Most inappropriate access to patient records is done by staff with valid logins, so perimeter security never sees it and only monitoring of what clinicians and support staff actually open and dispense will catch it. Hospitals must give broad, fast access to electronic health records (EHR) because care cannot wait for approvals, and that openness is exactly what lets curious, malicious or addicted insiders look up neighbours, celebrities and colleagues or divert controlled drugs. This guide covers how to build a clinical access monitoring programme: the legal duties in the US and UK, which events to collect, the detection rules that find snooping, how diversion analytics link EHR, dispensing cabinet and waste data, and how to investigate fairly. It is for privacy officers, information governance leads, pharmacy diversion teams, security analysts and EHR application owners.
Key takeaways
- Review is a legal duty, not an option: the HIPAA Security Rule requires audit controls (45 CFR 164.312(b)) and procedures to regularly review information system activity (164.308(a)(1)(ii)(D)); in England NHS England now expects monitoring and regular audits of record access.
- Snooping and diversion share data: both are found by comparing a user's activity with a legitimate care relationship, so one analytics pipeline over EHR, dispensing and HR data serves the privacy officer and the diversion officer.
- Rules beat random sampling: targeted rules (same surname, same address, coworker, VIP, deceased, no care relationship) find far more real cases than reviewing random records.
- Break-glass is for emergencies, not convenience: every emergency access to a restricted record should be reviewed, and a rising break-glass rate is a signal in its own right.
- Fairness protects the programme: documented rules, independent investigators, consistent sanctions and prompt reporting keep monitoring defensible with staff, unions and regulators.
What the rules require
The legal basis differs by country, but the expectation is the same: log access, review it, and act on misuse.
| Requirement | Source | What it means for EHR monitoring |
|---|---|---|
| Audit controls | HIPAA 45 CFR 164.312(b) | Mechanisms that record and examine activity in systems containing ePHI; the EHR audit trail must be on and retained |
| Information system activity review | 45 CFR 164.308(a)(1)(ii)(D) | Procedures to regularly review records such as audit logs and access reports |
| Unique user identification | 45 CFR 164.312(a)(2)(i) | Shared logins defeat attribution; each person needs their own account |
| Emergency access procedure | 45 CFR 164.312(a)(2)(ii) | A defined break-glass route that is itself logged and reviewed |
| Sanction policy | 45 CFR 164.308(a)(1)(ii)(C) | Consistent sanctions for workforce members who break policy |
| Theft or significant loss of controlled substances | 21 CFR 1301.76(b) | Notify the DEA Field Division Office in writing within one business day of discovery and file DEA Form 106 within 45 days |
| Security of processing, integrity and confidentiality | UK GDPR Articles 5(1)(f) and 32 | Access controls and audit trails able to detect misuse |
| Offence of obtaining personal data without consent | Data Protection Act 2018 section 170 | Individuals who knowingly or recklessly obtain records without the controller's consent can be prosecuted by the ICO |
NIST SP 800-66 Rev. 2 (final, February 2024) is the US implementation resource for the Security Rule. See the HIPAA Security Rule Guide and the UK GDPR and Data Protection Act 2018 Guide.
Recent enforcement signals
- US: in June 2023 HHS OCR announced a $240,000 settlement with Yakima Valley Memorial Hospital after several security guards accessed the medical records of 419 individuals without a permissible purpose. The corrective action included updated policies and training against snooping.
- UK: in July 2026 NHS England published guidance on preventing, monitoring and investigating unauthorised access and launched a staff campaign. It expects organisations to set up monitoring and regular audits suited to their systems, use record systems that can flag suspicious access in real time, and apply role-based access and MFA. Trade press reported in September 2026 that NHS England had also asked trusts to suspend staff suspected of unlawful access while facts are established; we could not find this on an official NHS England page, so confirm it against NHS England's current guidance.
- UK criminal route: on 17 June 2026 the ICO issued a formal caution under section 170(5) of the Data Protection Act 2018 to a former healthcare professional who offered medical information for financial gain, following a breach reported by the London Clinic in March 2024.
The data you need
Monitoring only works if the right sources are joined. Most EHR platforms keep a detailed audit trail, but it is often retained in the application and never exported.
| Source | Key fields | Used for |
|---|---|---|
| EHR audit trail | User ID, patient ID, timestamp, action (view, print, export, edit), screen or module, workstation | All snooping rules; volume and pattern baselines |
| Care relationship data | Encounters, admissions, care team and treatment team assignments, orders, scheduled appointments | Deciding whether access had a care reason |
| HR and identity data | Employee home address, surname, department, role, manager, start and leave dates, contractor status | Family, neighbour, coworker and role-mismatch rules |
| Patient flags | VIP or restricted status, staff-as-patient flag, deceased date, sensitive record markers | High-risk record rules |
| Automated dispensing cabinet (ADC) data | Withdrawals, returns, waste, overrides, discrepancies, user, location | Diversion analytics |
| Medication administration record (MAR) | Administered dose, time, pain score, patient | Reconciling dispensed against administered and wasted |
| Time and attendance | Shifts and clock-in times | Off-shift access and dispensing |
Retention: export the EHR audit trail to a store the EHR administrators cannot alter, and keep it at least as long as your investigation and legal hold needs. HIPAA's six-year documentation retention rule (164.316) covers policies and review records rather than every log line, so set log retention deliberately.
