- Joined
- Feb 1, 2012
- Messages
- 8,219
- Reaction score
- 97
was the person that you allegedly looked up someone of importance? how did they even jump on this??
And does the school know who it was?
Sent from my DROID RAZR using SDN Mobile
was the person that you allegedly looked up someone of importance? how did they even jump on this??
This is incredible. Clearly your account was compromised. The simplest explanation, given that a single patient's information was accessed twice and one of those times was while you were not in town, is that another individual used your account to check on a person of interest to them.
I'm a complete layperson when it comes to this area, but were you on campus when the first incident occurred? If you were at home and using electronic devices, might it be possible to request logs of your electronic activity, including cell phone coordinates, email account access (IP address from your home/library/another terminal), home router history, etc. with the goal of establishing that you were not at the computer terminal? Alternatively, is it possible that you were doing something else at that specific time: rounding, scrubbed on a case, in lecture, in a research meeting, etc? I'm sure you've thought of all these, but there certainly has to be some way to establish innocence...
The reason I say this is incredible: I cannot believe your school would expel you for this EVEN if you were guilty. Letter in your file? Reasonable-ish. Stern warning and some kind of remedial professionalism training? Definitely. FWIW, some upper classmen committed a similar violation of an classmate's information (he/she was admitted to UH), and their response was a number of 1-on-1 meetings with the offenders (the outcome of which I don't know, but all of the people in that year went to residencies) and periodic reminder/threatening emails to those of us not at fault.
Either way, thanks for keeping us updated. We're rooting for you. Once you're graduated, I would totally call your school out for this. It is scary and absurd, and prospective applicants should factor this kind of anti-reason and anti-student administrative stance into their matriculation decisions.
^ I think most institutions have safeguards built into the EMR system that help to identify HIPAA violations/unauthorized access.
Really?
Would it cross reference every single attending/resident/student rotation, team assignment, and/or billing data to ensure that no unauthorized access had occurred?
What about mis-clicks performed from within system lists, patients with identical names, mis-typed MRN queries, access performed for IRB approved research purposes? What about informal peer-to-peer consults? Nursing stations left open and accessed by another floor nurse by mistake?
I don't understand how this happens to me. I am always by the book. Maybe medicine isn't for me if I can't handle this how will I handle a lawsuit.
I don't understand how this happens to me. I am always by the book. Maybe medicine isn't for me if I can't handle this how will I handle a lawsuit.
The reason I say this is incredible: I cannot believe your school would expel you for this EVEN if you were guilty. Letter in your file? Reasonable-ish. Stern warning and some kind of remedial professionalism training? Definitely.
I don't understand how a student can pull a student's electronic chart. Our school's EMR in the clinics has us at an access level that we cannot view charts belonging to staff, students, or physicians affiliated with the school. Perhaps its more difficult to do when you're not only doing it for a few family medicine offices but also an entire hospital system.
I don't understand how this happens to me. I am always by the book. Maybe medicine isn't for me if I can't handle this how will I handle a lawsuit.
My hospital has been sending out announcements about their new policy that accessing a patient's EMR without a valid clinical or business reason is grounds for immediate dismissal. For some reason, the bureaucrats in our increasingly Brave New World-esque society have decided this is the latest unspeakable crime against humanity.
How do they handle misclicking on the wrong name? Half the bloody hospital will likely be canned in a year.
It's not the case for us but would be easy to implement the way you describe. It would be a simple flag in the database query. I don't remember it being this brutal in the corporate world. It's a little extreme. We were dealing with personal information as well. I find out this week. Hoping I can appeal.
Oh, they do random screens. They supposedly do them at my facility, but everyone who works here gets treated here as well, so it must be a complicated set-up. I've cared for, operated on, and accessed the records of physicians, nurses, residents, techs, managers, IT personnel, etc. Plus, I've done research with chart reviews, and I've seen even more records (not just a few of which I recognized).i guess my question wasnt if this was a celebrity, but out of the thousands of logins every student uses..howd this even come to ANYONES attention?
Yes, they do monitor your usage.Really?
Would it cross reference every single attending/resident/student rotation, team assignment, and/or billing data to ensure that no unauthorized access had occurred?
What about mis-clicks performed from within system lists, patients with identical names, mis-typed MRN queries, access performed for IRB approved research purposes? What about informal peer-to-peer consults? Nursing stations left open and accessed by another floor nurse by mistake?
To me, random/complete surveillance sounds very, very difficult to implement well and would produce far more innocuous false positives, as in this case, than intentional violation of significant health information. Now, if a student or ex-president or other VIP is admitted, it seems totally reasonable to monitor every query of that individual's record and verify whether all those seeking access had an indication to do so.
CPRS (the VA system) will warn you as well, but there's no warning/acknowledgement on our system.The problem is when the person being checked is an employee, student or VIP. I often operate on nurses at the hospitals I go to; I know my activity in their charts is monitored because I get a pop-up menu when I first check it. Once I've verfied that I am their attending (and it shows they are admitted to me), it doesn't pop up again, but I'm sure its tracked. Way back in the day, we also had a nurse fired for checking files on cute male surgical residents.
