At a hospital, the EHR application log shows a bulk chart read by a service account that has never read more than a few charts. Which question should the analyst ask first?
Select an answer to reveal the explanation.
Short Explanation
The filing clerk just wheeled out the whole cabinet instead of one folder. You ask first whether that bulk chart read is an allowed interface or theft of patient records. The trap is starting with the cipher, a sampling rate, or a jammed badge printer.
Full Explanation
The application log shows a service account reading far more charts than its history. The first question is what that read means: an authorized interface doing a known job, or someone using the account to take patient records. Volume in an EHR log is a host and application fact, and it is the fact that can indicate data theft. The question that matters first is "Whether that bulk chart read is an authorized interface job or a theft of patient records". "Whether the EHR session cipher suite for that read was TLS 1.3 rather than an older version" asks how the session was encrypted, and the cipher suite does not explain a sudden bulk read. "Whether hospital NetFlow was sampling one packet out of every hundred on the EHR link" asks about a network summary rate, and the evidence in hand is already an application log of the read. "Whether the nurses-station badge printer jammed during the same hour as the bulk read" is an unrelated facilities event and does not interpret the chart access. Exam caveat: a service account is still an account on the host, and a quiet history of a few charts makes a bulk read the anomaly to explain before you chase transport details. Operational check: compare the read with the interface schedule and the account's normal chart count, then identify the process and source that issued it before you call it theft or close it as a job.