Possible Dismissal

This forum made possible through the generous support of SDN members, donors, and sponsors. Thank you.
This is incredible. Clearly your account was compromised. The simplest explanation, given that a single patient's information was accessed twice and one of those times was while you were not in town, is that another individual used your account to check on a person of interest to them.

I'm a complete layperson when it comes to this area, but were you on campus when the first incident occurred? If you were at home and using electronic devices, might it be possible to request logs of your electronic activity, including cell phone coordinates, email account access (IP address from your home/library/another terminal), home router history, etc. with the goal of establishing that you were not at the computer terminal? Alternatively, is it possible that you were doing something else at that specific time: rounding, scrubbed on a case, in lecture, in a research meeting, etc? I'm sure you've thought of all these, but there certainly has to be some way to establish innocence...

The reason I say this is incredible: I cannot believe your school would expel you for this EVEN if you were guilty. Letter in your file? Reasonable-ish. Stern warning and some kind of remedial professionalism training? Definitely. FWIW, some upper classmen committed a similar violation of an classmate's information (he/she was admitted to UH), and their response was a number of 1-on-1 meetings with the offenders (the outcome of which I don't know, but all of the people in that year went to residencies) and periodic reminder/threatening emails to those of us not at fault.

Either way, thanks for keeping us updated. We're rooting for you. Once you're graduated, I would totally call your school out for this. It is scary and absurd, and prospective applicants should factor this kind of anti-reason and anti-student administrative stance into their matriculation decisions.
 
This is incredible. Clearly your account was compromised. The simplest explanation, given that a single patient's information was accessed twice and one of those times was while you were not in town, is that another individual used your account to check on a person of interest to them.

I'm a complete layperson when it comes to this area, but were you on campus when the first incident occurred? If you were at home and using electronic devices, might it be possible to request logs of your electronic activity, including cell phone coordinates, email account access (IP address from your home/library/another terminal), home router history, etc. with the goal of establishing that you were not at the computer terminal? Alternatively, is it possible that you were doing something else at that specific time: rounding, scrubbed on a case, in lecture, in a research meeting, etc? I'm sure you've thought of all these, but there certainly has to be some way to establish innocence...

The reason I say this is incredible: I cannot believe your school would expel you for this EVEN if you were guilty. Letter in your file? Reasonable-ish. Stern warning and some kind of remedial professionalism training? Definitely. FWIW, some upper classmen committed a similar violation of an classmate's information (he/she was admitted to UH), and their response was a number of 1-on-1 meetings with the offenders (the outcome of which I don't know, but all of the people in that year went to residencies) and periodic reminder/threatening emails to those of us not at fault.

Either way, thanks for keeping us updated. We're rooting for you. Once you're graduated, I would totally call your school out for this. It is scary and absurd, and prospective applicants should factor this kind of anti-reason and anti-student administrative stance into their matriculation decisions.

Yes. Welcome to how seriously this is taken. 😕 if you Eff with the EMR, intentionally or not, you are usually screwed. It sucks but then again it makes sense from a certain angle

Sent from my DROID RAZR using SDN Mobile
 
This person wasn't of importance. No celeb or faculty. I will definitely fully update in June when I get done. There aren't any details that are negative just more case and circumstance specific that I will update. Lets see what happens with this process. At our school computers are always logged on. It wouldn't be that hard to go onto a computer and look up stuff if you wanted to. I have always liked EMR but after this experience and knowing IT I feel it is difficult to perfect the system. We can't get windows right and more money has been poured into it than EMR.
 
i guess my question wasnt if this was a celebrity, but out of the thousands of logins every student uses..howd this even come to ANYONES attention?

i understand you cant say anymore..

i hope things work out for you..

i think they will..
 
^ I think most institutions have safeguards built into the EMR system that help to identify HIPAA violations/unauthorized access.
 
^ I think most institutions have safeguards built into the EMR system that help to identify HIPAA violations/unauthorized access.

Really?

Would it cross reference every single attending/resident/student rotation, team assignment, and/or billing data to ensure that no unauthorized access had occurred?

What about mis-clicks performed from within system lists, patients with identical names, mis-typed MRN queries, access performed for IRB approved research purposes? What about informal peer-to-peer consults? Nursing stations left open and accessed by another floor nurse by mistake?

