Access-log anonymisation is the removal of identifying detail from an EPR audit log: usernames, IP addresses, and timestamps. The NHS DSP Toolkit sets the bar for such records. anonym.plus does this on your own device, keeping the viewing pattern.
When this applies
An audit log shows which worker opened which record and when. To study these patterns or train a model, the usernames, IPs, and patient links must come out.
How anonym.plus handles it
- Point anonym.plus at the log on your server.
- It scans username, IP, host, and timestamp fields.
- Steady labels keep one worker’s actions linked.
- Review the summary and tune the field rules.
- Swap each identifier, shifting times to keep the order.
- Save the clean export. Source entries stay local.
What you need to provide
- The log (CSV, JSON, or audit export).
- A field map for username, IP, and host columns.
- Replace with a steady map to keep action chains.
Patient data entity types detected
| Category | anonym.plus entity type | Example |
|---|---|---|
| Staff ID | ID | user jmertens → [USER_n] |
| Network | IP_ADDRESS | 10.14.2.9 → [IP_n] |
| Dates | DATE_TIME | 08:42:11 access → shifted [TIME] |
| Patient | PERSON | viewed record: A. Roth → [PATIENT] |
| Record IDs | MEDICAL_RECORD_NUMBER | NHS No. opened → [NHS_NUMBER_n] |
| Location | LOCATION | host WS-RAD-04 → [HOST] |
Compliance achieved
- Supports compliance with the NHS DSP Toolkit by keeping audit records off the cloud.
- Removes usernames, IPs, and timestamps as identifiers.
- Steady labels keep the viewing pattern analysable.
Anonymise EPR access logs offline — see plans & start free →
Limitations & cautions
An access record can re-identify by pattern alone: a single worker active at an odd hour on one ward may stand out after the username goes. Shift the times and weigh whether the pattern itself needs coarsening before you share.
Frequently asked questions
What is in an EPR access record?
Each entry shows a username, an IP or host, a timestamp, and the record opened. All of these identify a worker or a patient, so they are cleared for safe sharing.
Why does the NHS DSP Toolkit matter here?
The toolkit sets controls around who may view a patient record. Keeping access records on-device and anonymising them before reuse supports those controls.
Can one worker’s actions stay linked?
Yes. A steady map gives one user the same alias, so the sequence of actions is preserved.