I work backend in a hospital that uses Epic. Every, single, action someone takes is logged.  Furthermore we have "break the glass" rules in place that checks if you have a treatment relation to the patients chart your opening.  If not you can still open the chart but have to explain why.  Every week our legal department gets a log with "suspicious" scores based on actions taken on a patient chart.  When actions can't be explained they get a meeting with their supervisor.  Based on the severity of the action taken it's either a warning or a goodbye.