## 1 Introduction  
Healthcare critical infrastructures must be supervised actively for the detection of malicious or unusual behaviour. This is because, given the value and quantity of personal information stored, the health sector is consistently in the top three for the highest number of reported data-security incidents yearly [1]. For example, in 2016, 450 data breaches occurred, affecting more than 27 million patient records; 26.8% of these breaches were the result of hacking and ransomware [1], with the remaining percentage a result of non-cyber breaches relating to human error, such as posting/faxing/emailing personal data to the incorrect recipient. Often, attacks on healthcare infrastructures are well documented, including the WannaCry global ransomware campaign, which affected 48 UK hospital networks in May 2017.  
Within the infrastructure, employees also present an additional persistent internal threat as they have access to any patient record without control or reprimand. Without proactive monitoring of audit records, data breaches go undetected and employee misbehaviour is not deterred. With a requirement for all hospitals in the UK to aim to be paperless [2], solutions are needed for the monitoring of access to healthcare data for malicious activity.  
Electronic patient record (EPR) systems support the efficiency of clinical operations within healthcare organisations [3]. They improve the safety and efficiency of healthcare delivery, whilst reducing costs. This shift from paper-based to digital patient records improves the availability of patient data without limitations. In turn, this results in more accessible health information, that is useable and available by a range of health professionals. However, this development conflicts with the public perception of patient confidentiality [4]. Current patient privacy within EPR systems is enforced through corrective mechanisms, managed through role-based access. However, once a user has been authenticated, they are essentially granted unhindered access, meaning that EPR systems are equally vulnerable to both insider and outsider threats.  
In many cases, measures are not taken to detect and prevent patient privacy violations; any breaches of confidentiality are only brought to light once an investigation is launched, which is often too late. EPR systems are audited; however, the quantity of EPR audit data is significant and a challenge for regular analysis by an information security analyst.  
There is a clear need for health care critical infrastructures to bridge the gap between cyber operations/resilience and the priorities of the business. However, this is a considerable challenge, especially when considering data complexity, fragmentation, interoperability issues and lack of spatialisation, which, together, degrade information visibility within organisations. More specifically, within the healthcare security domain, the core challenges include (1) a lack of labelled data from previous attacks; (2) constantly evolving bespoke attacks and (3) the analyst's limited investigative time and budget. Machine learning approaches are required in order to tackle the large volumes of data that cannot be investigated either by hand or through visualisation.  
Therefore, as an internal-facing anomaly detection solution put forward in this paper, the local outlier factor (LOF) is adopted as a benchmark analyser for the detection of normal/abnormal data interaction points. Density-Based Spatial Clustering of Applications with Noise (DBSCAN) is selected as a comparison for the purposes of evaluation. The solution achieves promising results, showing that within a dataset refined to 90,385 unique IDs, 102 and 358 anomalies are detected with DBSAN and LOF, respectively.  
The remainder of the paper is structured as follows. Section 2 provides a background investigation on EPR data. Section 3 focuses on the methodology adopted in this research. The results from experiments are presented in Section 4 and the paper is concluded in Section 5.