# Access governance: role-based controls and break-the-glass audits
In 2013, staff at a Los Angeles hospital were fired for peeking at the medical records of a reality TV star admitted for treatment. This was not an isolated event. Hospitals have disciplined and terminated employees for snooping on celebrities, politicians, coworkers, ex-spouses, and neighbors. The temptation is real, the click is easy, and the damage is permanent.
This lesson traces one snooping incident from click to consequence, then shows you how to design the controls that catch it: role-based access, break-the-glass workflows, and the audit log that flags inappropriate views of PHI.
PHI (Protected Health Information) is any health data that can be tied to an individual: name, diagnosis, lab results, admission dates, even a room number linked to a person.
A local musician is admitted overnight to a large teaching hospital for a suspected overdose. By morning, it is trending on social media.
Nadia is a nurse on the cardiology floor, three buildings away. The musician is on the toxicology unit. Nadia has never been assigned to this patient. Out of curiosity, she opens the electronic health record (EHR), searches the patient's name, and reads the chart: labs, notes, the works. Two minutes, then she closes it.
Nothing stops her at the moment of the click. That is the first failure. But every keystroke is recorded. Six days later, the hospital's privacy team runs a routine audit, and Nadia's name surfaces on an alert.
Under HIPAAHIPAAHealth Insurance Portability and Accountability Act, loi américaine imposant la protection des données de santé (PHI). Violations : amendes jusqu'à 1,9M$ par catégorie de violation. (the US Health Insurance Portability and Accountability Act, enforced by the HHS Office for Civil Rights, or OCR), that unauthorized view is a privacy violation. The hospital must investigate, potentially report a breach, and discipline the employee. In Europe, the equivalent is the GDPR (General Data Protection Regulation), where health data is a "special category" needing extra protection, enforced by national Data Protection Authorities.
RBAC means access is granted based on your job role, not your identity. You do not get keys to everything; you get keys to what your role needs.
The governance principle underneath is minimum necessary: HIPAAHIPAAHealth Insurance Portability and Accountability Act, loi américaine imposant la protection des données de santé (PHI). Violations : amendes jusqu'à 1,9M$ par catégorie de violation. requires that access be limited to the minimum PHI needed to do the job.
A practical hospital tier design might look like this:
| Role | Can access | Cannot access |
|---|---|---|
| Attending physician | Charts of patients on their service | Charts on unrelated units |
| Floor nurse | Patients assigned to their unit and shift | Other units, historical discharged patients |
| Billing clerk | Diagnosis codes, insurance, dates | Clinical notes, imaging |
| Lab technician | Test orders and results they process | Full clinical history, psych notes |
| Registration | Demographics, insurance | Diagnoses, lab results |
Notice Nadia's problem. As a cardiology nurse, her role gave her the ability to search and open any patient in the EHR, not just her assigned patients. That is a design flaw. A tighter RBAC model would scope her access to her unit's active census.
Attribute-based access control (ABAC) goes further, layering context on top of role: unit, shift, and care-team assignment. Under ABAC, Nadia opening a toxicology patient three buildings away would fail the check outright, because she is not on that care team.
For a solid primer on the regulatory backbone, see the HHS Summary of the HIPAA Privacy Rule.
Here is the tension. If you lock access down too hard, you kill people. A patient codes in the ERERThe ratio of interactions (likes, comments, shares) to reach for a given piece of content, used to gauge how well audiences respond relative to how many people saw it.Voir la définition complète →, an off-service physician runs in to help, and the system says "access denied." That delay can be fatal.
Break-the-glass solves this. It lets an authorized clinician override normal access restrictions in an emergency, but only after a deliberate, logged action.
1. A clinician tries to open a chart outside their normal access scope.
2. The system does not simply refuse. It presents a warning screen: "You are attempting to access a record outside your assigned care team. This access will be logged and reviewed. State your reason to continue."
3. The clinician must pick or type a justification: "Emergency response," "Covering colleague," "Consult requested."
4. Access is granted. A high-priority flag is written to the audit log.
Break-the-glass shifts the model from "prevent" to "permit but scrutinize." Every glass-break is a candidate for review, because emergencies are legitimate but curiosity dressed up as an emergency is not.
Would break-the-glass have caught Nadia? Only if her search triggered the barrier. If her role let her open any chart silently, there was no glass to break. This is why RBAC scope and break-the-glass must be designed together: the barrier forces the logging event.
🎬 [VIDEO: "How Hospitals Track Who Views Your Medical Records" - youtube.com - a plain-language walkthrough of EHR audit logging and privacy monitoring]
Every EHR records an access log (also called an audit trail): who viewed what, when, and from where. This is the evidence layer. RBAC prevents, break-the-glass deters, and the audit log catches what slips through.
A single access-log entry typically captures:
Raw logs are useless without pattern detection. Effective PHI audits hunt for specific signals:
Nadia gets caught on two of these: the celebrity patient was VIP-flagged, and her access was cross-unit with no care relationship.
Here is the logic of a same-surname flag, expressed in SQLSQLSales Qualified Lead: a prospect the sales team has validated as ready for direct outreach and a proposal, having passed clear qualification criteria.Voir la définition complète → against an access-log table joined to staff and patient directories:
SELECT a.user_id, a.patient_id, a.access_time
FROM access_log a
JOIN staff s ON a.user_id = s.user_id
JOIN patient p ON a.patient_id = p.patient_id
WHERE s.last_name = p.last_name -- shared surname
AND a.care_relationship = FALSE -- not on the care team
AND a.action = 'VIEW'
ORDER BY a.access_time DESC;Modern EHR vendors and third-party tools (for example, privacy-monitoring platforms used alongside systems like Epic and Oracle Health) automate this with machine learning, scoring each access for risk and surfacing the outliers for human review. The human always makes the final call, because a shared surname might be a coincidence and a cross-unit view might be a legitimate consult.
Vérification des acquis
1. In the incident, Nadia was able to open and read the celebrity's chart even though she was never assigned to that patient. What does this reveal as the primary control failure at the moment of the click?
2. Why is a break-the-glass workflow used instead of simply blocking all access outside a clinician's assigned patients?
3. The audit log caught Nadia's snooping six days after the fact. What does this illustrate about the role of audit logs relative to access controls?
4. Select ALL correct answers about what qualifies as PHI (Protected Health Information).
Sélectionnez toutes les réponses correctes.
5. Select ALL correct answers about how a well-designed access governance program should handle a snooping risk like Nadia's.
Sélectionnez toutes les réponses correctes.
Think of the layers as a funnelfunnelThe customer journey from awareness to purchase, typically Awareness, Interest, Consideration, Decision, Action, with prospects narrowing at each stage.Voir la définition complète →:
The governance job is to keep all three tight and reviewed. A break-the-glass log nobody reads is worthless. An RBAC model nobody updates when staff change roles drifts into over-permissioning within months.
A workable monthly rhythm for a hospital privacy office:
1. Run automated flags (surname, address, VIP, cross-unit, volume).
2. Review 100 percent of VIP-flagged and break-the-glass accesses.
3. Sample-audit a percentage of routine access for the rest.
For Nadia, the outcome is likely termination and a documented disciplinary record. For the hospital, it may mean a breach assessment and, if reportable, notification to OCR. Under GDPR, similar unauthorized access to health data can draw regulatory fines and mandatory reporting to the supervisory authority, typically within 72 hours of becoming aware.