September 15, 2026
This story is fictional. If it sounds like your hospital, that’s between you and your privacy officer.
You have asked me to explain, in my own words and at whatever length I like, the entries on the audit log report you showed me Tuesday. I am grateful for the opportunity to explain. Most of the access entries were made at night, and a column of timestamps tells you very little about why.
Ellen and I were married for eleven years. (I mention it because your report begins six years ago, and a reader might suppose it begins at the beginning.) When she left, she left the house, the dog and most of the books, and took only her clothes and her sister’s opinion of me. For a long while I did not know where she had gone. Then one chill evening in November I was reading films in the department, and her name came up on a wrist series from the emergency room. She had fallen on the ice. It was a clean fracture of the distal radius, which I read myself, and read well.
I want to be honest with you and myself. I did not have to open the rest of her chart, and I knew it. But she had broken her wrist, and there was no one, so far as I could see, to look after her.
Afterward it became a habit, as these things do. Once a month at first, then oftener. I learned her new address from registration, and the name of her new internist, whom I contrived to meet at a conference and found competent. I learned that she had changed her name when she remarried, though not to his; she took back her mother’s. I knew she was expecting a child some weeks before, I think, her sister did, and I knew before her sister when there was no longer a child to expect. I sent flowers, unsigned, which I hope was a comfort.
I have always known about the audit log. Every physician knows the system writes down who opens what, in the way every child knows that God is watching, and like children grown I came to suspect that the record might be kept but never read. Six years bore that out. I came to think of it as a diary someone was keeping for me, in a hand I could not read and no one else troubled to.
Last spring a box began to appear whenever I opened her chart, asking me to state my reason for access. I wrote continuity of care. I have written it, I suppose, two hundred times. It is as true as anything in the record.
I understand from counsel that the hospital must now write to Ellen and tell her what I have done. I do not object. I ask only that you enclose this statement with the letter, so that she will know someone was looking after her all this time.
Before you read on: Who should have caught this, and when? Does Ellen get a letter, and what will it say?
Each look, except the first when he was assigned her wrist imaging (a valid treatment use), was a use HIPAA does not permit (45 C.F.R. § 164.502(a)). Role-based access under the minimum-necessary standard (§ 164.514(d)(2)) would not have stopped him, because a radiologist has a real need to open a great many charts and that standard does not apply to treatment. The hospital had the audit controls the Security Rule requires (§ 164.312(b)), and the log recorded every look.
The report reaches back six years, which is also how long HIPAA requires a covered entity to keep its compliance documentation, such as policies, procedures and risk analyses (§ 164.316(b)(2)(i); § 164.530(j)(2)). Whether that rule covers raw audit logs is unsettled, and many hospitals set a shorter period for logs by policy for practical reasons.
Section 164.308(a)(1)(ii)(D) requires regular review of information system activity, which hospitals meet with reports that pull out the few accesses worth a person’s attention. Most large EHR systems can flag an employee who opens the chart of someone who shares, or once shared, a surname, address or emergency contact with that employee. That report would have caught him the first night, when Ellen still had his name. A break-the -glass report, on one user giving the same reason for the same patient month after month, would have caught the hundred or so entries afterward.
The breach rule’s exception for a workforce member who accesses records unintentionally and in good faith (paragraph (1)(i) of the definition in § 164.402) does not apply, so this is a breach. That might have gone unappreciated without the doctor’s story. Ellen will receive notice under § 164.404 within 60 days of discovery, and the radiologist faces sanctions under § 164.530(e). His characterization of the letter is wrong. It should tell her that a workforce member viewed her records without a work-related reason over several years. His memoir should stay in the file.
Takeaway: An audit log that no person or system reviews is just a diary, and many breaches have a story like this one: it must be understood to make a determination.