We're currently looking for a solution (hardware or software-based) that can monitor and audit all PHI viewing activity per new HIPAA rules. We use MS-SQL for our production database. We have the following requirements:
- Can track inserts/updates/deletes/views of PHI
- Works for both Database Users and Application Users
- Captures changes made over the network and directly in the database (privileged users)
- Works on multiple servers
There are some other items that would be nice to have (low-impact to implement, great reporting, alerting for suspicious behaviour), but are not requirements.
Has anybody implemented a solution that accomplishes something similar to this, or has worked with a vendor that offers something like this?