Healthcare privacy breach prevention through integrated audit and access control

A method, comprising:

• receiving, by a computing device, an access log for a medical records database,
• the access log including information identifying occasions in which users access medical records in the medical records database;
• mapping, by the computing device, the access log for the medical records database to generate a mapped log,
• the mapped log comprising information identifying roles associated with the users, information identifying accesses of the medical records by the users, and user identifications,
• the mapped log including a plurality of mapped role-access pairs;
• reducing, by the computing device, the mapped log to generate a reduced log,
• the reduced log comprising role-access pair statistics associated with a mapped role-access pair of the plurality of mapped role-access pairs,
• the role-access pair statistics including an average access for a user associated with the mapped role-access pair, an identification of the user associated with the mapped role-access pair, and an access count associated with the user;
• deriving, by the computing device, an updated access policy for the medical records database based on the reduced log,
• the updated access policy including a plurality of proposed role-access pairs;
• proxying, by the computing device, access of client devices to the medical records database according to the updated access policy;
• assigning, by the computing device, the plurality of proposed role-access pairs to risk subsets,
• the risk subsets comprising:
• underrepresented role-access pairs of the plurality of proposed role-access pairs,
• underutilized role-access pairs of the plurality of proposed role-access pairs,
• utilized role-access pairs of the plurality of proposed role-access pairs, and
• unutilized role-access pairs of the plurality of proposed role-access pairs;
• determining, by the computing device and based on sizes associated with the risk subsets, a level of compliance with a privacy requirement based on assigning the plurality of proposed role-access pairs to the risk subsets;
• and
• providing, by the computing device, the level of compliance.

A device, comprising:

• a memory to store instructions,
• one or more processors, coupled to the memory, to:
• receive an access log for a medical records database,
• the access log including information identifying occasions in which users access medical records in the medical records database;
• map the access log for the medical records database to generate a mapped log,
• the mapped log comprising information identifying roles associated with the users, information identifying access of the medical records by the users, and user identifications,
• the mapped log including a plurality of mapped role-access pairs;
• reduce the mapped log to generate a reduced log,
• the reduced log comprising role-access pair statistics associated with a mapped role-access pair of the plurality of mapped role-access pairs,
• the role-access pair statistics including an average access for a user associated with the mapped role-access pair, an identification of the user associated with the mapped role-access pair, and an access count associated with the user;
• derive an updated access policy for the medical records database based on the reduced log,
• the updated access policy including a plurality of proposed role-access pairs;
• proxy access, of client devices, to the medical records database according to the updated access policy;
• assign the plurality of proposed role-access pairs to risk subsets,
• the risk subsets comprising:
• underrepresented role-access pairs of the plurality of proposed role-access pairs,
• underutilized role-access pairs of the plurality of proposed role-access pairs,
• utilized role-access pairs of the plurality of proposed role-access pairs, and
• unutilized role-access pairs of the plurality of proposed role-access pairs;
• determine, based on sizes associated with the risk subsets, a level of compliance with a privacy requirement based on assigning the plurality of proposed role-access pairs to the risk subsets;
• and
• provide the level of compliance.