Explaining accesses to electronic medical records using diagnosis information

Area of Science:

• Health Informatics
• Computer Science
• Medical Security

Background:

• Ensuring patient health information security in electronic medical records (EMR) systems is a significant challenge.
• Existing auditing systems often generate numerous alerts, overwhelming compliance officers.

Purpose of the Study:

• To enhance the Explanation-Based Auditing System (EBAS) by incorporating patient diagnosis information to determine the reason for EMR access.
• To filter explained accesses, thereby reducing the manual review burden for compliance officers.

Main Methods:

• Developed metrics to identify hospital employees responsible for specific patient diagnoses and quantify their confidence levels.
• Integrated diagnosis-based responsibility information into the EBAS to infer the reason behind medical record access.
• Evaluated the system's classification performance using data from the University of Michigan Health System.

Main Results:

• The enhanced EBAS accurately identifies departments responsible for specific diagnoses.
• The system explains over 94% of all accesses with high precision.
• The number of explained first accesses increased by a factor of two compared to previous methods.

Conclusions:

• The enhanced EBAS functions as a valuable security tool for protecting personal health information.
• By filtering a majority of accesses, the system makes manual review of remaining suspicious activities more feasible for compliance officers.