Healthcare privacy violation detection and investigation system and method

A method for detecting privacy violations of patient personal healthcare information (PHI) access comprising:

• at least one processor for performing the steps of:
• generating an audit log for an access to PHI by an authorized user (22A-22E);
• communicating with at least one system (24A-24E) to collect the audit log (26);
• normalizing and parsing the audit log into a predefined and uniform data format (32);
• discarding parameters considered to be irrelevant to a risk of privacy violation (32);
• comparing at least one parameter of the audit log to a corresponding baseline parameter range of an access to PHI by an authorized user that is considered normal and non-healthcare authorized user information (58);
• adding a weighted risk score assigned to the corresponding baseline parameter range to a cumulative risk score for the access to PHI by the authorized user if the parameter of the audit log differs from the corresponding baseline parameter range (64);
• creating an alert (54) and flagging (56) the audit log when the cumulative risk score exceeds an acceptable threshold (66);
• storing the normalized and parsed audit log in a storage database (34);
• comparing the audit log to a set of patient rules (68);
• and
• creating the alert (54) and flagging the audit log (56) when at least one audit log parameter matches a corresponding parameter of the set of patient rules (68).

A method for detecting privacy violations of patient personal healthcare information (PHI) access comprising:

• at least one processor for performing the steps of:
• generating an audit log when an access to PHI by an authorized user occurs (22A-22E);
• normalizing and parsing the audit log into a predefined and uniform data format (32);
• discarding parameters considered to be irrelevant to a risk of privacy violation (32);
• comparing at least one parameter of the audit log to a corresponding baseline parameter range of the authorized user and non-healthcare authorized user information (58);
• adding a weighted risk score (64) assigned to the baseline parameter range to a cumulative risk score for the access to PHI by the authorized user, if the parameter of the audit log differs from the corresponding baseline parameter range for the authorized user (60);
• creating an alert (54) and flagging the audit log (56) when the cumulative risk score exceeds an acceptable threshold (66);
• storing the normalized and parsed audit log in a storage database (34);
• creating the alert (54) and flagging the audit log (56) when at least one audit log parameter matches a corresponding parameter of a set of patient rules (68);
• adding the audit log to the baseline parameter range (62) for the authorized user when the cumulative risk score is under the acceptable threshold (66);
• and
• creating an alert (54) when an unknown authorized user generated the audit log and storing the audit log as the baseline parameter range for the unknown authorized user (40).