Context-Aware Anomaly Detection for Electronic Medical Record Systems

The electronic medical record (EMR) system is a critical component of a modern health information architecture. EMRs are increasingly connected to a diverse array of systems that support healthcare business operations, such as clinical documentation, laboratory reporting, radiology services, pharmaceutical dispensing, and billing. The complexity of this domain creates challenges for ensuring patient data security and compliance with regulations (e.g., HIPPA). Certain challenges are common across domains and have thus been addressed through traditional solutions. For instance, exploits against the external perimeter of EMR systems are mitigated by network-based intrusion detection systems (IDS), hardening operating systems, and updating security patches. Additionally, access control mechanisms have been adopted by EMRs to enforce users' privileges with respect to patient records. Beyond access control, the notion of experience based access management (EBAM) has been proposed to refine access control assignments via documented user behavior [4]. Other challenges are unique to the clinical domain. First, EMR systems are connected to web portals and exposed to the Internet for a wide range of users; e.g., patients, providers. The vulnerabilities within web-based systems attract various attacks, which are difficult to detect because they exploit the semantics of clinical operations. Second, healthcare organizations use a coarsegrained implementation of access control. This is because access control mechanisms do not scale to manage the large number of clinical functions that can be invoked (e.g., medication ordering, laboratory report editing, consult requests). Third, clinical treatment guidelines are usually too complex to be modeled and explicitly enforced, which may lead to guideline violation by insiders. Our objective is to build a context-aware anomaly detection system that is customized to the needs of the clinical domain and EMR systems. Our detection system will model the characteristics of EMR systems, monitor the system usage, and detect anomalous user behaviors. This system can help realize the user behavior monitoring component of an EBAM framework.