Access governance: role-based controls and break-the-glass audits
In 2013, staff at a Los Angeles hospital were fired for peeking at the medical records of a reality TV star admitted for treatment. This was not an isolated event. Hospitals have disciplined and terminated employees for snooping on celebrities, politicians, coworkers, ex-spouses, and neighbors. The temptation is real, the click is easy, and the damage is permanent.
This lesson traces one snooping incident from click to consequence, then shows you how to design the controls that catch it: role-based access, break-the-glass workflows, and the audit log that flags inappropriate views of PHI.
PHI (Protected Health Information) is any health data that can be tied to an individual: name, diagnosis, lab results, admission dates, even a room number linked to a person.
The incident: a nurse and a celebrity chart
A local musician is admitted overnight to a large teaching hospital for a suspected overdose. By morning, it is trending on social media.
Nadia is a nurse on the cardiology floor, three buildings away. The musician is on the toxicology unit. Nadia has never been assigned to this patient. Out of curiosity, she opens the electronic health record (EHR), searches the patient's name, and reads the chart: labs, notes, the works. Two minutes, then she closes it.
Nothing stops her at the moment of the click. That is the first failure. But every keystroke is recorded. Six days later, the hospital's privacy team runs a routine audit, and Nadia's name surfaces on an alert.
Under HIPAA (the US Health Insurance Portability and Accountability Act, enforced by the HHS Office for Civil Rights, or OCR), that unauthorized view is a privacy violation. The hospital must investigate, potentially report a breach, and discipline the employee. In Europe, the equivalent is the GDPRGDPREU regulation governing how organizations collect, store and use personal data, with fines tied to global revenue for breaches.View full definition → (General Data Protection Regulation), where health data is a "special category" needing extra protection, enforced by national Data Protection Authorities.
Layer 1: Role-based access control (RBAC)
RBAC means access is granted based on your job role, not your identity. You do not get keys to everything; you get keys to what your role needs.
The governance principle underneath is minimum necessary: HIPAA requires that access be limited to the minimum PHI needed to do the job.
Designing access tiers
A practical hospital tier design might look like this:
| Role | Can access | Cannot access |
|---|---|---|
| Attending physician | Charts of patients on their service | Charts on unrelated units |
| Floor nurse | Patients assigned to their unit and shift | Other units, historical discharged patients |
| Billing clerk | Diagnosis codes, insurance, dates | Clinical notes, imaging |
| Lab technician | Test orders and results they process | Full clinical history, psych notes |
| Registration | Demographics, insurance | Diagnoses, lab results |
Notice Nadia's problem. As a cardiology nurse, her role gave her the ability to search and open any patient in the EHR, not just her assigned patients. That is a design flaw. A tighter RBAC model would scope her access to her unit's active census.
Attribute-based access control (ABAC) goes further, layering context on top of role: unit, shift, and care-team assignment. Under ABAC, Nadia opening a toxicology patient three buildings away would fail the check outright, because she is not on that care team.
For a solid primer on the regulatory backbone, see the HHS Summary of the HIPAA Privacy Rule.
Layer 2: Break-the-glass
Here is the tension. If you lock access down too hard, you kill people. A patient codes in the ERERThe ratio of interactions (likes, comments, shares) to reach for a given piece of content, used to gauge how well audiences respond relative to how many people saw it.View full definition →, an off-service physician runs in to help, and the system says "access denied." That delay can be fatal.
Break-the-glass solves this. It lets an authorized clinician override normal access restrictions in an emergency, but only after a deliberate, logged action.
How the workflow feels in practice
- A clinician tries to open a chart outside their normal access scope.
- The system does not simply refuse. It presents a warning screen: "You are attempting to access a record outside your assigned care team. This access will be logged and reviewed. State your reason to continue."
- The clinician must pick or type a justification: "Emergency response," "Covering colleague," "Consult requested."
- Access is granted. A high-priority flag is written to the audit log.
Break-the-glass shifts the model from "prevent" to "permit but scrutinize." Every glass-break is a candidate for review, because emergencies are legitimate but curiosity dressed up as an emergency is not.
Would break-the-glass have caught Nadia? Only if her search triggered the barrier. If her role let her open any chart silently, there was no glass to break. This is why RBAC scope and break-the-glass must be designed together: the barrier forces the logging event.
🎬 [VIDEO: "How Hospitals Track Who Views Your Medical Records" - youtube.com - a plain-language walkthrough of EHR audit logging and privacy monitoring]
Layer 3: The access-log audit
Every EHR records an access log (also called an audit trail): who viewed what, when, and from where. This is the evidence layer. RBAC prevents, break-the-glass deters, and the audit log catches what slips through.
