1. A method for detecting privacy violations of patient personal healthcare information (PHI) access comprising: at least one processor for performing the steps of: generating an audit log for an access to PHI by an authorized user ( 22 A- 22 E); comparing at least one parameter of the audit log to a corresponding baseline parameter of the access to PHI by the authorized user that is considered normal ( 58 ); assigning a risk score to the parameter of the audit log when the parameter of the audit log differs from the corresponding baseline parameter ( 60 ); and adding together all of the risk scores to determine a cumulative risk score ( 64 ).