Re: Confidentiality Policies in Dr's Off Site Office

[Daniel Downey <ddowney@u.washington.edu>]

  Our medical center assigns access levels to different types of staff.
  Doctors and direct providers of care have access to all dictated notes and
  labs. Psychiatrists however are the only ones to see mental health and
  substance abuse notes. The remainder of the staff (RNs, midlevels, support
  staff) get appropriately let access for their "need to know".
  
  The common feature among all these levels of access is an auditing system
  that we all know about and respect (?fear). Surfing the record of a
  patient whose hospital number doesn't match up with a table of your recent
  appointments (past 120 days, forward in time 90 days) will trigger an
  audit event and a letter. Repeat offenders (like an MD looking up his
  wife's CT scan) are turned over to their superiors (like section chief).
  So even the doctors respect the confidentiality of patient records.
  
  Marc's question is central to the issues of privacy of the medical record.
  
  Dan Downey, MD
  
  On Tue, 7 May 1996, Marc Carter wrote:
  
  > More and more hospitals are linking referring and attending physician
  > offices to their Hospital Information System or Integrated Health Network
  > (IHN) through PC based networks.  The benefits are obvious, physicians can
  > see the latest clinical data without having to call the Hospital.  In a very
  > real sense the walls of the Hospital are breaking down and with that the
  > "normal level" of control a Hospital would have on a patients medical record.
  >
  > How can a Hospital or IHN control unathorized physician office staff access
  > to its medical records?
  >
  > What is to stop a secretary/clerk from cruising the Master Patient Index and
  > finding her Uncle Joe, viewing his latest lab results, discovering that he
  > has a positive VDRL or whatever and blabbing it to the family over
  > Thanksgiving turkey.  Uncle Joe would have a very interesting legal case
  > regarding a breech of records confidentiality and would create a liability
  > issuer not only for the physician and Hospital but also the whole IHN.
  >
  > Does anyone have any successful experience in dealing with this question?
  >
  > Thanks,
  > Marc Carter <mcarter@cloud9.net>
  > Carter Consulting Group, Inc.
  >
  >
  
  +---------------------------+------------------------------------------------+
  | Dan Downey MD             |         Virginia Mason Clinic Plastic Surgery  |
  | ddowney@u.washington.edu  | Plastic, Reconstructive, and Cosmetic Surgery  |
  | pladld@vmmc.org           |              (206)223-6831  Fax:(206)223-6816  |
  |                           |                http://www.halcyon.com/ddowney/ |
  +----------------------------------------------------------------------------+
  | Disclaimer: all opinions are mine, and do not necessarily reflect those    |
  | of Virginia Mason Medical Center or the American Society of Plastic and    |
  | Reconstructive Surgery, Inc., especially if they're great ideas.           |
  +----------------------------------------------------------------------------+