Detecting snooping
These are the rule families privacy monitoring programmes commonly use. Tune each to your organisation before acting on alerts.
| Rule | Logic | Typical false positives |
|---|---|---|
| Family member | User and patient share a surname and address, or a surname plus rare first-name match in emergency contacts | Common surnames; staff treating relatives in small communities |
| Neighbour | Patient address within the same street or postcode as the user's home | Rural areas where staff live near most patients |
| Coworker | Patient is an employee, especially in the same department | Occupational health and staff clinics |
| Self-access | User opens their own record | Allowed in some policies through a patient portal, not the clinical record |
| VIP or restricted record | Any access to a flagged record without a care relationship | Admissions and registration staff in the first hours |
| No care relationship | No encounter, order or care team link between user and patient | Consults, coders, billing, quality reviewers (role exceptions) |
| Deceased patient | Access after date of death outside records, coding and mortality review | Death certification and audit staff |
| Volume anomaly | User opens many more distinct patients than role peers, or bulk prints and exports | Ward clerks, bed managers, research staff with approvals |
| Media event | Spike in access to a patient in the news, such as a crime victim or public figure | Treating teams, which care relationship data will show |
Behavioural analytics can rank users by how far they deviate from role peers, which helps where rules are noisy. See the UEBA Guide.
Break-glass and restricted records
- Restrict, then allow with a reason: VIP, staff and sensitive records (mental health, sexual health, safeguarding) should require a stated reason before opening.
- Review every break-glass event: within a set time (we suggest two working days) a privacy or clinical reviewer confirms the reason. See the Break-Glass Account Guide.
- Watch the rate: a ward whose break-glass rate climbs is often working around poorly designed role access, which is a fix for the access model, not a disciplinary issue.
Detecting drug diversion
The ASHP Guidelines on Preventing Diversion of Controlled Substances (2022) set out a programme led by an interdisciplinary committee and a designated diversion officer, reporting at least quarterly to senior leadership. They strongly recommend diversion monitoring software with analytics, especially in high-risk or high-volume areas, and review of ADC data at least monthly against medication administration records.
| Signal (from ASHP examples) | Data joined | What it can indicate |
|---|---|---|
| Frequent overrides, unlinked orders, cancelled or null transactions | ADC and orders | Withdrawals without a valid order |
| Delayed or unusual waste documentation; high-waste products | ADC waste and witness records | Substitution or retention of waste |
| Dispenses off the clock, outside the user's area or after discharge | ADC, time and attendance, ADT | Withdrawal with no patient to treat |
| Sole-user activity: one person dispenses, wastes and returns | ADC | No independent check on the chain of custody |
| Dispensing inconsistent with pain scores or patient response | ADC, MAR, nursing assessments | Medication not reaching the patient |
| Repeated unresolved discrepancies | ADC and pharmacy inventory | Loss that may be reportable |
EHR audit link: chart access patterns add context. A user who views patients on other units with active opioid orders, or opens records immediately before overrides, deserves review. This is where privacy and diversion monitoring meet and why they should share a data pipeline.
Response: ASHP recommends treating any unresolvable discrepancy as possible diversion, reporting it to pharmacy immediately and resolving it within 24 to 72 hours, removing the person's access to controlled substances while an investigation runs, and involving personnel outside the area to limit bias. Theft or significant loss triggers the 21 CFR 1301.76(b) notification and DEA Form 106.
Where identity fits
- Unique accounts and fast authentication: shared clinical logins and workstations left signed in break attribution. Tap-and-go badge sign-on keeps unique identity practical at the bedside. See the Healthcare Identity Security Guide and, in England, NHS Spine, smartcards and NHS identity security.
- Joiners, movers and leavers: movers who keep old department access are a frequent root cause of no-care-relationship alerts. Tie EHR roles to HR position data and review them. See the Access Reviews Guide.
- Service and interface accounts: integration engines, reporting tools and research extracts read records at scale under non-human accounts. Exclude them from user rules but monitor them separately for volume and scope changes. See the HL7 v2 and Clinical Interface Engine Security Guide.
Building the programme: a phased plan
- Month 1, governance: agree ownership (privacy officer for snooping, diversion officer for controlled substances, security for platform and data), write the monitoring policy and sanction matrix with HR and staff representatives, and tell staff that access is monitored.
