Access-log anonymisation is the removal of identifying detail from an EPR audit log: usernames, IP addresses, and timestamps. The NHS DSP Toolkit assesses providers against the National Data Guardian's data security standards, which expect unauthorised staff access to be identifiable and reviewed, and the Records Management Code of Practice for Health and Social Care 2021 sets how long such logs are kept. anonym.plus does this on your own device, keeping the viewing pattern.
When this applies
An audit log shows which worker opened which record and when — exactly the kind of access review the National Data Guardian's standards expect a provider to run. To study these patterns more broadly or train a model, the usernames, IPs, and patient links must come out.
How anonym.plus handles it
- Point anonym.plus at the log on your server.
- It scans username, IP, host, and timestamp fields.
- Steady labels keep one worker’s actions linked.
- Review the summary and tune the field rules.
- Swap each identifier, shifting times to keep the order.
- Save the clean export. Source entries stay local.
What you need to provide
- The log (CSV, JSON, or audit export).
- A field map for username, IP, and host columns.
- Replace with a steady map to keep action chains.
Patient data entity types detected
| Category | anonym.plus entity type | Example |
|---|---|---|
| Staff ID | ID | user jmertens → [USER_n] |
| Network | IP_ADDRESS | 10.14.2.9 → [IP_n] |
| Dates | DATE_TIME | 08:42:11 access → shifted [TIME] |
| Patient | PERSON | viewed record: A. Roth → [PATIENT] |
| Record IDs | MEDICAL_RECORD_NUMBER | NHS No. opened → [NHS_NUMBER_n] |
| Location | LOCATION | host WS-RAD-04 → [HOST] |
Compliance achieved
- Supports assessment against the NHS DSP Toolkit and the National Data Guardian's data security standards.
- Fits the retention approach in the Records Management Code of Practice for Health and Social Care 2021.
- Removes usernames, IPs, and timestamps as identifiers.
- Steady labels keep the viewing pattern analysable.
Anonymise EPR access logs offline — see plans & start free →
Limitations & cautions
An access record can re-identify by pattern alone: a single worker active at an odd hour on one ward may stand out after the username goes. Shift the times and weigh whether the pattern itself needs coarsening before you share.
Frequently asked questions
Why does the National Data Guardian's work matter to an access log?
One of the National Data Guardian's data security standards expects a provider to show that unauthorised staff cannot see patient information, and to review access to check that. The DSP Toolkit assesses providers against that expectation, so an access log is exactly the record it's built to review.
What is in an EPR access record?
Each entry shows a username, an IP or host, a timestamp, and the record opened. All of these identify a worker or a patient, so they are cleared for safe sharing.
Can one worker’s actions stay linked?
Yes. A steady map gives one user the same alias, so the sequence of actions is preserved even once the real username and IP are gone.