<![CDATA[Digital transformation in the healthcare sector has driven the adoption of clinic information systems for computerized management of patient medical records. Sensitive data security is threatened by user behavior deviations, requiring immediate detection mechanisms. This study aims to identify anomalous activity patterns and indicators from user log records, including unusual database operation frequencies, abnormal access times, and suspicious data manipulation patterns.The Local Outlier Factor algorithm functions to systematically calculate the local density score of each data point relative to its nearest neighbors. This method detects user activities that deviate significantly from normal patterns in daily clinic operational systems. The K-Means Clustering algorithm groups detected anomalous data into clusters based on similarity of user activity feature characteristics. The clustering facilitates administrator categorization of occurring anomaly types along with threat severity levels to the system.Research data were obtained from user activity log records of the clinic information system at Klinik Utama RIDDA Payakumbuh, which underwent preprocessing stages including data cleaning, feature transformation, value normalization, and handling of missing values.Test results demonstrate that the combination of LOF and K-Means achieved accuracy of 89.5%, precision of 87.3%, and recall of 85.7% on the test dataset. These validation metrics prove that the method effectively addresses user behavior deviation detection in the clinic environment. The test results affirm that the hybrid approach can identify suspicious activities with minimal error rates, ensuring reliability. The research contribution provides practical impact for clinic information system administrators in supervising patient data security through integrated early warning mechanisms.]]>
