Workplace violence, drug diversion, patient safety, handled defensibly.
Handle workplace violence, drug diversion, and patient-safety cases where PHI sits beside badge logs and video. Healthcare security evidence management keeps each file attributable on infrastructure you control. HIPAA-aware handling, not a certification.
PHI in the same pile as the evidence
A clinical incident becomes a security investigation, and PHI lands in the same pile as badge logs and exported video. Someone shares the file with an outside party and the patient identifiers ride along by accident. The investigation is real; the data handling is a separate liability.
Healthcare security evidence management means handling patient-safety and security incident files where PHI sits next to badge logs and exported video, and one careless share sends patient identifiers along with it. A code grey ends in the hallway and the investigation drags on for weeks; the CCTV clip lives on a shared drive, the badge pulls are in someone's inbox, the witness notes are on paper, and the diversion report came out of a different system. Then a surveyor, or a lawyer, asks who handled what, and when. EMP keeps that answer attached to the case, and the evidence stays on infrastructure you control. HIPAA-aware, not a certification.
Where EMP fits in the workflow.
Your healthcare-security packet might include
- ✓ The incident or code-grey report
- ✓ Badge access records
- ✓ CCTV
- ✓ Statements kept in your own controlled handling
- ✓ A reviewed disclosure package
Workplace violence & code-grey security file
Patient-on-staff, visitor-on-staff, and code-grey events. Pull exported CCTV, witness statements, and post-incident debriefs into one HIPAA-aware case, with case actions logged and PHI kept inside the controls you already run.
Drug diversion
Dispensing cabinet discrepancy exports, badge access logs, exported video, and witness interviews reconciled in one case file, and ready when pharmacy, HR, or a regulator needs the record.
Patient-safety security review
Capture the security-relevant components of an incident review without copying patient identifiers into the security slice. Select the appropriate files and reports, review all included content for patient information and complete required redaction in an approved tool before sharing. Checksums do not remove PHI.
Visitor & access incidents
Restricted-visitor enforcement, court-order compliance, and visitor-related events with long retention windows for high-acuity matters.
Asset & medication security
Medication theft, equipment theft, and supply-chain integrity in a regulated environment. Each file gets a fingerprint on the way in and the original is kept untouched, so a reviewer can confirm later that nothing changed.
How a healthcare-security case moves through EMP
- Open the case on your workstation and import the incident records. The code-grey incident reports, badge-access pulls, and exported CCTV come into one local case, each hashed (SHA-256) at intake. Because EMP Intake WS is local-first, PHI stays on the workstation, inside the controls you already run. The only network calls are license validation, an optional update check, and online map resources, and none of them carry case data.
- Build the case carefully, with PHI handled deliberately. Tag the staff involved, the location, and the assets, and link each record to the incident, capturing the security-relevant components without copying patient identifiers into every record in the file.
- Reconstruct the event on a timeline. On Professional, align imported badge-access logs and video in Timeline Recon so the sequence of the code-grey event is clear to a reviewer.
- Prepare a reviewed disclosure package. Generate a reviewed package from selected files and reports. Enable Manifest for checksums and the verifier; Standard and Professional can include Audit Timeline. Professional also supports report branding. Review all artifacts for patient information before sharing.
- A surveyor, HR, or counsel verifies the record without trusting EMP. They recompute the manifest hashes with sha256sum or the /verify tool. The audit trail shows who brought the file in, who handled it, and when it went out. HIPAA-aware handling, defensible after the fact, with no EMP install required.
Feature availability: Standard adds Chain of Custody, Audit Timeline and Incident Maps. Timeline Recon, Link Analysis and custom report branding require Professional. Core includes case management, file intake and exports.
Case workspace example
Code-grey or security incident report. Track the parties, badge-access events, CCTV clips, locations and scenes, and any assets involved as case objects, with comments, tasks, and findings logged along the way. Any PHI stays inside your own controlled handling. Link each object to the evidence behind it, then export a reviewed, selected package for the next reviewer.
Ingests your exports. Doesn't replace your tools.
EMP organizes security records exported from clinical and security systems. Import incident reports, dispensing discrepancies, badge logs and video under your organization's controls, and review patient information before disclosure.
- CSV exports from your diversion-analytics system via file import
- CSV or PDF incident exports from your EHR via manual file ingest
- CSV exports from your access-control system
- Video exported from your hospital CCTV/VMS, imported as case evidence
- OSHA workplace-violence recordkeeping documents (PDF) imported and fingerprinted as they arrive, so the proof travels with the file
Questions these teams ask first.
How does EMP support HIPAA-aware handling?
EMP Intake WS is local-first: case data stays in a SQLite database on your workstation, and EMP doesn't transmit your evidence to us, so PHI stays on infrastructure you control. It supports HIPAA-aware patterns (customer-controlled hosting, local user profiles with per-user audit attribution on the shared workstation, audit logging, and compatibility with OS-level disk encryption you already run, such as BitLocker). EMP itself is not a HIPAA-compliance certification; your policies, operations, and configuration determine your posture.
Can I import diversion-analytics reports?
CSV exports from your diversion-analytics system arrive through the file-import workflow. Investigators import the relevant transactions into a case for cross-reference with badge logs (imported as CSV) and exported video. Each file is hashed (SHA-256) at intake. EMP imports files and CSV logs from your existing tools; it does not integrate directly with them.
What does Joint Commission survey readiness look like with EMP?
EMP writes an append-only audit trail of the documented material case, evidence, custody, administrative, and export events, each with the acting user and a timestamp. That history can support review of case handling. Use it alongside the policies and records requested for the particular survey.
Does my evidence leave my workstation?
No. EMP Intake WS keeps case data in a SQLite database on the workstation. No cloud upload and no telemetry of file contents. The only calls that leave are a licensing check on activation and validation, an optional update check, and map-resource requests when map views, Timeline Recon playback, or exports use online basemaps. Map requests go through a Falcrex-controlled map delivery service using Cloudflare infrastructure (see the Trust page for details). None transmit case data.
How does this interact with our patient-safety / RCA workflow?
EMP captures the security-relevant components. Patient-safety teams use their own tooling for clinical root-cause analysis; prepare a selected disclosure package when the workflows need to share data. Review files, reports and metadata for patient information and complete required redaction in an approved tool; EMP does not automatically remove PHI.
Build the case anyone can verify.
EMP Intake Workstation comes with a 14-day trial, no card and no sales call, so bring a real case and watch it stay defensible.