To me, random/complete surveillance sounds very, very difficult to implement well and would produce far more innocuous false positives, as in this case, than intentional violation of significant health information. Now, if a student or ex-president or other VIP is admitted, it seems totally reasonable to monitor every query of that individual's record and verify whether all those seeking access had an indication to do so.
 
Really?

Would it cross reference every single attending/resident/student rotation, team assignment, and/or billing data to ensure that no unauthorized access had occurred?

What about mis-clicks performed from within system lists, patients with identical names, mis-typed MRN queries, access performed for IRB approved research purposes? What about informal peer-to-peer consults? Nursing stations left open and accessed by another floor nurse by mistake?

That sort of stuff happens all the time; when I'm working at a multi-hospital system, you can better believe there is more than one Betty Smith in the EMR and that its easy to open the wrong chart. That is recognized.

Nursing stations left open is a problem which is why people are instructed to log off when they leave the terminal. They never do - I can walk up to any station in the hospital and fin that every desk top has someone logged in (nurse or MD/DO) as do most of the COWs.

The problem is when the person being checked is an employee, student or VIP. I often operate on nurses at the hospitals I go to; I know my activity in their charts is monitored because I get a pop-up menu when I first check it. Once I've verfied that I am their attending (and it shows they are admitted to me), it doesn't pop up again, but I'm sure its tracked. Way back in the day, we also had a nurse fired for checking files on cute male surgical residents.

So in the OP's case; a classmate's record was accessed. That is an issue unless you were on the treating team. For example, I was called by IT when I was a 3rd year resident because I accessed the chart of one of the Vascular Fellows. He had been admitted to the MICU with a GI bleed and I was on call for Gen Surgery consults. My accessing his record was valid and it was documented and no problems. However, if someone is accessing another student's records and that student is not a patient and the person accessing is not a member of the treating team, its a problem.

That being said, surely there has to be ways that the OP can prove that he was elsewhere at the time of the supposed transgression.
 
Thanks guys. That's what I am trying to prove that I didn't do it. I refuse to see students for this reason.
 
I don't understand how this happens to me. I am always by the book. Maybe medicine isn't for me if I can't handle this how will I handle a lawsuit.
 
I don't understand how this happens to me. I am always by the book. Maybe medicine isn't for me if I can't handle this how will I handle a lawsuit.

Whoa. Whoa. No innocent person would "handle this" well. Stay the course and fight!
 
I don't understand how this happens to me. I am always by the book. Maybe medicine isn't for me if I can't handle this how will I handle a lawsuit.

now youre gettting it..this is why docs practice defensive medicine and it drives up healthcare costs..

you cant have hc reform without tort reform...
 
I don't understand how a student can pull a student's electronic chart. Our school's EMR in the clinics has us at an access level that we cannot view charts belonging to staff, students, or physicians affiliated with the school. Perhaps its more difficult to do when you're not only doing it for a few family medicine offices but also an entire hospital system.
 
The reason I say this is incredible: I cannot believe your school would expel you for this EVEN if you were guilty. Letter in your file? Reasonable-ish. Stern warning and some kind of remedial professionalism training? Definitely.

My hospital has been sending out announcements about their new policy that accessing a patient's EMR without a valid clinical or business reason is grounds for immediate dismissal. For some reason, the bureaucrats in our increasingly Brave New World-esque society have decided this is the latest unspeakable crime against humanity.
 
I don't understand how a student can pull a student's electronic chart. Our school's EMR in the clinics has us at an access level that we cannot view charts belonging to staff, students, or physicians affiliated with the school. Perhaps its more difficult to do when you're not only doing it for a few family medicine offices but also an entire hospital system.

Hmmm...I'll ask my student tomorrow if that's the case for her.

I know that wasn't the case for students when I was a resident (different hospital of course).
 
My hospital has been sending out announcements about their new policy that accessing a patient's EMR without a valid clinical or business reason is grounds for immediate dismissal. For some reason, the bureaucrats in our increasingly Brave New World-esque society have decided this is the latest unspeakable crime against humanity.

How do they handle misclicking on the wrong name? Half the bloody hospital will likely be canned in a year.
 
