Healthcare organisations approach employee monitoring with an assumption that turns out to be backwards. The worry is usually that HIPAA restricts what you can watch. In fact the Security Rule mandates a specific kind of watching, and the compliance risk runs in the other direction — toward not monitoring access to ePHI closely enough.
Where healthcare organisations genuinely do get into trouble is by conflating that mandated monitoring with workforce productivity measurement, and running both through one system. Those are different problems with different rules, and merging them creates exposure that neither would produce alone.
HIPAA requires monitoring, of a particular kind
Two provisions do the work.
The technical safeguard at 45 CFR 164.312(b) requires covered entities and business associates to implement hardware, software or procedural mechanisms that record and examine activity in information systems containing or using electronic protected health information. That is an audit logging requirement, and it is not optional.
The administrative safeguard at 164.308(a)(1)(ii)(D) requires procedures to regularly review records of information system activity — audit logs, access reports, security incident tracking. Logging without review does not satisfy it.
Read together, these say: know who touched which patient record, when, and have someone actually look. The canonical use case is the one everyone in healthcare has heard about, where a staff member looks up a celebrity's chart, or a neighbour's, or an ex-partner's. Detecting that is not surveillance overreach. It is the control working as designed.
What this monitoring covers is access to ePHI systems. It is bounded by the data, not by the person — the point is the record that was opened, not how the employee spent their afternoon.
What HIPAA does not cover
The second half is where organisations get confused. HIPAA protects individually identifiable health information held by a covered entity acting as a healthcare provider, plan or clearinghouse. Employment records held by an employer acting as an employer are outside its scope.
So your nurses' scheduling data, your billing team's application usage, your IT department's working hours are not HIPAA questions. They are ordinary employment and privacy questions, governed by state law in the US and by whatever regime applies elsewhere — our US state guide and the ECPA overview cover the American position, and the GDPR checklist covers Europe.
This matters because "we're a HIPAA-covered entity" is sometimes offered as a justification for broad workforce surveillance. It is not one. HIPAA's requirements attach to ePHI systems. Extending heavy collection across the whole workforce because some systems hold patient data is a proportionality failure in every jurisdiction that applies such a test, and HIPAA provides no cover for it.
Two systems, two purposes
The architecture that holds up separates them cleanly.
The ePHI audit layer lives with your EHR and clinical systems, is owned by security and compliance, retains records per your retention schedule and regulatory expectations, restricts access to a named group, and has a documented review cadence. Most EHR platforms provide much of this natively; where they do not, this is the legitimate use case for a user activity monitoring tool, scoped to the systems and roles that touch patient data.
The workforce analytics layer answers operational questions — where clinical staff lose time to administrative systems, whether the coding team is under-resourced, how much of a shift disappears into tool-switching between the EHR and four adjacent applications. It is owned by operations, aggregate by default, retains for months rather than years, and is visible to the people it measures.
Different owners, different retention, different access lists. If someone proposes collapsing them, the question to ask is which set of requirements the merged system will satisfy, because it cannot satisfy both.
The operational problem worth measuring
Healthcare has a well-documented version of a problem workforce analytics is actually good at: clinicians spending large fractions of their time in documentation rather than care, and administrative staff losing hours to systems that do not talk to each other.
That is a measurable, actionable finding. Time lost to EHR navigation, the number of application switches per patient encounter, where the prior-authorisation workflow stalls, which shift patterns correlate with the documentation backlog. This is capacity and workflow analysis, it does not require anyone's screen, and it produces the kind of evidence that justifies an IT investment.
It is also, not incidentally, one of the better arguments for monitoring that healthcare staff will accept. Burnout in clinical roles is severe and well-documented, and administrative burden is a substantial contributor. Analytics deployed to reduce that burden lands very differently from analytics deployed to check whether people are working — see spotting burnout early for the leading indicators, and the ethical monitoring principles for the trust mechanics.
Deploying it in a clinical environment
A few things are specific to healthcare and easy to get wrong.
Shared workstations are common, and they break per-user attribution. Know how your tool handles a terminal where six people badge in across a shift, because a system that attributes everything to whoever logged in first produces confidently wrong data.
Clinical staff are not desk workers, and measuring them as though they are produces nonsense. A nurse's screen time is a small and unrepresentative slice of their work. Analytics is most useful for the administrative and back-office population, and applying it to bedside staff mostly measures documentation burden — which is worth measuring, but only if you interpret it as such.
Union and works council obligations apply in many healthcare settings, and in Europe they carry a formal veto. Engage early.
And separate the messaging. Staff who hear "monitoring" in a HIPAA context assume you mean chart-access auditing, which they already expect. If you are deploying operational analytics as well, say plainly that it is a different system with a different purpose and does not feed compliance investigations — and then hold to that, because purpose creep here is both a trust failure and a legal one.
Where ProdView fits
ProdView is the second layer, not the first. It measures activity and application metadata — where time goes across systems, focus time, capacity, working patterns — never screen content or keystrokes, aggregate-first, with employees seeing the same dashboard their manager does. Configurable retention, SOC 2 Type II, one agent across Windows, macOS and Linux.
When not to pick us: you need HIPAA audit controls over ePHI systems. We do not provide them and cannot satisfy 164.312(b). Use your EHR's native auditing or a purpose-built UAM tool scoped to those systems, and keep it separate from operational analytics.
Try before you commit
Three seats are free forever, which is enough to test the administrative-burden question on one back-office team before deciding anything broader. Model the payback with the ROI calculator.
General information as of August 2026, not legal or compliance advice. Confirm your obligations with counsel and your privacy officer before deploying.