New Privacy Technology Will Monitor Epic Access

Beginning Tuesday, Sept. 22, we will have a new tool to monitor access to patient information in Epic.

PrivacyPro is an AI-enabled system that will allow our Privacy Office to review Epic access patterns in near real time and at a broader scale to keep protected health information safe. The system is designed to help identify unusual or potentially high-risk activity earlier than targeted manual audits alone.

What You Need to Know

You do not need to do anything differently. PrivacyPro operates in the background and does not change your Epic access or clinical workflows. 

The most important thing to remember is that you should only access patient information when you have a legitimate clinical or business need. This is an important part of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) law and has not changed. Our patients trust us to keep their information safe.

How it Will Work

PrivacyPro will review Epic access patterns and alert the Privacy Office to activity that may need further review. A flag does not automatically mean that inappropriate access occurred or that disciplinary action is warranted. The Privacy Office will review the circumstances before reaching a conclusion.

During the initial learning period, you or your leader may receive outreach from the Privacy Office about flagged activity. The team may ask for information to confirm the business purpose and determine whether the access was appropriate. Responses will also help the team refine monitoring rules and improve accuracy over time.

We are planning education for all Epic users.

For More Information

If you have questions about appropriate Epic access or how PrivacyPro works, contact the Privacy Office at privacy@carilionclinic.org.