It's not the case for us but would be easy to implement the way you describe. It would be a simple flag in the database query. I don't remember it being this brutal in the corporate world. It's a little extreme. We were dealing with personal information as well. I find out this week. Hoping I can appeal.
 
How do they handle misclicking on the wrong name? Half the bloody hospital will likely be canned in a year.

The realistic answer is that despite these organizations' constant threatening reminders that all activity is logged, no one is looking at each click to make sure it was for an acceptable reason. What likely happens is that if the patient is a VIP or employee, a flag goes up, and a list of these flagged events is generated and sent to someone for review. Realisically, what usually happens is probably nothing more than that the person skims over it, and if it looks at all feasible that the person had a reason to access the chart, they ignore it. (I say this on the basis of having had patients with protected records, getting pop-ups saying "if you proceed, you will be contacted to give your justification" but never actually being contacted.)
 
It's not the case for us but would be easy to implement the way you describe. It would be a simple flag in the database query. I don't remember it being this brutal in the corporate world. It's a little extreme. We were dealing with personal information as well. I find out this week. Hoping I can appeal.

I don't see how your school would just totally expel you without first being able to prove you were the one who accessed the chart or at the least gave your contact info out, both being violations of HIPAA. If what you say is true it should be easy to show it was not you who accessed the chart. There should be some evidence somewhere that it was another person. The question is who was this other person and how could they have used your login? I take your word you didn't give it out so there must be a reason as to how your login was then used to access the chart. I think if they can show who actually performed the act they could find out how the login was used.

I just doubt you'll be dismissed, especially at this point. They probably need to sit down and talk with you to see what happened and then they will go from there.
 
Agree c above...and couldn't say it better. Frankly, I'd be quite offended if my Med School threatened dismissal sans process...after 4 years, I would hope they'd know my character a bit better than that. I tend to be a "hot-head" about things like this - I'd probably threaten a defamation of character suit or something (I wouldn't have grounds...this is not advisable).

It's not in the school's interests to dismiss you (assuming your nose is truly clean, and I have no reason to doubt that it is). I can't fault you for being nervous/emotional...I would be as well. But pragmatically, it's a huge deal to dismiss a student for any reason (from legal, ethical and PR perspectives); I'm doubtful that they'll go that far.

Hoping for a good outcome; hang in there!
 
i guess my question wasnt if this was a celebrity, but out of the thousands of logins every student uses..howd this even come to ANYONES attention?
Oh, they do random screens. They supposedly do them at my facility, but everyone who works here gets treated here as well, so it must be a complicated set-up. I've cared for, operated on, and accessed the records of physicians, nurses, residents, techs, managers, IT personnel, etc. Plus, I've done research with chart reviews, and I've seen even more records (not just a few of which I recognized).

Really?

Would it cross reference every single attending/resident/student rotation, team assignment, and/or billing data to ensure that no unauthorized access had occurred?

What about mis-clicks performed from within system lists, patients with identical names, mis-typed MRN queries, access performed for IRB approved research purposes? What about informal peer-to-peer consults? Nursing stations left open and accessed by another floor nurse by mistake?

To me, random/complete surveillance sounds very, very difficult to implement well and would produce far more innocuous false positives, as in this case, than intentional violation of significant health information. Now, if a student or ex-president or other VIP is admitted, it seems totally reasonable to monitor every query of that individual's record and verify whether all those seeking access had an indication to do so.
Yes, they do monitor your usage.

No, they probably don't red flag a chart/record when a med student is admitted :laugh: Students (and residents) are not VIPs.

The problem is when the person being checked is an employee, student or VIP. I often operate on nurses at the hospitals I go to; I know my activity in their charts is monitored because I get a pop-up menu when I first check it. Once I've verfied that I am their attending (and it shows they are admitted to me), it doesn't pop up again, but I'm sure its tracked. Way back in the day, we also had a nurse fired for checking files on cute male surgical residents.
CPRS (the VA system) will warn you as well, but there's no warning/acknowledgement on our system.

So in the OP's case; a classmate's record was accessed. That is an issue unless you were on the treating team. For example, I was called by IT when I was a 3rd year resident because I accessed the chart of one of the Vascular Fellows. He had been admitted to the MICU with a GI bleed and I was on call for Gen Surgery consults. My accessing his record was valid and it was documented and no problems. However, if someone is accessing another student's records and that student is not a patient and the person accessing is not a member of the treating team, its a problem.
You'd think they could have figured that out without calling you...
 
