NSW Health uses AI to help map staff access to digital patient record system

AI helps the state health department understand who needs what inside its electronic medical records platform.

You have probably sat through an access-control audit that felt like archaeology. Someone prints a spreadsheet of permissions granted three years ago, cross-references it with org charts that moved twice since then, and asks each manager whether their team still needs read rights to payroll or patient notes. By the time the exercise finishes, half the findings are stale and the other half wait for the next quarterly review.

NSW Health decided to point AI at that problem. The state health department is using machine learning to map which staff members hold access to its digital patient record system and whether those permissions still match their roles. The work turns a manual compliance task into a continuous model that can flag anomalies, suggest revocations and keep pace with the churn of hiring, transfers and departures that defines a workforce of tens of thousands.

What happened

NSW Health deployed an AI capability to analyse access patterns across its electronic medical records platform. The system ingests permission logs, compares them to role definitions and employment records, then surfaces cases where someone's access no longer aligns with their current job. The model does not revoke rights automatically; it generates a list of candidates for human review, so a manager or security officer can confirm the change before it takes effect.

The initiative sits inside a broader digital transformation that includes the statewide rollout of electronic health records, but the access-mapping layer is new. Traditional identity and access management tools can enforce policy once you write the rules. The AI layer helps you discover what the rules should be when your organisation is large enough that no single person knows every team's workflow and no static role-based access control template survives contact with clinical reality.

Why it matters for L&D and governance

Healthcare is one of the few sectors where access mistakes carry regulatory penalties, reputational damage and patient harm in equal measure. A nurse who retains admin privileges after moving to a non-clinical role can read records she no longer needs to see. A contractor who keeps system access after the contract ends creates an audit finding and a potential breach. Manual reviews catch some of those cases, but they are slow, expensive and often incomplete.

AI-driven access mapping does three things that matter for learning and development teams. First, it makes role definitions visible. When the model flags ten people in the same job title with wildly different permissions, that is a signal that the role itself is poorly defined or that training has been inconsistent. Second, it creates a feedback loop for onboarding. If new hires in a department consistently request the same additional access within their first month, the onboarding checklist is probably missing a step. Third, it turns compliance from a quarterly event into a continuous process, which means L&D can design just-in-time training for people whose roles are about to change rather than waiting for the next audit cycle to reveal a gap.

The model also exposes where informal knowledge transfer has replaced formal process. If a senior clinician's access profile looks nothing like their peers', either they have been granted exceptions for good reasons that should be documented, or they have accumulated permissions through years of ad-hoc requests that no one ever reviewed. Both cases are learning opportunities: the first tells you where the formal role definition is incomplete, the second tells you where governance has failed.

The capability question

Building an access-mapping model requires three capabilities that most health departments do not have in-house. You need people who understand identity and access management well enough to know which log fields matter. You need data scientists who can turn messy permission records into a training set. And you need domain experts who can validate the model's suggestions without slowing the system to a crawl.

NSW Health's approach suggests they either hired that mix or partnered with a vendor who could supply it. The harder question is what happens after deployment. AI models drift when the underlying data changes, and healthcare organisations change constantly. New roles appear, old ones get redefined, clinical workflows evolve and regulatory requirements shift. Keeping the model accurate means treating it as a capability that needs continuous learning, not a one-time implementation.

For L&D leaders in other sectors, the lesson is that AI tools for governance work best when they are paired with a learning system that can act on what the model reveals. If your AI flags a hundred access anomalies and you have no process for deciding which ones matter, you have built a noise generator. If you can route each finding to the right person with enough context to make a decision, and then feed those decisions back into training and onboarding, you have built a capability that compounds.

The stakes are lower outside healthcare, but the pattern holds. Access control is a proxy for role clarity, and role clarity is a prerequisite for effective learning. When you know what someone is supposed to do, you can train them to do it. When their permissions drift and no one notices, you have lost that clarity. AI can help you find it again, but only if you are willing to act on what it shows you.

Sources:

• iTnews