Access logs nobody reads are not a control

Clinical systems log access because they have to. Who viewed which record, when. The table grows to hundreds of millions of rows and is queried twice a year, both times after something has already gone wrong.

Logging is necessary and not sufficient

The control the regulation intends is detection of inappropriate access. The log is the raw material. Without something reading it, you have the ability to answer questions after an incident and no ability to notice one.

Log the reason, not just the fact

The most useful column is the one usually missing: why. Access with a clinical context — an open appointment, an active admission, a referral — is legitimate by construction. Access without one is the interesting case.

record_access
  actor_id, patient_id
  action              -- view | export | print | amend
  accessed_at
  context_kind        -- appointment | admission | referral
                      -- | break_glass | none
  context_ref
  source_ip, session_id

Now the alerting query is trivial: accesses where context_kind = 'none'. That is a handful a day in a normal clinic, not hundreds of millions.

Break-glass should be easy and loud

Emergency access to a record outside the normal relationship must never be blocked — someone is bleeding. But it should require a typed reason, and it should generate a review task immediately, not appear in a quarterly report.

Making it easy is what stops staff sharing logins to get around it, which is the failure the control was meant to prevent in the first place.

The patterns worth alarming on

Same-surname lookups, which catch relatives. Access to records with no appointment in a window either side. Volume spikes against a single actor. Access to a flagged record. Each is a scheduled query writing to a review queue.

None of it is machine learning. It is five queries and a table of findings that someone works through weekly.

The measure that matters

Not “are we logging”. Everyone is logging. It is how long between an inappropriate access and someone noticing. If that number is “when the patient complained”, the log is documentation, not a control.