"Yes, we collect access logs." Hospitals answer this readily. Ask how many entries were reviewed in the last three months and the answer often stops.
Collecting logs and reviewing logs are different activities, and for EMR access logs the reviewing is by far the harder one. The reason is volume: a few hundred beds produces tens of thousands of access records a day, sometimes more. Nobody can read all of it.
Nor can it simply be left. Improper viewing of medical records arrives by a different route from external attack. A member of staff who legitimately holds access opens a record for reasons unrelated to their work — an acquaintance, a family member, someone locally known, someone connected to a reported incident. Antivirus and network segmentation do not touch this. What touches it is the fact that it can be detected, and that staff know it.
This article is about designing EMR access log review as an operation that lasts: what to look at first when faced with an unreadable volume, who reviews it and how often, and how to stop the review from becoming a formality.
Disclaimer: This article is general information. Requirements for handling medical information and retaining records are governed by the MHLW guidelines, the Act on the Protection of Personal Information, and related guidance. Action concerning staff also involves employment rules and HR process; consult a specialist where needed.
What You Are Trying to Detect
| Pattern | What it is | Signals |
|---|---|---|
| Viewing an acquaintance or relative | Opening the record of someone known to you, outside any clinical need | Same surname as the viewer; same address; no relationship between the viewer's department and the patient's care |
| Viewing a well-known patient | A patient in the news viewed by many staff | A concentration of access to one patient over a short period |
| Viewing one's own record | A staff member reading their own chart outside process | Viewer and patient are the same person |
| Bulk viewing before departure | Taking information out ahead of leaving | Volumes above the individual's norm; increased printing or export |
| Exceeding role | Access beyond the scope of one's duties | Sustained access to departments unrelated to the viewer's role |
| Shared account activity | Nobody can be identified | Individual attribution impossible in the first place (Designing a Password Policy) |
| Misuse of credentials | Logging in as someone else | Access at unusual hours or from unusual terminals; simultaneous sessions |
The first three have relatively clear technical signals — matching surnames, matching addresses, concentration over a short window can all be extracted mechanically. Start there.
"Exceeding role" is the hard one. There are many legitimate reasons to view another department's records: checking prior care, covering on call, case review. It requires two stages — mechanical extraction, then judgement by someone who understands the work.
The shared-account row matters most of all. Without individual attribution, no amount of logging supports a review. Securing individual identification on shared terminals is a precondition. See Designing a Password Policy and Access Design and Privileged ID Management.
What the Logs Must Contain
| Item | What to establish |
|---|---|
| Operations recorded | Whether viewing is recorded, not just create, update, and delete |
| Fields captured | Timestamp, user ID, terminal, patient, action |
| Retention | Standard period, and whether it can be extended (and at what cost) |
| Extraction | Whether records can be exported for review, with conditional search |
| Filter conditions | By patient, user, period, department |
| Tamper resistance | Protection of the logs; whether an administrator can delete them |
| Built-in review support | Whether the product ships with functions for surfacing suspected improper viewing |
The first row is decisive. Some systems record edit history — who wrote what — without recording views, or retain view records only briefly. Detecting improper viewing is impossible without them. If yours does not capture them, fold the requirement into your next replacement (Security Requirements When Replacing an EMR).
Retention matters because improper viewing usually surfaces late, through a patient's query or a colleague's report. If the log has aged out by then, nothing can be established. Set retention against the expected delay to discovery. See Log Management and Audit Trails.
Ease of extraction determines whether reviews continue. If every extraction requires a vendor request, the review will not survive. Check whether your own staff can extract it, and if not, consider including periodic export in the maintenance contract (Questions to Ask Your Vendors).
Designing the Review
Begin from the premise that you cannot read everything. The design problem is choosing the conditions that narrow what you look at.
| Layer | What it is | Frequency | Owner |
|---|---|---|---|
| ① Condition-based periodic review | Mechanical extraction on surname match, self-access, access concentration | Monthly | IT lead with medical records office |
| ② Targeted review | Records of staff and their families, and of high-profile patients | As they arise | Medical information safety management officer |
| ③ Investigation on report | Examining specific records following a patient query or a staff report | As required | Safety management officer with the administrative director |
Start with ①. It automates easily and costs the least attention. Begin with two or three conditions, monthly. Add more only once the routine is established.
