Winning the Battle of Patient Privacy vs Provider Access
I’m so excited to be here at HIMSS this week, and it’s not just because it’s in Florida in February! Healthcare is my passion, the vertical which focuses on preserving and transforming lives. It’s being driven by so many interesting technology breakthroughs and patient-centered initiatives right now! It’s a dynamic place to be. But the challenges are significant. Have you ever been stuck between a rock and hard place? Healthcare providers live with this situation every day. Governing bodies are putting in place policy and legislation to ensure patients have absolute control over their own data and choose who can see it. However, initiatives such as the Merit-based Incentive Payment System (MIPS) and Medicare and Medicaid’s Promoting Interoperability Program drive increased digitization and data sharing. This is a tension for those who have to try to meet both goals.
The Battle of Privacy vs AccessProviders’ priority is patient care and outcomes. Due to requirements for Promoting Interoperability (formerly Meaningful Use), Electronic Health Records (EHRs) contain more patient information than ever. With the collaborative nature of caregiving, clinicians access new patient records every day. This leads to three significant problems:
- Healthcare providers frequently have more access than needed. In order to not be impeded in patient health concerns, administrators grant providers excessive access—rarely is unnecessary access removed.
- If a clinician does not have access, granting emergency break-the-glass access is often done without governance and auditing.
- Even when administrators grant access, the correct access can be abused. A cardiologist may have access to all patient records at a hospital, but he should not be accessing the record for a neighbor who happens to be in labor and delivery. Historically it’s been a great challenge to sift through log data and validate people are doing what they should be with the access they have, and it’s only ever examined after a complaint has been filed.