How to keep patient data from leaving your EHR, and record who accessed it

HIPAA’s Security Rule doesn’t have one rule that stops patient data from leaving your practice. It asks for four things that work together. Limit who can see which records, and control the devices and media that carry data. Record activity in your systems, and review those records regularly. HHS’s Office for Civil Rights (OCR), which enforces HIPAA, has written guidance on how insiders take data and has settled cases where they did.

How patient data leaves a practice

OCR’s Summer 2019 cybersecurity newsletter lists several ways an insider can get data out. They can send it in encrypted messages or copy it to a phone or USB drive. They can also take a laptop or other equipment out of the building. The same newsletter says laptops, phones, and thumb drives are harder to protect and control, especially when staff own them.

The people in question aren’t only employees. HIPAA’s definition of “workforce” in 45 CFR 160.103 also covers volunteers, trainees, and others whose work is under your direct control, paid or not. OCR’s breach report for 2024 lists employees opening records outside their job duties among the year’s unauthorized access breaches.

With a web-based EHR, data can leave without any device moving. A staff member signs in from a home laptop and saves a file or a screenshot.

Limit who can see each record

The access rules come first, because a record a person can’t open is a record they can’t copy. Under 45 CFR 164.308(a)(3) and (a)(4), you set policies so each workforce member has appropriate access and no more. Most of the detailed steps under these two standards are “addressable”, including access authorization and access establishment and modification. Addressable means you assess whether the step is reasonable for you. If it isn’t, you document why and use an equivalent measure if one is reasonable.

The Privacy Rule’s minimum necessary standard adds a role-by-role list. Under 164.514(d)(2), you identify the people or job roles that need patient data. For each one, you list the kinds of data they need and any conditions on that access. Then you make reasonable efforts to keep each role inside those limits.

OCR’s 2019 newsletter turns this into a practical question: does the job need to write, download, or change data, or is read-only enough? A scheduler, a biller, and a nurse need different things. If your EHR can separate viewing from exporting, use that setting.

Control the devices and media that carry data

45 CFR 164.310(d)(1) is the device and media standard. It asks for policies on hardware and electronic media that hold patient data as they come into and leave a facility, and as they move inside it. Under it, disposal and media re-use are required. Keeping a record of each item’s movements and who is responsible for it is addressable.

The 2019 newsletter suggests limiting mobile devices nobody needs. It also suggests controls that stop staff from copying data to external devices without permission. If you do let staff use a phone or USB drive, the newsletter says you must protect the data on it.

A media log has a limit. It tracks drives and laptops, not files that leave over the internet. For downloads from a browser, you need the system’s own settings and records.

Record activity and review the records

Audit controls, in 164.312(b), are a standard that every practice covered by HIPAA must meet. You put in place hardware, software, or procedures that record and examine activity in systems that hold patient data. Information system activity review, in 164.308(a)(1)(ii)(D), is required. It means you regularly review records such as audit logs and access reports.

OCR’s 2024 breach report lists the review failures its investigations found. Some practices didn’t review records at all. Others reviewed them only after a breach, or now and then with no schedule. The report says regular review gives you a baseline of normal activity, so unusual activity stands out. The rule doesn’t list which events a log must capture. So ask your EHR vendor whether exports, prints, and downloads appear in the log you review.

A log only names a person if each person has their own login. Unique user identification, in 164.312(a)(2)(i), is required. OCR’s Summer 2021 newsletter explains why. With a shared username, the system records one name for everyone, so it can be very hard to find who entered, changed, or deleted information. Can staff share an EHR login? covers the rest of that question.

End access when people leave or change roles

Termination procedures, in 164.308(a)(3)(ii)(C), are addressable. They cover ending access to patient data when someone’s job or other arrangement with you ends. The 2019 newsletter singles out involuntary separations. Before the person leaves, it says to disable all of their computer and application accounts, including remote and admin access. It also says to change facility codes they know and collect keys, devices, and media. Which accounts to close when someone leaves a medical practice, and how fast walks through the accounts.

OCR’s case records show what happens otherwise. OCR has settled cases with a city health department and with a hospital that it says failed to end a former employee’s access. Its 2024 breach report describes a medical practice fined after a former contractor kept getting into its record system. OCR found no procedures for regularly reviewing system activity or for ending former workforce members’ access.