You'd think they could have figured that out without calling you...

One would think.

I'm sure it was a just a knee jerk protocol that all staff accessing other staff files generates a report and a call (after all, it had just been the year or two before when the nurse mentioned above was fired checking out resident's birthdates, and phone numbers).

There was something about GI Bleeds in our department; our PC had one a few years later as well.
 
Yes, they do monitor your usage.

No, they probably don't red flag a chart/record when a med student is admitted :laugh: Students (and residents) are not VIPs.
I've no doubt that they monitor my usage extensively. Which is to say, it gets translated into a bunch of 1s and 0s and put onto a database somewhere for later review should there be an issue.

I disagree with your second point, though. We are all entitled to privacy of our health information. Those most likely to be accessed without permission are those that are interesting to a hospital's employees: attendings, staff, celebrities, nurses, and yes, students and residents. (The average hospital donor or potential donor, which is the more common usage of "VIP" in my experience, may not represent much extra risk if he or she is not a household name.)

Student patients may be at greater risk of having their information violated due to the nature of medical school classes: compared to others with unrestricted EMR access, they are younger, less mature, and have not been around long enough to see punitive action taken against those violating HIPPA. In my n=1 experience, violation of student protected information has occurred on at least 2 occasions. It's clearly a problem and if anyone is deserving of extra monitoring, students ought not be excluded because of their perceived lesser importance to your team. To suggest that student/resident patients deserve less protection than other employees is kind of offensive.

EDIT: Given that "violations" of various degrees of maliciousness are occurring continually, I'll grant you that hospitals are probably doing constant PR damage control. As such, celebrities and athletes and persons of public interest, whose information is most likely to be widely disseminated, probably merit extra protection from a practical standpoint. I still don't think it's necessarily "right" though.

Oh, they do random screens. They supposedly do them at my facility, but everyone who works here gets treated here as well, so it must be a complicated set-up. I've cared for, operated on, and accessed the records of physicians, nurses, residents, techs, managers, IT personnel, etc. Plus, I've done research with chart reviews, and I've seen even more records (not just a few of which I recognized).

I've performed hundreds, if not thousands, of mis-clicks, MRN mistakes, same-name mistakes, and so on. I have done (approved) chart reviews requiring access to >700 individual's charts (some of whom were attending physicians, some VIP including politicians and celebrities). If my activity's not been "flagged" as yet, I cannot imagine what I could possibly do to bring that about.

I do not know any more than the average person, but like a few other posters have suggested, I believe the only way to monitor this would be at the individual chart level. If they were to investigate the entirety of my activity and ask me to justify each access, I'd just pack my bags and show myself out. Luckily, the OP's hospital administration seems to be alone in their heavy handedness and inability to think critically about the problem.
 
Last edited:
I disagree with your second point, though. We are all entitled to privacy of our health information. Those most likely to be accessed without permission are those that are interesting to a hospital's employees: attendings, staff, celebrities, nurses, and yes, students and residents. (The average hospital donor or potential donor, which is the more common usage of "VIP" in my experience, may not represent much extra risk if he or she is not a household name.)
Flagging all of those for every record access would probably be an unreasonable amount of work. They may have a trigger for a student accessing another student's record, but how does it make sense to trigger every access of a student's record? That means if you were admitted for appendicitis, every person who cared for you would trigger the alert, and they would all have to be reviewed.

I strongly suspect they have algorithms in place that look for usage patterns. I know that our EMR knows how long it's been since someone was seen at our facility, so if it's been a while, you have to punch in the reason why you're accessing the record (pt treatment, research, billing, etc). If a student is admitted, has a flurry of people accessing the record, is discharged, and then two weeks later, another student accesses the record, it would make the most sense for only that last accession to garner interest.

EDIT: Given that "violations" of various degrees of maliciousness are occurring continually, I'll grant you that hospitals are probably doing constant PR damage control. As such, celebrities and athletes and persons of public interest, whose information is most likely to be widely disseminated, probably merit extra protection from a practical standpoint. I still don't think it's necessarily "right" though.