- Months 2 to 3, data: export the EHR audit trail, join care relationship, HR and patient flag data, and confirm field quality (address formats, surname normalisation).
- Months 3 to 4, pilot rules: run the VIP, coworker, family and self-access rules in report-only mode on one site for four weeks; measure the true positive rate and tune exceptions before any investigations start.
- Months 4 to 6, go live and add diversion: start case management with documented triage, then connect ADC, MAR and waste data and the diversion signals.
- Ongoing: retire rules that produce no confirmed cases, add rules for new patterns, and report trends to the board or quality committee quarterly.
Rollback: if a rule floods the queue, return it to report-only rather than switching it off, so trend data continues. Small and large organisations: a small practice or community hospital can start with the EHR's built-in audit reports, monthly VIP and coworker checks and pharmacy reconciliation; a health system with many sites needs dedicated privacy monitoring and diversion analytics, a case management workflow and analysts.
Investigating fairly
- Check the care reason first: confirm whether a consult, transfer, coding task or verbal request explains the access before contacting the user.
- Preserve evidence: export the audit trail entries, screens viewed, workstation and badge events, and ADC transactions to the case file.
- Interview with HR present: give the user a chance to explain, and record the outcome.
- Apply the sanction matrix consistently: curiosity, disclosure and financial gain carry different consequences, as 164.308(a)(1)(ii)(C) expects consistent sanctions.
- Assess reporting duties: a confirmed snoop may be a reportable breach. See the HIPAA Breach Notification Rule Guide. In the UK, consider ICO and regulator referral. Confirmed diversion triggers DEA, licensing board and law enforcement routes defined in your procedures.
Detection and measurement
- Percentage of EHR audit events exported to the monitoring platform (target: 100% of production instances).
- Alerts reviewed within the service level, and the confirmed-case rate per rule.
- Break-glass events reviewed within two working days (our recommended target).
- Median days from alert to case closure.
- Unresolved ADC discrepancies older than 72 hours (ASHP's upper bound for resolution).
- Repeat offenders after sanction, as a measure of deterrence.
Framework mapping
| Activity | NIST SP 800-53 Rev 5 | NIST CSF 2.0 | HIPAA |
|---|---|---|---|
| Generate EHR audit records | AU-12 Audit Record Generation | DE.CM-03 | 164.312(b) |
| Review and analyse access | AU-6 Audit Record Review, Analysis, and Reporting | DE.AE-02 | 164.308(a)(1)(ii)(D) |
| Role-based least privilege | AC-6 Least Privilege; AC-2 Account Management | PR.AA-05 | 164.308(a)(3)(ii)(B) |
| Leavers and sanctions | PS-4 Personnel Termination | PR.AA-05 | 164.308(a)(1)(ii)(C) |
Common failure patterns
- Audit trail on, nobody looking: logs kept inside the EHR for a short period and reviewed only after a complaint.
- Random sampling as the whole programme: a few random record audits a month rarely find snooping; targeted rules do.
- No HR address data: without home addresses and surnames the family and neighbour rules cannot run.
- Privacy and pharmacy in separate silos: diversion teams miss chart-access context and privacy teams miss dispensing anomalies.
- Inconsistent sanctions: senior clinicians treated more leniently than support staff, which undermines the programme and invites challenge.
- Security staff with clinical access: the Yakima Valley case shows that non-clinical roles given EHR access need the same monitoring as clinicians.
Practitioner checklist
- Confirm the EHR audit trail captures view, print and export events and is exported to tamper-resistant storage.
- Join care relationship, HR and patient flag data to the audit trail.
- Run VIP, coworker, family, self-access and no-care-relationship rules, piloted in report-only mode.
- Require a reason for restricted records and review every break-glass event.
- Stand up a diversion committee and officer and review ADC data against the MAR at least monthly.
- Write a sanction matrix with HR and apply it consistently.
- Document reporting routes: HHS OCR, ICO, DEA Form 106, licensing boards and police.
- Monitor interface and reporting service accounts separately from people.
- Report monitoring metrics to leadership quarterly.
Standards and references
- 45 CFR 164.312: Technical safeguards (Cornell LII)
- 45 CFR 164.308: Administrative safeguards (Cornell LII)
- 21 CFR 1301.76: Other security controls for practitioners (Cornell LII)
- NIST: SP 800-66 Rev. 2, Implementing the HIPAA Security Rule
- ASHP: Guidelines on Preventing Diversion of Controlled Substances
- HHS OCR: Yakima Valley Memorial Hospital resolution agreement
- NHS England: Snooping staff face sack or prison for inappropriate access of patient data
- ICO: Statement on conclusion of criminal investigation
Related NHI Mgmt Group resources: Insider Threat Programme Guide · Healthcare Identity Security Guide · Health Data Privacy Beyond HIPAA Guide (My Health My Data) · NHS Data Security and Protection Toolkit Guide