4. The computer-implemented method of claim 3 , wherein the clustered portion of the plurality of access events are displayed as being correlated and the at least one access event is displayed as being isolated.
5. The computer-implemented method of claim 1 , wherein determining that the at least one access event is inconsistent with the at least one pattern of access comprises determining that a degree of deviation of the at least one access event from the at least one pattern of access is greater than a predefined threshold, wherein the predefined threshold is one of: access duration; access location; and access time.
6. The computer-implemented method of claim 1 , wherein the commonalities include at least one of: EMR accessing times by an employee of the plurality of employees; groups of employees of the plurality of employees accessing a same medical record; or an order in which employees access the same medical record.
7. The computer-implemented method of claim 3 , further comprising:
receiving, by the one or more processors, a selection of a data point of the set of data points on the second user interface; and
causing to display, by the one or more processors, on the second user interface, at least one of: employee identification information, at least one action associated with the at least one access event, and at least one note associated with a patient associated with the one or more EMRs.
8. A system for displaying an indication of non-compliant access to an electronic medical record (EMR) on a user interface, the system comprising:
at least one processor; and
at least one storage device comprising instructions which, when executed by the at least one processor, cause the at least one processor to perform operations comprising:
receiving electronic data from one or more of a plurality of data sources, the electronic data comprising access data associated with a plurality of EMRs;
identifying a plurality of access events by a plurality of employees to one or more EMRs of the plurality of EMRs;
detecting commonalities among two or more employees of the plurality of employees that have accessed one or more EMRs of the plurality of EMRs in the electronic data, machine-learning commonalities in the electronic data, or network analyzing commonalities in the electronic data, wherein the commonalities are determined based on computing statistical inferences between the plurality of access events;
clustering a portion of the plurality of access events based on detecting commonalities among two or more employees of the plurality of employees that have accessed one or more EMRs of the plurality of EMRs in the electronic data;
based on the clustering, determining at least one pattern of access associated with one or more employees of the plurality of employees;
detecting, based on the at least one pattern of access, at least one access event of the plurality of access events that is inconsistent with the at least one pattern of access;
determining that the at least one access event constitutes a possible breach of the EMR based on the at least one access event being inconsistent with the at least one pattern of access; and
transmitting, to a display of a first user interface, an alert associated with the at least one access event,
wherein the alert comprises an indicator of the at least one access event and wherein interacting with the indicator causes a display of additional information corresponding to the at least one access event facilitating further investigation of the at least one access event.
9. The system of claim 8 , wherein the alert is selectable by a user via the first user interface.
10. The system of claim 9 , the operations further comprising:
receiving a selection of the alert by the user; and
generating a second user interface in response to the selection of the alert, wherein the second user interface displays a set of data points representing the plurality of access events, including the at least one access event, in association with corresponding employees and times of access.
11. The system of claim 10 , wherein the clustered portion of the plurality of access events are displayed as being correlated and the at least one access event is displayed as being isolated.
12. The system of claim 8 , wherein determining that the at least one access event is inconsistent with the at least one pattern of access comprises determining that a degree of deviation of the at least one access event from the at least one pattern of access is greater than a predefined threshold, wherein the predefined threshold is one of: access duration; access location; and access time.
13. The system of claim 8 , wherein the commonalities include at least one of: EMR accessing times by an employee of the plurality of employees; groups of employees of the plurality of employees accessing a same medical record; or an order in which employees access the same medical record.
14. The system of claim 10 , the operations further comprising:
receiving a selection of a data point of the set of data points on the second user interface; and
causing to display, on the second user interface, at least one of: employee identification information, at least one action associated with the at least one access event, and at least one note associated with a patient associated with the EMR.
15. A non-transitory computer readable medium storing instructions which, when executed by at least one processor, cause the at least one processor to perform operations for displaying an indication of non-compliant access to an electronic medical record (EMR) on a user interface, the operations comprising:
receiving electronic data from one or more of a plurality of data sources, the electronic data comprising access data associated with a plurality of EMRs;
identifying a plurality of access events by a plurality of employees to one or more EMRs of the plurality of EMRs;
detecting commonalities among two or more employees of the plurality of employees that have accessed one or more EMRs of the plurality of EMRs in the electronic data, machine-learning commonalities in the electronic data, or network analyzing commonalities in the electronic data, wherein the commonalities are determined based on computing statistical inferences between the plurality of access events;
clustering a portion of the plurality of access events based on detecting commonalities among two or more employees of the plurality of employees that have accessed one or more EMRs of the plurality of EMRs in the electronic data;
based on the clustering, determining at least one pattern of access associated with one or more employees of the plurality of employees;
detecting, based on the at least one pattern of access, at least one access event of the plurality of access events that is inconsistent with the at least one pattern of access;
determining that the at least one access event constitutes a possible breach of the EMR based on the at least one access event being inconsistent with the at least one pattern of access; and
transmitting, to a display of a first user interface, an alert associated with the at least one access event,
wherein the alert comprises an indicator of the at least one access event and wherein interacting with the indicator causes a display of additional information corresponding to the at least one access event facilitating further investigation of the at least one access event.
16. The non-transitory computer readable medium of claim 15 , wherein the alert is selectable by a user via the first user interface.
17. The non-transitory computer readable medium of claim 16 , the operations further comprising:
receiving a selection of the alert by the user; and
generating a second user interface in response to the selection of the alert, wherein the second user interface displays a set of data points representing the plurality of access events, including the at least one access event, in association with corresponding employees and times of access.
18. The non-transitory computer readable medium of claim 17 , wherein the clustered portion of the plurality of access events are displayed as being correlated and the at least one access event is displayed as being isolated.
19. The non-transitory computer readable medium of claim 15 , wherein determining that the at least one access event is inconsistent with the at least one pattern of access comprises determining that a degree of deviation of the at least one access event from the at least one pattern of access is greater than a predefined threshold, wherein the predefined threshold is one of: access duration; access location; and access time.
20. The non-transitory computer readable medium of claim 15 , wherein the commonalities include at least one of: EMR accessing times by an employee of the plurality of employees; groups of employees of the plurality of employees accessing a same medical record; or an order in which employees access the same medical record.