A single access-log entry typically captures:
- User ID and role
- Patient ID
- Timestamp
- Action (view, edit, print, export)
- Access point (workstation, department)
- Break-the-glass flag and justification, if any
What auditors look for
Raw logs are useless without pattern detection. Effective PHI audits hunt for specific signals:
- Same-last-name access: an employee viewing a patient who shares their surname (possible relative).
- Same-address access: staff and patient at the same home address.
- VIP or flagged-patient access: any view of a record marked "sensitive" (celebrities, staff, high-profile cases).
- Cross-unit access: a clinician viewing patients outside their assigned unit with no care relationship.
- Volume anomalies: one user opening far more charts than peers in the same role.
Nadia gets caught on two of these: the celebrity patient was VIP-flagged, and her access was cross-unit with no care relationship.
A simple detection query
Here is the logic of a same-surname flag, expressed in SQLSQLSales Qualified Lead: a prospect the sales team has validated as ready for direct outreach and a proposal, having passed clear qualification criteria.View full definition → against an access-log table joined to staff and patient directories:
SELECT a.user_id, a.patient_id, a.access_time
FROM access_log a
JOIN staff s ON a.user_id = s.user_id
JOIN patient p ON a.patient_id = p.patient_id
WHERE s.last_name = p.last_name -- shared surname
AND a.care_relationship = FALSE -- not on the care team
AND a.action = 'VIEW'
ORDER BY a.access_time DESC;Modern EHR vendors and third-party tools (for example, privacy-monitoring platforms used alongside systems like Epic and Oracle Health) automate this with machine learning, scoring each access for risk and surfacing the outliers for human review. The human always makes the final call, because a shared surname might be a coincidence and a cross-unit view might be a legitimate consult.
Knowledge check
1. In the incident, Nadia was able to open and read the celebrity's chart even though she was never assigned to that patient. What does this reveal as the primary control failure at the moment of the click?
2. Why is a break-the-glass workflow used instead of simply blocking all access outside a clinician's assigned patients?
3. The audit log caught Nadia's snooping six days after the fact. What does this illustrate about the role of audit logs relative to access controls?
4. Select ALL correct answers about what qualifies as PHI (Protected Health Information).
Select all the correct answers.
5. Select ALL correct answers about how a well-designed access governance program should handle a snooping risk like Nadia's.
Select all the correct answers.
Putting the three layers together
Think of the layers as a funnelfunnelThe customer journey from awareness to purchase, typically Awareness, Interest, Consideration, Decision, Action, with prospects narrowing at each stage.View full definition →:
- RBAC/ABAC blocks most inappropriate access before it happens. This is your cheapest and strongest control.
- Break-the-glass handles the exceptions, permitting emergency access while forcing an intentional, logged justification.
- Audit logs catch everything that got through, including misused break-the-glass events and design gaps.
The governance job is to keep all three tight and reviewed. A break-the-glass log nobody reads is worthless. An RBAC model nobody updates when staff change roles drifts into over-permissioning within months.
A quick governance cadence
A workable monthly rhythm for a hospital privacy office:
- Run automated flags (surname, address, VIP, cross-unit, volume).
- Review 100 percent of VIP-flagged and break-the-glass accesses.
- Sample-audit a percentage of routine access for the rest.
- Recertify RBAC roles quarterly: confirm each user still needs their access.
For Nadia, the outcome is likely termination and a documented disciplinary record. For the hospital, it may mean a breach assessment and, if reportable, notification to OCR. Under GDPR, similar unauthorized access to health data can draw regulatory fines and mandatory reporting to the supervisory authority, typically within 72 hours of becoming aware.
Key Takeaways
- Design RBAC around "minimum necessary." Scope access to role, unit, and active care relationship. Nadia's snooping was possible only because her role let her open any chart.
- Break-the-glass is a feature, not a loophole. It permits emergency access while forcing a logged justification, turning silent curiosity into a reviewable event.
- The access log is your evidence layer. Automated flags for shared surnames, shared addresses, VIP patients, and cross-unit views catch what prevention missed.
- Governance is a cadence, not a one-time setup. Review VIP and break-the-glass access every cycle, and recertify roles quarterly so permissions do not drift.
- The law has teeth. HIPAA (enforced by HHS OCR) and GDPR both treat unauthorized PHI access as a reportable violation with real financial and disciplinary consequences.