Example conditions:
- Views where the viewer's surname matches the patient's
- Views where viewer and patient are the same person
- Any patient whose record exceeded a defined number of views in the past month
- Staff with the highest counts of viewing outside their department
- Overnight or weekend viewing by staff with no corresponding duty record
An extraction result is not a finding of misconduct. Matching surnames usually means two unrelated people; cross-department viewing usually has a reason. Everyone involved must understand that extraction selects what to check, and judgement belongs to people who know the work. Getting this wrong damages your relationship with staff.
Define the procedure:
- Triage the extraction for items with no obvious clinical explanation
- Ask the relevant department head about the business need where appropriate
- Escalate unexplained items to the safety management officer
- Establish the facts and decide whether employment procedures apply
- Decide on any communication to the patient (Reporting Obligations After a Data Breach)
Approach staff carefully. Ask about the clinical need rather than arriving with a conclusion. Most enquiries end with a legitimate explanation — and the process itself signals to the organisation that reviews happen.
Awareness Is the Control
Most of the value of log review comes not from detection but from staff knowing that review takes place.
Improper viewing is rarely deliberate data theft. It happens because someone heard an acquaintance had been admitted and was curious, without expecting anyone to look. Knowing that access is recorded and reviewed is often enough to stop it happening.
| Method | What it is | Effect |
|---|---|---|
| Onboarding and transfer briefing | State that access is recorded and reviewed | Reaches everyone; align with employment rules and undertakings |
| Login notice | A line displayed at EMR login | Seen daily; confirm feasibility with the vendor |
| Periodic all-staff notice | Once or twice a year, confirm that reviews occur | More concrete if you include volumes |
| Scenario-based training | Realistic situations, without identifying real cases | Easier to internalise (Designing Staff Security Training) |
Explain, do not threaten. "You are being watched" corrodes trust. It lands better to say that protecting patient information is the institution's duty, that recording and review are how that duty is met, and that the same records protect staff from unfounded suspicion.
It also helps to settle in advance how staff and their families being treated at their own institution is handled. Whether checking your own results in the EMR is permitted, and what the proper route is instead, should be stated — it removes a common cause of "I just looked."
Making It Last
Reviews stop for one of two reasons: the workload is too high, or nothing ever turns up and the value stops being felt.
| Tactic | What it means |
|---|---|
| Narrow the conditions | Do not start with many; two or three is enough |
| Automate extraction | Reduce manual work; ask the vendor to schedule exports |
| Write a runbook | So the routine survives a change of personnel |
| Record each execution | Date, period covered, items extracted, outcome — including that nothing was found |
| Fix the reporting line | Monthly or quarterly to the safety management officer and administration |
| Review annually | Check whether the conditions still surface anything useful, and adjust |
Recording "nothing found" matters particularly. Without a record of execution you cannot demonstrate that reviews happen — and once nobody would notice its absence, the review quietly stops.
The electronic clinical information coordination structure addition introduced in 2026 requires compliance with the guidelines and a dedicated medical information system safety management officer. Log review sits naturally within that role; consider writing execution and reporting into the job description. See The 2026 Fee Revision and What the Three-Ministry Guidelines Are.
Where AI features or voice input are in use, a further question arises about what data each processing step touches. See Security Design and the Shared Responsibility Model for AI EMRs and Security for AI Voice Charting.
Conclusion
- EMR access log review addresses internal improper viewing, which is detected differently from external attack
- Confirm with the vendor that view events are recorded and retained long enough
- You cannot read everything: design mechanical extraction followed by human judgement
- Extraction results are not findings. Everyone involved must understand it is a way of selecting what to check
- Most of the effect comes from staff knowing reviews happen — explained with reasons, not as a threat
- To keep it running: narrow the conditions, automate, write a runbook, and record that nothing was found
Log review depends on both EMR capability and internal organisation, so the design has to fit your institution. For help deciding where to start, get in touch.
Suppliers of EMRs and cloud services are asked about log capture, retention, and provision too. On building that posture as a supplier, see What Is an ISMS (ISO/IEC 27001)?.
References and Sources
- Guidelines for the Safe Management of Medical Information Systems | MHLW
- Guidelines for the Safe Management of Medical Information Systems, Version 6.0 (PDF) | MHLW
- Personal Information Protection Commission
- Information-technology Promotion Agency (IPA)
- On the FY2026 Medical Fee Revision | MHLW
Note: action concerning staff must follow employment rules and HR process. Obligations regarding personal data are governed by the Act on the Protection of Personal Information and the Commission's guidelines.