I do not know any more than the average person, but like a few other posters have suggested, I believe the only way to monitor this would be at the individual chart level. If they were to investigate the entirety of my activity and ask me to justify each access, I'd just pack my bags and show myself out. Luckily, the OP's hospital administration seems to be alone in their heavy handedness and inability to think critically about the problem.
It's actually probably not very hard to write algorithms that address most of these things.
 
How do they handle misclicking on the wrong name? Half the bloody hospital will likely be canned in a year.

That's a really good point ... Hope OP stays course and sees justice done...this is a bunch of BS that it's happening at all :-(
 
Flagging all of those for every record access would probably be an unreasonable amount of work. They may have a trigger for a student accessing another student's record, but how does it make sense to trigger every access of a student's record? That means if you were admitted for appendicitis, every person who cared for you would trigger the alert, and they would all have to be reviewed.

I strongly suspect they have algorithms in place that look for usage patterns. I know that our EMR knows how long it's been since someone was seen at our facility, so if it's been a while, you have to punch in the reason why you're accessing the record (pt treatment, research, billing, etc). If a student is admitted, has a flurry of people accessing the record, is discharged, and then two weeks later, another student accesses the record, it would make the most sense for only that last accession to garner interest.


It's actually probably not very hard to write algorithms that address most of these things.

At some places employees records are protected and you have to be click through some stuff to get access (or be granted, not sure). These are probably flagged for review from time to time. I am not sure if residents/students are treated as employees but they should be. It only makes sense and these things are not hard to set up as it would be with other "VIP" patients.

Me... I'm just going to avoid using my employer as my health care provider to avoid all these issues. I really don't want my physicians to also be the ones who evaluate me. Need to have these things separate.
 
So the update so far is there is a glitch in the IT system that allows for multiple logins to same station. They are going to evaluate this further and see if I had any wrongdoing. But I think I am in the clear. I have never felt so relieved. Damn IT.
 
So the update so far is there is a glitch in the IT system that allows for multiple logins to same station. They are going to evaluate this further and see if I had any wrongdoing. But I think I am in the clear. I have never felt so relieved. Damn IT.

👍

Sent from my DROID RAZR using SDN Mobile
 
So the update so far is there is a glitch in the IT system that allows for multiple logins to same station. They are going to evaluate this further and see if I had any wrongdoing. But I think I am in the clear. I have never felt so relieved. Damn IT.

Dude your school pulled a huge douche move with how they treated you in this matter. Seriously I could see if you had any sort of history of some wrong doing but it sounds like they didn't give you even the benefit of the doubt... and this is something they could have easily fully investigated without telling you that you may be dismissed.

I'd bad mouth them to your friends and people who may want to go to med school and I wouldn't do residency at their program.
 
I'd bad mouth them to your friends and people who may want to go to med school and I wouldn't do residency at their program.

I agree it was mishandled. I don't think there's any need to badmouth them, however. The details are damning enough.

Simply delete any past identifying posts of yours, retell this story including the name of your school, and link it to pre-Allo each application season. Allow prospective students to decide if they want to risk their tuition, past achievements, multiple years of their life, and future earnings on a school and administration that treats its students this way for a first "offense" of which they are clearly innocent.

I mean, imagine if you hadn't been cleared by IT? Your admin showed their true colors when they threatened expulsion if you couldn't provide a higher level of evidence than not being in the freakin' state. Or keep it to yourself and allow admins everywhere to continue getting away with wild west style, shoot from the hip and don't-think-too-much brand of "professionalism" policemanship.
 
Dude your school pulled a huge douche move with how they treated you in this matter. Seriously I could see if you had any sort of history of some wrong doing but it sounds like they didn't give you even the benefit of the doubt... and this is something they could have easily fully investigated without telling you that you may be dismissed.

I'd bad mouth them to your friends and people who may want to go to med school and I wouldn't do residency at their program.

I second that...if I were you, the day after I graduate I would send a letter to dean of the med school, hospital department head of IT and president of the hospital detailing what happened and calling out the IT people by name that tried to screw you over.

It's is cruel and unusually to make someone go through what you did.
 
I'm glad it worked out. I don't even know you and I would have been pissed if they kicked you out as a fourth year. Good luck in residency next year (and don't look back!)
 
Sounds like this will be resolved in the OP's favor, which is great.

