Chart Read Access Log

mikeseale

(@mikeseale)

Posts: 344

Reputable Member

Topic starter

We're doing a Security Risk Analysis on our system and a few questions have come up wondering if we keep track of who looks at a certain patient's chart. I was wondering if anyone knew if Centricity keeps track of who all has looked at a patient's chart. I can somewhat track who makes clinical list changes, but as far as just looking over their information, I can't find anything. Other than making every chart sensitive, I can't really tell who is looking at what charts.

We haven't had any issues yet with people looking up PHI without reason, but it would be nice to have proof if it does happen.

Posted : April 22, 2013 4:22 am

ErnieT

(@erniet)

Posts: 479

Honorable Member

Yep it does. There is a chart access report under the report/inquires section. Look under the medicalogic folder then Audit reports.

There are several there that will show that information.

Posted : April 22, 2013 4:58 am

mikeseale

(@mikeseale)

Posts: 344

Reputable Member

Topic starter

Ah, I see. So, there is an audit_event for it. The Medical Logic reports didn't allow me to search by patient, so I'll try and build a report that can do it by patient instead of by the user.

Thanks Ernie!

Posted : April 22, 2013 5:29 am

ErnieT

(@erniet)

Posts: 479

Honorable Member

I use this to look at in sql managerment console. Maybe it will help

This one is for access mainly

select *
from PatientInfoLog
where PatientProfileId = 171127 and Created > '2012-11-08 12:00:00'

This will show information on what was entered

select distinct(dc.contbid)as 'id',dc.CONTB_TIME,dc.DATA_DESC,dc.OLD_VAL,dc.NEW_VAL,dc.USERNAME,ae.EVENT_TIMESTAMP,ae.EVENT_ID
from AUDIT_EVENT ae
left outer join AUDIT_EVENT_DETAIL aed on ae.EVENT_ID = aed.EVENT_ID
left outer join AUDIT_EVENT_TYPE aet on ae.EVENT_TYPE_ID = aet.EVENT_TYPE_ID
left outer join DOCCONTB dc on ae.SDID = dc.SDID
left outer join patientprofile pp on ae.pid = pp.pid
where pp.patientprofileid = 73091 and ae.EVENT_TIMESTAMP >= '2012-02-22 00:00:00' and not(dc.CONTBID is null)
order by ae.EVENT_TIMESTAMP,dc.CONTBID

Posted : April 22, 2013 5:45 am

mikeseale

(@mikeseale)

Posts: 344

Reputable Member

Topic starter

Those queries didn't have "Access a normal chart" logs in them. I just went into Audit Event and scrapped this together, but it will give you everyone that has just opened the chart and looked at it in CPS. You can look further into the details and get information like if they went to the medications tab, started a new document, added a medication, etc. You'll need to edit the query some to get that information, though.

SELECT ae.EVENT_TIMESTAMP, aet.EVENT_TYPE_DESCRIPTION, 
	u.FIRSTNAME, u.LASTNAME, ap.LOGINNAME, aed.EVENT_NOTE, ae.OUTCOME,
	vpi.last, dc.NEW_VAL, ap.OS_MACHINE_NAME
FROM vRptAuditEvent vr
	JOIN AUDIT_EVENT ae ON ae.EVENT_ID = vr.event_id
	JOIN AUDIT_PROFILE ap ON ae.PROFILE_ID = ap.PROFILE_ID
	LEFT JOIN USR u ON u.LOGINNAME = ap.LOGINNAME
	LEFT JOIN AUDIT_EVENT_DETAIL aed ON ae.EVENT_ID = aed.EVENT_ID
	LEFT JOIN AUDIT_EVENT_TYPE aet ON aet.EVENT_TYPE_ID = ae.EVENT_TYPE_ID
	LEFT JOIN DOCCONTB dc ON ae.EVENT_ID = dc.EVENT_ID
	LEFT JOIN vPatientProfile vpi ON ae.PID = vpi.pid
WHERE vpi.patientid = '61963'
	--vpi.first = 'test' AND vpi.last = 'testerman'
	AND aet.EVENT_TYPE_DESCRIPTION = 'Access a normal chart'
ORDER BY vr.event_timestamp DESC

Thanks for pointing me in the right direction, Ernie.

Posted : April 22, 2013 6:27 am

Welcome to the NEW CHUG— your ultimate destination for cutting-edge insights and discussions at the intersection of healthcare and technology.