View source for Modifying Without a Trace: High-level Audit Guidelines are Inadequate for Electronic Health Record Audit Mechanisms

J. King, B. Smith, L. Williams, "Modifying Without a Trace: General Audit Guidelines are Inadequate for Electronic Health Record Audit Mechanisms", Proceedings of the International Health Informatics Symposium (IHI 2012), pp. 305-314, 2012.

== Abstract ==

Without adequate audit mechanisms, electronic health record (EHR) systems remain vulnerable to undetected misuse. Users could modify or delete protected health information without these actions being traceable. ''The objective of this paper is to assess electronic health record audit mechanisms to determine the current degree of auditing for non-repudiation and determine if high-level audit guidelines adequately address non-repudiation. We qualitatively assess three open-source EHR systems''. In our high-level analysis, we derive a set of 16 non-specific auditable event types that affect non-repudiation. We find that the EHR systems audit an average of 12.5% of non-specific event types. In our lower-level analysis, we generate 58 black-box test cases based on specific auditable events derived from the Certification Commission for Health Information certification criteria. We find that only 4.02% of these test executions pass. Additionally, 20% of tests fail in all three EHR systems on actions including the modification of patient demographics, assignment of user privileges, and change of user passwords. The ambiguous nature of non-specific auditable event types may explain the overall inadequacy of auditing for non-repudiation. EHR system developers should focus on specific auditable events for managing protected health information instead of non-specific auditable event types derived from generalized guidelines.

== 1. Introduction ==

Without adequate audit systems to ensure accountability, electronic health record (EHR) systems remain vulnerable to undetected misuse, both malicious and accidental. Users could modify or delete protected health information without these actions being traceable to the modifier. According to Chuvakin and Peterson<sup>[3]</sup, “If [an organization’s information technology] isn’t accountable, the organization probably isn’t either.” Patients need to trust the privacy practices and accountability of healthcare organizations. Administering software audit mechanisms forms a basis for privacy-driven and accountability-driven policy and regulations, including government regulations<sup>[8]</sup>. The United States Health Insurance Portability and Accountability Act of 1996 (HIPAA) Security and Privacy Rule states that one must implement, “mechanisms that record and examine activity in information systems that contain or use electronic protected health information”<sup>[5]</sup>.

Storing an accurate history of user interaction with a software application and its underlying data helps build a sense of accountability, since a user cannot expressly deny performing certain actions that were recorded by the audit mechanism. In the case of a medical mistake, audit mechanisms can provide a record by which healthcare practitioners can exonerate themselves from legal action by demonstrating that they prescribed the correct drug at a certain time, or that a certain test result was, in fact, what they claim it was. The health informatics field needs standards that address the implementation of software audit mechanisms to monitor access and information disclosure, including details of ''what'' should be logged, ''how'' it should be logged, and ''when'' logged information should be monitored.

''The objective of this paper is to assess electronic health record audit mechanisms to determine the current degree of auditing for non-repudiation and determine if high-level audit guidelines adequately address non-repudiation''. In performing this study, we investigate the following questions:

* R1: What events should be included in an EHR log file for non-repudiation?
* R2: What are the strengths and weaknesses of software auditing mechanisms in EHR systems?

== 2. Background ==

== 3. Related Work ==

=== 3.1. Challenges in Technology ===

==== 3.1.1. Limited Infrastructure Resources ====

==== 3.1.2. Log File Reliability ====

=== 3.2. Challenges in Policy, Regulations, and Compliance ===

==== 3.2.1. Ill-defined Standards, Policies, and Regulations ====

==== 3.2.2. Ineffective Log Analysis ====

== 4. Assessment Methodology ==

=== 4.1 High-level Assessment using Audit Guidelines and Checklists ===

==== 4.1.1 Derivation of Non-specific Auditable Events ====

==== 4.1.2 High-level Assessment Methodology ====

=== 4.2. Low-level Assessment using Black-box Test Cases ===

==== 4.2.1 Audit Test Case Template ====

==== 4.2.2 Audit Test Case Example ====

== 5. Case Studies ==

=== 5.1. Open-source EHR Systems Studied ===

=== 5.2. High-level User-based Non-repudiation Assessment ===

=== 5.3 Low-level User-based Non-repudiation Assessment with Black-box Test Cases ===

== 6. Modifying without a Trace ==

== 7. Limitations ==

== 8. Future Work ==

== 9. Conclusion ==

== 10. Acknowledgements ==

== 11. References ==