drop ehr access log · detect minimum-necessary violations + curious access patterns · runs locally
flags break-the-glass without reason · off-hours bulk access · celebrity/vip patient patterns · department mismatch
heuristic minimum-necessary screener · patient ids may be hashed · celebrity/vip markers are pattern-based · not a legal hipaa determination · correlate with workforce role data before escalation