# Presentation: 705572

## Audit Logs as Security Control

**Soumitra Sengupta, PhD**
**Information Security Officer, NewYork-Presbyterian Hospital**
**Information Security Officer, Columbia University Medical Center**
**Assistant Clinical Professor, Dept of Biomedical Informatics,**
**Columbia University**
**Richard Gallagher, PhD**
**Sr. Security Analyst, FCGMS**
**June 9, 2005**

## Introduction 

** ****NewYork-Presbyterian Hospital**
**Affiliated to two medical schools**
** ****Columbia University Medical Center**
** ****Weill Cornell Medical College**
** ****5,083 Physicians**
** ****14,738 employees**
** ****$2.4 billion revenue**
** ****105,666 discharges (2,344 beds)**
** ****1,444,076 outpatient visits, 180,308 emergency visits**

## Information Security Risk Management

*criteria*

- not acceptable(**proactively improve**)

- have

- Threats

- Risks

- Incidents

- Resolution

- Sanctions

- Measurement

*value*

*costs*

- Assets

- Controls

- acceptable

- may lead to

- quantify

- when realized,instantiate

- re-evaluation(**retroactively improve**)

- potentiallyadd

- if imperfect, yield

- potentiallyreduce

- Vulnerabilities

**Information Security Risk Management**

- resolve

## Security Controls 

** ****Authentication and Authorization **
** ****Access definitions are ****not precise**
** ****Privacy goes ****beyond**** explicit permissions**
** ****Minimum Necessary**** & ****Need to know**
** ****Audits (as Security Control)**
** ****Need ****consolidated**** Audit logs**
** ****Need ****intelligence**** to make logs useful**
** ****Need ****procedural investigation and actions**
** ****Need ****communication**
** ****Need ****Institutional support**** and ****Sanctions**

## What is NOT an Audit Log

**What is NOT an Audit Log**

** ****NOT**** a general level network and system log **
** ****NOT**** a log of Disclosures or EPHI transfers**
** ****NOT**** performance logs**
** ****NOT**** debug logs**
** ****NOT**** journal logs**

## What is an Audit Log

**What is an Audit Log**

**Focus on ****Access by Users ****in ****             EPHI Applications, Databases, Files**
** ****Capture **
** ****Who**** – ****Users, Patients**** **
** ****What**** – ****Data classes and Actions**
** ****When**** – ****Date, time**** **
** ****How**** – ****Apps, programs, server/database name**
** ****Where**** – ****Network locations, local/remote**
** ****Why**** – ****sometimes, just ask why**
** ****Some relevant events**
** ****Login, Logout, Timeout**

## NYP Audit Log processing

**NYP Audit Log processing**

**Application Logs**

**Reformat (perl)**

**Splus scripts**

**Data**
**by MRN**

**Data**
**by User**

**Data**
**by Time**

**Usage**
**Statistics**

**C programs**
**Splus scripts**

**Web reports **
**& graphs**

**Email**
**alert reports**

**Merged ****Daily Logs**

**Application Logs**

**Application Logs**

**User**
**database**

*Splus statistical **package*

## Slide 8

## Patient View

**Patient View**

## Slide 10

## Slide 11

## Slide 12

## Slide 13

## Slide 14

## Audit Process

** ****Complaint, VIP audit, Some event **
** ****Privacy officer, Patient Relations, ****     Risk Management, Legal**
** ****Discussion with manager/supervisor**
** ****Individual interviews**
** ****Additional technical investigations**
** ****Chief Medical Officer, HR, Union Rep**
** ****Sanctions**
** ****Training**
** ****Reprimand (letter)**
** ****Suspension**
** ****Termination**

## Usage Statistics

## Usage Statistics

## Usage Statistics

**Usage Statistics**

## Disk Utilization

## Conclusion

** ****Audit is a reasonable security control**
** ****Not uniformly supported by vendors**
** ****Standards efforts**
** ****ASTM E2147-01 Audit and Disclosure Logs for Use ****    in Health Information Systems**
** ****Audit Trails and Node Authentication Profile ****    (RSNA, ACC, HIMSS, www.himss.org/IHE)**
** ****The goal is better user compliance**
** ****Logs are useful in other ways**
** ****Needs commitment and resources**