Comments on: Today Britney Spears, Tomorrow Joe Schmo

By: PalMD

PalMD — Mon, 17 Mar 2008 20:55:03 +0000

At our hospital, every access is logged. Perhaps these folks don’t know that their hospital likely does this, or figure the payoff might be worth it.At least in my part of the country, losing a job basically means losing a house.

By: Nomen Nescio

Nomen Nescio — Mon, 17 Mar 2008 20:21:57 +0000

i’d be interested to know just what positions these people held, and what kind of network access they had.access logging is generally fairly easy, certainly easier than locking people out of a system, but there’s almost always some alternate way into the data store if you have the right sort of access. “systems administrator”: the only person in the corporation who, despite being paid little more than the unionized janitors, has more access to confidential information than the CEO does. after all, somebody has to maintain the actual back-end database these records get stuffed into…

By: MattXIV

MattXIV — Mon, 17 Mar 2008 19:19:20 +0000

As the commenter above points out, access to electronic medical records generally has a warning and access logging rather than a hard stop since while protecting people’s privacy is important, preventing people from accessing someone’s record when they have a legitimate need is considered far worse. The access logging generally is enough to scare off people who don’t have a legitimate need to look at the patient’s chart and it’s probably how they know who looked at it.

By: Jim

Jim — Mon, 17 Mar 2008 16:38:43 +0000

I used to work for an electronic medical records company. The way we would secure the records is by recording any access to them. (Everyone knew access was logged; you want people to know their access is logged. They still had to log on to see any medical records.) You could designate a person’s medical records as sensitive (the entire record). In those cases the medical professional could still access the data, but they had to give a positive response that they knowingly were accessing sensitive information.The reasoning was that it was more important to let medical professionals access medical information that they may need and record the fact that they had done so than not allowing them to get at the information at all. Could more sophisticated checks be put in place -> eg only a select list of people could see a chart.? Yes, however that becomes very unweidly in a medical emergency where it is vital to know the information. (eg any known allergies, prior medical history, current medications, results of labs etc.)The penalties for violating HIPPA are very strict and taken seriously at hospitals.