Analysis of PACS audit logs proves fruitful

Oct 30, 2003

Maintaining HIPAA-compliant security and privacy practices in a PACS environment isn’t easy, with myriad healthcare personnel requiring access to images and reports. But a new solution -- analyzing audit logs with a multidimensional online analytical processing (OLAP) tool -- has proved highly efficient in identifying security problems and analyzing departmental benchmarks, according to Bob Coleman, director of radiology informatics at Maine Medical Center in Portland, ME.

"Multidimensional analysis is a great tool (for analyzing audit logs)," he said. "It's (also) easily expanded beyond audit logs: you can use it for completely analyzing your departmental workflow."

Coleman discussed the facility's experience with audit log analysis in a presentation at the 2003 Symposium for Computer Applications in Radiology.

At MMC, all users are trained and required to sign an agreement indicating they understand and will follow all security and confidentiality policies, he said. For staff not employed by MMC, an office agreement was developed to ensure support for the security policy.

These policies are backed up with strong review and enforcement, the key to which is strong auditing of the institution’s logs. MMC has approximately 1,600 users on its Web-based image distribution system, with audit records growing by 25,000 to 30,000 per week.

"That’s a lot of data," he said. "It’s impossible to just sit there and go through it."

Those logs are purged after 30 days by the hospital’s PACS vendor for performance reasons, and the audit report tool provided by the PACS vendor was limited. So MMC needed to come up with an alternative solution, Coleman said.

First, MMC elected to extract audit logs from its Web server and PACS network on a weekly basis. In addition, other associated data was captured, and MMC essentially created a departmental data warehouse, Coleman said. User information from the credentialing system, study information from the RIS, and image information from the PACS is included.

The OLAP software (PowerPlay, Cognos, Ottawa, ON) is then deployed to analyze the logs. The multidimensional analysis preprocesses the data, which is then loaded into a different structure that provides analysis and data mining, Coleman said.

Easy filtering of data can be performed based on one or more criteria, and the software provides excellent graphical tools to assist in analysis, he said.

"There’s a lot of ability to drill up or drill down," Coleman said. "You can start at a high level, (it will) show you everything that’s going on with the system. And then (when you) start to drill down, (it will) show me what’s happening in CT, show me what’s happening for my residents."

Via the OLAP software, suspicious Web users can be identified, and the activity of non-clinical users could be tracked, Coleman said. User names and patient names could be matched, Coleman said. The institution could also review activities related to any VIPs.

"As soon as we started sending out e-mails that said, ‘We’ve noted that you’re looking at a particular patient’s record, can you please explain that?’… it became a very effective deterrent," Coleman said. "Once word got out that we were actually using the audit logs, it made a huge difference."

Interestingly, the system was also helpful in evaluating departmental benchmarks, such as report turnaround times, Coleman said. The system produces information better than classical reports, and idiosyncrasies in the data are quickly identified.

It’s also possible to examine particular components of the turnaround time, filtering by dimensions such as exam type, body part, day of week, and physician, Coleman said.

By Erik L. Ridley
AuntMinnie.com staff writer
October 31, 2003

High-volume teleradiology brings substantial benefits, September 19, 2003

Swiss promote open-source radiology informatics tool, September 5, 2003

RIS/PACS integration, September 3, 2003

PACS training modules can smooth PACS education, operation, August 21, 2003