Monitoring more activity does not produce better monitoring, speakers said at a patient privacy symposium last week.

 

What happened

Healthcare privacy teams are using artificial intelligence to automate how they identify, rank, and investigate possible privacy violations, MedCity News reported on October 4, 2026, covering a patient privacy symposium held the previous Wednesday. Organizations are changing from reactive audits conducted after something surfaces to monitoring that identifies suspicious activity before it becomes an incident. Several speakers cautioned that simply increasing monitoring volume does not, by itself, improve it. The event was hosted by Bluesight, a healthcare compliance software company based in Alexandria, Virginia.

 

Going deeper

Electronic health record access monitoring was the practical example. Angela Alton, vice president and chief privacy officer at City of Hope, a cancer treatment and research organization in Duarte, California, described using it to support compliance and performance improvement rather than only to catch violations, according to the report. Access monitoring records exactly which staff member opened which patient records and flags patterns that fall outside expected behaviour, such as an employee viewing records for patients they are not treating. The volume those systems generate is the difficulty, since a large health system produces more flagged events each day than a privacy team can review, which is what makes automated prioritization attractive.

 

What was said

"You want to have transparency so you can see what's happening with the agent, how it's thinking," said Mustafa Rahimi, principal AI strategist and technical leader for healthcare and life sciences at Amazon Web Services, quoted by MedCity News from his keynote. The report records speakers stress human oversight, case-specific investigation, and accountability as the elements that have to remain in place as the technology takes on more of the work.

 

In the know

AI occupied the symposium in both directions, as a tool for privacy operations and as something privacy teams now have to monitor. As AI systems take on more tasks inside clinical workflows, organizations need to track closely what data those systems can reach and what actions they are able to take, the report notes. That reverses the usual relationship, since the system doing the monitoring becomes something requiring monitoring of its own. The access monitoring question for an AI agent differs from the one asked of an employee, because an agent acting with a clinician's permissions generates activity attributed to that clinician unless it has been given an identity of its own.

 

The big picture

Unauthorized AI use has become something privacy teams now have to watch alongside record access. Verizon found 45% of employees are regular users of AI tools on corporate devices, up from 15% the previous year, with 67% reaching those services through non-corporate accounts, in its 2026 Data Breach Investigations Report healthcare snapshot. Shadow AI is now the third most common non-malicious insider action appearing in data loss prevention records, a fourfold increase in a year. Source code was the data type most often submitted to external AI services, followed by images and structured data. For a healthcare privacy team, that creates a monitoring problem running parallel to the one they already have, since an employee pasting a patient summary into a consumer AI tool generates no record access alert at all. The symposium's point about human oversight applies to both, and neither is solved by generating more flags than anyone can review.

 

FAQs

What does EHR access monitoring actually detect?

It detects patterns rather than individual actions, such as an employee opening records for patients outside their care team, repeatedly viewing one patient without a treatment relationship, or accessing records for someone sharing their surname. Each pattern requires investigation before it means anything.

 

Why does monitoring volume become a problem?

Flagged events scale with the size of the organization while privacy teams do not. A system generating thousands of alerts weekly against a team of two or three produces a backlog, and unreviewed alerts are worse than none because the organization has the record without the examination.

 

Does HIPAA require reviewing logs or only keeping them?

Both. The Security Rule requires implementing procedures to regularly review records of information system activity, so retention alone does not satisfy it. Organizations should be able to describe the review process and show it operating.

 

How should an AI agent be represented in access logs?

Through an identity of its own rather than operating under a staff member's credentials. Without that separation, activity cannot be attributed, and an investigation cannot distinguish what a clinician did from what software did on their behalf.

 

What should a privacy team ask about an automated prioritization tool?

How it ranks events, what it does with those it ranks low, whether a person reviews anything closed automatically, and whether the reasoning behind a decision can be reconstructed afterwards. The last question is the one a regulator would ask.