Flagging and Ranking Suspicious Accesses in Electronic Health Record Systems.

Abstract

Hospitals are facing steep challenges to protect privacy of patient data in Electronic Health Records (EHR) from insider threats. To achieve fast detection of insider misuse and reduce further harm, large hospitals need automated suspicious access detection mechanisms. Currently, the use of rule-based auditing systems is prevalent across several healthcare organizations. However, rule-based auditing systems have not been evaluated empirically. Hence in this work, we first propose a principled approach to evaluate the effectiveness of rule-based methods in identifying suspicious behavior. Furthermore, rule-based auditing systems rely on predefined rules and are oblivious to the statistical properties of the EHR data. To this end, we propose an auditing method based on supervised machine learning techniques which utilizes clinical context to identify suspicious behavior. Experiment results show the effectiveness of our approach to identify suspicious behavior in EHR systems.