A HIPAA access review in Dock works like this. Your team pulls the week's Epic audit-log report and the matching ServiceNow access-request tickets using its own access to those systems. An agent works through them, drafts a finding row in Dock for each user under review, and waits. The named privacy officer opens the row, reads the citations, and either approves or sends it back. Epic and ServiceNow stay the systems of record for the underlying events. Dock holds the work: the interpretation, the reasoning, the reviewer name, and the timestamp.
Healthcare data is sensitive. Hold any tool, Dock included, to your own HIPAA policies and your compliance team's review before you connect clinical systems.
The architecture
Epic and ServiceNow stay the systems of record for the raw data: chart accesses and access-request tickets. Your control framework lives wherever your compliance team keeps it. Dock holds what the agent interprets from that data. Each Dock row carries a pointer back to the source record (epic_audit_event_id, servicenow_ticket_id), the agent that drafted it, the reviewer who approved it, and a timestamp. When the reviewer needs current state, for example to confirm a user's role has not changed since the draft, someone checks Epic or ServiceNow directly. Keep rows to pointers and findings, and let your compliance team decide what detail belongs in them. The goal is a review record your team can audit.
The review table
| row_id | user | epic_audit_event_id | servicenow_ticket_id | finding | agent | reviewer | status |
|---|---|---|---|---|---|---|---|
| ar-3104 | j.okafor@stclare.org | EPC-AE-99214 | INC-44021 | 14 chart accesses outside assigned unit; ticket INC-44021 grants temporary float coverage. Within scope. | argus-compliance@dock | k.reyes (Privacy Officer) | approved |
| ar-3105 | m.chen@stclare.org | EPC-AE-99217 | (none) | 3 accesses to VIP record with no documented care relationship. No supporting ticket. | argus-compliance@dock | k.reyes (Privacy Officer) | flagged for investigation |
| ar-3106 | l.adebayo@stclare.org | EPC-AE-99221 | INC-44088 | Break-glass access; reason field cites code blue 4N at 02:14. Matches ServiceNow on-call roster. | argus-compliance@dock | k.reyes (Privacy Officer) | approved |
The workflow
Every Monday morning, the team drops the prior week's Epic report of out-of-unit, break-glass, and VIP-touching accesses into Dock, along with the relevant ServiceNow tickets. For each event, the agent checks whether a covering ticket exists, then drafts a row with the finding and links back to both sources. Kira Reyes, the named privacy officer, opens her review queue in Dock. She reads each row, expands the citations, and approves or flags. Approved rows become part of the record her compliance team reviews. For flagged rows, the team opens a ServiceNow investigation ticket and notifies the user's manager. Nothing counts as a finding until Kira has approved it.
Why it matters
HIPAA 45 CFR 164.312(b) requires covered entities to "implement hardware, software, and/or procedural mechanisms that record and examine activity" in systems containing ePHI (Cornell LII, 45 CFR 164.312). The rule does not say a human must read every log line. It says activity must be examined. Dock turns the examination into a structured artifact instead of an inbox thread.
NIST SP 800-66 Revision 2 offers guidance on implementing the HIPAA Security Rule, including information system activity review (NIST SP 800-66r2, Feb 2024). A Dock row with agent, reviewer, status, and decided_at columns gives your compliance team a clear record to review against that guidance. Whether it meets your obligations is their call.
A common question in any access review is "show me who approved this." A privacy officer's name on a row, tied to a named agent identity with a lifecycle the team can replay, answers it in one screen.
See the full picture under Dock for healthcare operations, and the adjacent controls work under Dock for compliance and Dock for security operations.
FAQ
Should PHI go into Dock? Ask your compliance team. This workflow is designed around pointers to Epic audit events and ServiceNow tickets, plus the agent's finding and the reviewer's decision. Re-reading the chart access happens in Epic, with your own access.
Who is on the hook if the agent miscategorizes an access? The named reviewer. The row records that Kira Reyes, not the agent, approved the finding. Agents draft; humans accept accountability.
How often should the data be refreshed? Pull a fresh report for each weekly run, and re-check the source if a row sits in the queue more than a day before review.
Can the same review support SOC 2 work too? It can give your auditors and compliance team one clear record of who reviewed what and when. Which controls it supports, and whether it is enough, is for them to decide.