Insider Threat Defense: Detecting Unauthorized Access to Patient Records

Executive Summary A recent incident involving a healthcare worker attempting to access and sell the medical records of the Princess of Wales underscores a persistent, high-risk reality for healthcare organizations: the trusted insider threat. Despite perimeter defenses, users with legitimate access credentials remain one of the most potent vectors for data exfiltration. This breach highlights the urgent need for granular User and Entity Behavior Analytics (UEBA) and strict Role-Based Access Control (RBAC) within Electronic Health Record (EHR) systems.

Introduction

In early 2026, the Information Commissioner's Office (ICO) issued a caution to a hospital worker following an internal investigation into unauthorized access attempts. The employee attempted to view and potentially exfiltrate sensitive medical records for financial gain. While criminal prosecution was not pursued in this specific instance, the incident serves as a stark reminder for CISOs and SOC managers: standard access logging is insufficient. Defenders must shift from passive logging to active monitoring of "high-value" data access patterns.

The risk is not merely reputational. Unauthorized disclosure of Protected Health Information (PHI) violates HIPAA, GDPR (in the UK context), and creates severe liability. For security practitioners, the mandate is clear: implement controls that trigger alerts when a user accesses data inconsistent with their role or treatment duties.

Technical Analysis

Affected Products: Electronic Health Record (EHR) systems (e.g., Epic, Cerner) and patient management portals.
Attack Vector: Insider Threat (Privilege Misuse / Valid Accounts).
Mechanism: An authorized user leverages legitimate credentials to access records outside the scope of their clinical duties. This often involves querying specific patient identifiers or accessing VIP records without an active care relationship.
CVE Identifiers: N/A (Human-centric vulnerability).
Exploitation Status: Confirmed active exploitation via insider access. The attacker bypassed technical prevention controls (firewalls/AV) entirely by using approved authentication mechanisms.

Detection & Response

Detecting insider threats requires correlating identity context with data access logs. Standard signature-based detection fails here because the activity often uses authorized tools. We must hunt for anomalies in behavior, not just malware signatures.

SIGMA Rules

The following rules target anomalous EHR access patterns and potential data staging for exfiltration.

YAML

---
title: Potential Unauthorized EHR Record Access
id: 8d4e2a1f-9b3c-4d7e-8f1a-2b3c4d5e6f7g
status: experimental
description: Detects potential unauthorized access to patient records by flagging EHR processes querying specific VIP or patient IDs outside of known administrative workflows.
references:
  - https://attack.mitre.org/techniques/T1114/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.t1114
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\EpicClient.exe'
      - '\CernerPowerChart.exe'
    CommandLine|contains:
      - 'PatientLookup'
      - 'ExportPatient'
  filter_legit:
    ParentImage|contains:
      - '\explorer.exe'
  condition: selection and not filter_legit
falsepositives:
  - Legitimate administrative record lookups by authorized staff
level: medium
---
title: Mass Staging of Medical Records for Exfiltration
id: 9f5e3b2a-0c4d-5e8f-9a2b-3c4d5e6f7a8b
status: experimental
description: Detects bulk copying of patient data to removable drives or non-standard directories, indicative of data staging for theft.
references:
  - https://attack.mitre.org/techniques/T1041/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.exfiltration
  - attack.t1041
logsource:
  category: file_access
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - 'C:\Temp\'
      - 'C:\Users\Public\'
    TargetFilename|contains:
      - '.pdf'
      - '.docx'
      - '.xls'
    Image|endswith:
      - '\EpicClient.exe'
  condition: selection | count(TargetFilename) > 10
falsepositives:
  - Bulk printing or legitimate administrative backups
level: high

KQL (Microsoft Sentinel)

This query hunts for users accessing a high volume of unique patient records within a short timeframe, a behavior consistent with "record scraping" or "snooping."

KQL — Microsoft Sentinel / Defender

let HighVolumeThreshold = 10;
let TimeWindow = 1h;
DeviceFileEvents
| where Timestamp > ago(TimeWindow)
| where InitiatingProcessFileName in~ ('EpicClient.exe', 'CernerPowerChart.exe', 'Meditech.exe')
| where ActionType == 'FileCreated'
| extend PatientID = extract(@'PatientID_(\w+)', 1, TargetFileName)
| where isnotempty(PatientID)
| summarize RecordCount = dcount(PatientID), AccessedFiles = make_set(TargetFileName) by AccountName, DeviceName, InitiatingProcessAccountName
| where RecordCount > HighVolumeThreshold
| project AccountName, DeviceName, RecordCount, AccessedFiles, Timestamp
| order by RecordCount desc

Velociraptor VQL

This artifact hunts for specific EHR client processes interacting with the file system in a way that suggests mass export or viewing of non-standard files.

VQL — Velociraptor

-- Hunt for EHR processes accessing file system extensively
SELECT Pid, Name, CommandLine, Exe, Username
FROM pslist()
WHERE Name =~ 'EpicClient.exe'
   OR Name =~ 'Cerner.*'

-- Correlate with file access for the same processes
SELECT f.FullPath, f.Size, p.Name, p.Pid, p.Username
FROM glob(globs='C:\Users\*\Downloads\*.pdf', accessor='ntfs')
LEFT JOIN p ON p.Pid = f.Inode
WHERE p.Name =~ 'EpicClient.exe' AND f.Size > 1024 * 1024

Remediation Script (PowerShell)

This script audits the local group membership for users with elevated privileges that might access EHR databases or file systems, ensuring no "orphaned" high-privilege accounts exist.

PowerShell

# Audit Administrative Groups for EHR Access Review
function Invoke-AdminGroupAudit {
    $GroupsToAudit = @('Administrators', 'Domain Admins', 'EHR_SuperUsers')
    $Results = @()

    foreach ($Group in $GroupsToAudit) {
        try {
            $Members = Get-LocalGroupMember -Group $Group -ErrorAction SilentlyContinue
            if ($Members) {
                foreach ($Member in $Members) {
                    $Results += [PSCustomObject]@{
                        GroupName = $Group
                        MemberName = $Member.Name
                        SID        = $Member.SID.Value
                        Source     = $Env:COMPUTERNAME
                        Timestamp  = Get-Date
                    }
                }
            }
        }
        catch {
            Write-Warning "Group $Group not found on local machine."
        }
    }

    if ($Results) {
        $Results | Export-Csv -Path "C:\Temp\EHR_Admin_Audit_$(Get-Date -Format 'yyyyMMdd').csv" -NoTypeInformation
        Write-Output "Audit complete. Results saved to C:\Temp."
    } else {
        Write-Output "No suspicious group memberships found."
    }
}

Invoke-AdminGroupAudit

Remediation

Implement Just-In-Time (JIT) Access: Remove standing admin privileges for EHR databases. Require approval for temporary elevation.
Enable Alerting for VIP Access: Configure EHR systems (Epic/Cerner) to send Syslog/SIEM alerts immediately when a flagged VIP record is accessed.
Enforce Least Privilege: Conduct a quarterly review of user access rights. Ensure staff can only access records of patients in their immediate care circle.
Deploy DLP: Configure Data Loss Prevention policies to block copying of files containing keywords like "Medical Record" or "Patient History" to USB drives or personal cloud storage.
User Education: Reinforce HIPAA/GDPR training focusing on the real-world consequences of insider snooping.

Related Resources

Security Arsenal Healthcare Cybersecurity AlertMonitor Platform Book a SOC Assessment healthcare Intel Hub