You'd think they could have figured that out without calling you...So in the OP's case; a classmate's record was accessed. That is an issue unless you were on the treating team. For example, I was called by IT when I was a 3rd year resident because I accessed the chart of one of the Vascular Fellows. He had been admitted to the MICU with a GI bleed and I was on call for Gen Surgery consults. My accessing his record was valid and it was documented and no problems. However, if someone is accessing another student's records and that student is not a patient and the person accessing is not a member of the treating team, its a problem.
You'd think they could have figured that out without calling you...
hey Winged..funny how we remember the important things from orientation huh?
I've no doubt that they monitor my usage extensively. Which is to say, it gets translated into a bunch of 1s and 0s and put onto a database somewhere for later review should there be an issue.Yes, they do monitor your usage.
No, they probably don't red flag a chart/record when a med student is admittedStudents (and residents) are not VIPs.
Oh, they do random screens. They supposedly do them at my facility, but everyone who works here gets treated here as well, so it must be a complicated set-up. I've cared for, operated on, and accessed the records of physicians, nurses, residents, techs, managers, IT personnel, etc. Plus, I've done research with chart reviews, and I've seen even more records (not just a few of which I recognized).
Flagging all of those for every record access would probably be an unreasonable amount of work. They may have a trigger for a student accessing another student's record, but how does it make sense to trigger every access of a student's record? That means if you were admitted for appendicitis, every person who cared for you would trigger the alert, and they would all have to be reviewed.I disagree with your second point, though. We are all entitled to privacy of our health information. Those most likely to be accessed without permission are those that are interesting to a hospital's employees: attendings, staff, celebrities, nurses, and yes, students and residents. (The average hospital donor or potential donor, which is the more common usage of "VIP" in my experience, may not represent much extra risk if he or she is not a household name.)
It's actually probably not very hard to write algorithms that address most of these things.EDIT: Given that "violations" of various degrees of maliciousness are occurring continually, I'll grant you that hospitals are probably doing constant PR damage control. As such, celebrities and athletes and persons of public interest, whose information is most likely to be widely disseminated, probably merit extra protection from a practical standpoint. I still don't think it's necessarily "right" though.
I do not know any more than the average person, but like a few other posters have suggested, I believe the only way to monitor this would be at the individual chart level. If they were to investigate the entirety of my activity and ask me to justify each access, I'd just pack my bags and show myself out. Luckily, the OP's hospital administration seems to be alone in their heavy handedness and inability to think critically about the problem.
How do they handle misclicking on the wrong name? Half the bloody hospital will likely be canned in a year.
Flagging all of those for every record access would probably be an unreasonable amount of work. They may have a trigger for a student accessing another student's record, but how does it make sense to trigger every access of a student's record? That means if you were admitted for appendicitis, every person who cared for you would trigger the alert, and they would all have to be reviewed.
I strongly suspect they have algorithms in place that look for usage patterns. I know that our EMR knows how long it's been since someone was seen at our facility, so if it's been a while, you have to punch in the reason why you're accessing the record (pt treatment, research, billing, etc). If a student is admitted, has a flurry of people accessing the record, is discharged, and then two weeks later, another student accesses the record, it would make the most sense for only that last accession to garner interest.
It's actually probably not very hard to write algorithms that address most of these things.
So the update so far is there is a glitch in the IT system that allows for multiple logins to same station. They are going to evaluate this further and see if I had any wrongdoing. But I think I am in the clear. I have never felt so relieved. Damn IT.
So the update so far is there is a glitch in the IT system that allows for multiple logins to same station. They are going to evaluate this further and see if I had any wrongdoing. But I think I am in the clear. I have never felt so relieved. Damn IT.
I'd bad mouth them to your friends and people who may want to go to med school and I wouldn't do residency at their program.
Dude your school pulled a huge douche move with how they treated you in this matter. Seriously I could see if you had any sort of history of some wrong doing but it sounds like they didn't give you even the benefit of the doubt... and this is something they could have easily fully investigated without telling you that you may be dismissed.
I'd bad mouth them to your friends and people who may want to go to med school and I wouldn't do residency at their program.
wow that's so ridiculous..glad it worked for you but i would sit down and talk to your Executive Dean..and respectfully tell them that this was not at all handled professionally and how much it basically traumatized you for days (essentially ruined your entire christmas/new years)..school administrators love to preach about professionalism, they should be held to even higher standards due to their position and this was completely unprofessional..do it tactfully and respectfully so that they dont make the same mistake again with another student in the future..i would not be able to sleep for days or get out of bed if this happened to me
So the update so far is there is a glitch in the IT system that allows for multiple logins to same station. They are going to evaluate this further and see if I had any wrongdoing. But I think I am in the clear. I have never felt so relieved. Damn IT.
If I were the OP I'd mail a letter to myself that said, simply, "Never again reject my love for you" . The letter would be in an envelope with a return to sender of: the dean. I would then schedule a meeting with the president of the school and hand him the letter and tell them you are in fear of your career.
Same principles apply. Same logic. Same crack evidence. Same consequences?