title: Detecting Inappropriate Access to Electronic Health Records Using Collaborative Filtering.
abstract: Many healthcare facilities enforce security on their electronic health records (EHRs) through a corrective mechanism: some staff nominally have almost unrestricted access to the records, but there is a strictex post factoaudit process for inappropriate accesses, i.e., accesses that violate the facility's security and privacy policies. This process is inefficient, as each suspicious access has to be reviewed by a security expert, and is purely retrospective, as it occurs after damage may have been incurred. This motivates automated approaches based on machine learning using historical data. Previous attempts at such a system have successfully applied supervised learning models to this end, such as SVMs and logistic regression. While providing benefits over manual auditing, these approaches ignore theidentityof the users and patients involved in a record access. Therefore, they cannot exploit the fact that a patient whose record was previously involved in a violation has an increased risk of being involved in a future violation. Motivated by this, in this paper, we propose a collaborative filtering inspired approach to predicting inappropriate accesses. Our solution integrates bothexplicitandlatentfeatures for staff and patients, the latter acting as a personalized "finger-print" based on historical access patterns. The proposed method, when applied to real EHR access data from two tertiary hospitals and a file-access dataset from Amazon, shows not only significantly improved performance compared to existing methods, but also provides insights as to what indicates an inappropriate access.
authors.affiliation: UC San Diego, La Jolla, CA 92093, USA.
authors.forename: Aditya Krishna
authors.initials: AK
authors.lastname: Menon
authors.affiliation: UC San Diego, La Jolla, CA 92093, USA.
authors.forename: Xiaoqian
authors.initials: X
authors.lastname: Jiang
authors.affiliation: UC San Diego, La Jolla, CA 92093, USA.
authors.forename: Jihoon
authors.initials: J
authors.lastname: Kim
authors.affiliation: Rutgers University, Newark, New Jersey, 07102-1897.
authors.forename: Jaideep
authors.initials: J
authors.lastname: Vaidya
authors.affiliation: UC San Diego, La Jolla, CA 92093, USA.
authors.forename: Lucila
authors.initials: L
authors.lastname: Ohno-Machado
keywords: access violation; collaborative filtering; electronic health records; privacy breach detection