I wanted to restate something mentioned above: You are responsible for everything that is done in the EMR from your login. If you log into a public kiosk / COW and walk away, and someone else accesses a record from there, you are absolutely "liable" for that. Health care organizations are getting very strict over record access, and "1 strike and you're out" rules are becoming more common. There is some sense to this -- before the EMR I would actually need to go to medical records, or pull the chart off a rack, where someone could see me. Now, I can look at any chart I want from home.

Our system also has a "break glass" solution, where if you try to access someone who is "connected" to the medical center -- any employee, student, or VIP -- you get an extra chance to abort. A prior institution had the solution listed above -- searching for employees by name didn't work, you needed to search by MRN, or pull them up on a schedule. That solution worked best.

Some EMR's allow you to check access on your own records. A complaint generated by the patient will often be taken much more seriously than one found on routine surveillance.
 
Glad things seem to be turning out ok for you.

I'd definitely agree that the situation was mishandled. From what's described here, especially since they knew you were gone on a rotation for one of those access times, it sounds like what should have happened was probably notifying you that unauthorized access was documented from your login, including at a time you weren't even there and letting you know they were looking into it and asking you if you had any relevant information to contribute.

All employees are flagged at our institution, plus we have a lot of VIPs as well. As far as the accidental click goes, I think they also track how long you're in the record. So if you click in, realize you're in the wrong patient and exit, it shouldn't be a problem.

We got really frustrated when they updated our EMR system awhile back. I was working nights in the bloodbank and we'd have to be logged into the computer at multiple stations and have to run back and forth during the night. It was pretty common for colleagues to hop on and off different computers to get the blood out quickly and we had to manually log into and out of our lab system so it wasn't an issue. But the medical record system auto logged you in if you clicked the EMR icon using the desktops user log in, so it would have been very easy for someone to access records under your name while you were doing something on the other side of the lab. Prior to that, you had to click the EMR icon and log in. We complained and I guess a bunch of other people did too so they decided to work on it.
 
wow that's so ridiculous..glad it worked for you but i would sit down and talk to your Executive Dean..and respectfully tell them that this was not at all handled professionally and how much it basically traumatized you for days (essentially ruined your entire christmas/new years)..school administrators love to preach about professionalism, they should be held to even higher standards due to their position and this was completely unprofessional..do it tactfully and respectfully so that they dont make the same mistake again with another student in the future..i would not be able to sleep for days or get out of bed if this happened to me
 
wow that's so ridiculous..glad it worked for you but i would sit down and talk to your Executive Dean..and respectfully tell them that this was not at all handled professionally and how much it basically traumatized you for days (essentially ruined your entire christmas/new years)..school administrators love to preach about professionalism, they should be held to even higher standards due to their position and this was completely unprofessional..do it tactfully and respectfully so that they dont make the same mistake again with another student in the future..i would not be able to sleep for days or get out of bed if this happened to me

I'd hold off on making any waves until this is officially settled down. I'm glad it's working out in your favor now Seeker, just let the issue lie until it's official 🙂
 
If I were the OP I'd mail a letter to myself that said, simply, "Never again reject my love for you" . The letter would be in an envelope with a return to sender of: the dean. I would then schedule a meeting with the president of the school and hand him the letter and tell them you are in fear of your career.

Same principles apply. Same logic. Same crack evidence. Same consequences?
 
So the update so far is there is a glitch in the IT system that allows for multiple logins to same station. They are going to evaluate this further and see if I had any wrongdoing. But I think I am in the clear. I have never felt so relieved. Damn IT.

=D That's very promising, especially when you consider the field day your lawyer could have with this new information if they actually proceeded with dismissing you at this point. I'm thinking they may have wanted to try to intimidate you badly enough that you would break down and confess sharing your password at some point and beg for forgiveness. Didn't you say they were the first ones to realize you couldn't possibly have done this directly? 😕
 
If I were the OP I'd mail a letter to myself that said, simply, "Never again reject my love for you" . The letter would be in an envelope with a return to sender of: the dean. I would then schedule a meeting with the president of the school and hand him the letter and tell them you are in fear of your career.

Same principles apply. Same logic. Same crack evidence. Same consequences?

:nono:
 
My school doesn't flag employees but they do randomly screen the entire EMR for access. I've never heard of anyone getting in trouble for accessing records.
 
Top