Learning relational policies from electronic health record access logs

Area of Science:

• Health Informatics
• Data Mining
• Social Network Analysis

Background:

• Healthcare organizations (HCOs) face challenges in defining access control policies due to complex team dynamics and the fluid nature of clinical operations.
• Manual policy creation is labor-intensive, error-prone, and can lead to inappropriate access levels, compromising patient privacy or hindering legitimate care.
• Existing systems struggle to balance patient privacy with the need for timely access to medical records by healthcare providers.

Purpose of the Study:

• To propose an automated method for generating access control policies in healthcare organizations by mining usage patterns from electronic health record (EHR) systems.
• To develop a generalizable approach that assists in the design and evaluation of local access control policies across different HCOs.
• To provide a technique that enables the review of existing policies and the discovery of previously unknown user behaviors within EHR systems.

Main Methods:

• Utilizing data mining and social network analysis theory to extract a statistical model of the organization from EHR access logs.
• Analyzing 5 months of access logs from Vanderbilt University Medical Center to evaluate the proposed technique.
• Identifying stable social structures and business operations within the healthcare environment.

Main Results:

• Confirmed the existence of stable social structures and intuitive business operations within the analyzed healthcare data.
• Demonstrated significant turnover in user interactions within the healthcare organization.
• Showed that policies learned at the department level offer greater long-term stability.

Conclusions:

• Automated policy generation from EHR usage patterns offers a viable alternative to manual methods, improving efficiency and accuracy.
• The proposed technique effectively models organizational behavior and identifies both established and emergent interaction patterns.
• Department-level policy learning provides a more stable and manageable approach to access control in dynamic healthcare environments.