Neehr Perfect EHR Activity Introduction to Privacy, Security and Confidentiality

Neehr Perfect EHR Activity – Introduction to Privacy, Security and Confidentiality

Overview

This activity is intended for the Intermediate and Advanced EHR student user. In this activity you will be introduced to the basic aspects related to privacy, security and confidentiality for both the consumer and the healthcare worker.

Student Instructions

Access the EHR and follow the steps outlined in the activity below. Students will need to use their portfolios (the chart with your name on it) to post their answers. Log into the EHR and go to the notes sections, select "new note" from the left side panel. In the progress note selection box, type "Untemplated” select the "Untemplated nurse progress note" Select your faculty as the co-signer. Type or cut and paste your answers into the note and select save to submit your work.

Prerequisites

1. Completion of Scavenger Hunts I and II

2. Optional - Scavenger Hunt III Applying Meaningful Use

3. Completion of the Neehr Perfect EHR documentation activity for Health Information Terminology

Objectives

1. Identify the difference between privacy, confidentiality and security.

2. Understand the details of the HIPPA security rule.

3. Recognize role-based security.

Terminology

Privacy: the right patients have to control who can store, retrieve, and share their health information.

Confidentiality: the practices a provider employs to protect the patient’s privacy rights, such as permitting only certain authorized individuals to access a patient’s record.

Security: specific safeguards or controls that are put in place to ensure the confidentiality of patient data. For example, security would include a technical safeguard that requires all individuals in the healthcare setting to log into a system using a unique account using credentials that are not shared with others, thus providing a mechanism to enforce confidentiality of the information.

Details of the HIPAA Security Rule in regards to implementing HIT systems.

The HIPAA Security Rule groups its security standards into three categories—administrative safeguards, physical safeguards, and technical safeguards.

Administrative safeguards: the administrative functions that should be implemented to ensure that security standards are met. These standards include designating responsibility for security management, adoption of policies and procedures, and privacy and security training for an organization’s staff.

Physical safeguards: the controls put in place to protect electronic systems and hardware and the data stored there, from threats such as natural disasters and unauthorized intrusion. These safeguards may include locks on doors, special rooms, and back-ups to ensure that the data can be retrieved.

Technical safeguards: the automated controls used to protect electronic data and to control access. Examples include using authentication controls to ensure the identity of a person accessing a Health IT system containing electronic PHI, as well as encryption standards for data stored in HIT systems and transferred between them.

Role-Based Safety & Security Overview

When we think of safety and security in the EHR, we often think first of alerts and pop-ups. EHRs do indeed use the concept of the alert or pop-up message to notify users of potential risks, but these types of security are only secondary measures to encourage safe and mindful healthcare practice. Primary safety measures are built into the very structure of the EHR and are often invisible to the individual user. Primary safety measures, or “user-based security,” can help prevent a healthcare professional from potentially dangerous situations or inappropriate actions and therefore, can help prevent safety alerts and pop-ups from being triggered.

This activity will introduce you to a number of the safety structures built into the EHR and provide you with hands-on experience with a few of them. Because much of the safety mechanisms in the EHR are controlled by user class, role and privilege level, you will need to log into the EHR as different users to be able to see the underlying safety structures at work.

Role-Based Security Elements

User Class:

Classifying an individual user by professional scope of practice; i.e. Nurse, Doctor, Medical Assistant, etc. Based on the user class determines the user’s privileges, or want they can access in the EHR.

Menu Options:

Controls where you go and what you have access to. CPRS is actually a menu option. eMAR is a menu option. Users can be granted menu options to increase access.

Security Keys:

Controls what a user can and cannot do in any area of the EHR. e.g. CPRS Med Button to order crash cart meds in the BCMA. In order to have the CPRS Med Button, a user must first be in the Nurse User Class AND have the BCMA Menu Option, only then can they be granted the CPRS Med Button Security Key.

Activity

1. Make note of any security features (or safeguards) you see on the login screen.

______

Select the EHR icon and log in to the EHR. But when you log in to the EHR purposefully type the wrong username and password.

Note: Your screen may look different than what is shown in the screen shots.

2. What type of error message or pop-up message do you get?

______

3. Make note of any security features you see on the login screen.

______

The second time you log in to the EHR use your correct access code and verify code.

4. Suppose this is the first time that you have logged into the system. What additional safeguards could be put into place to improve the security of the login function?

______

After logging in, begin typing the word “Smith” in the search box.

5. What patients are showing in your list with the last name of “Smith”.

______

Using the following one-time credentials you will log in to the EHR as a provider.

Close out of the EHR by clicking on File > Exit.

Back at the EHR icon screen click on the EHR icon and use these codes:

Access Code: doctor01

Verify Code: password.2

After logging in, begin typing the word “Smith” in the search box, just as you did before.

6. What patients are showing in your list with the last name of “Smith”.

______

7. What would account for the discrepancy in the patient list for each of these users?

______

Security and Confidentiality

The idle warning will pop up on the screen after 30 minutes of complete inactivity in the EHR. Once the idle warning appears, you have 45 seconds to press the button and continue working. After 30 more minutes of complete inactivity, the idle window will pop up again. A ‘timeout’ ensures that a record can be accessed by others who might need it if someone has opened the record, but is not using it. On the other hand it also ensures that if the medical record is left open on a computer and then left, that it will automatically close after a specified amount of time to ensure confidentiality.

8. Describe a situation where the CPRS Timeout may appear?

______

9. Explain why this automatic ‘timeout’ feature is important in regards to security and confidentiality of a patient personal medical record?

______

References

The Nationwide Privacy and Security Framework for Electronic Exchange of Individually Identifiable Health Information. c2008. Available from:
http://healthit.hhs.gov/portal/server.pt/gateway/PTARGS_0_10731_848088_0_0_18/NationwidePS_Framework-5.pdf

Adapted from and modified for use with Neehr Perfect EHR:

Health IT Workforce Curriculum

Working with Health IT Systems Version 3.0/Spring 2012

Protecting Privacy, Security, and Confidentiality in HIT Systems

This material was developed by Johns Hopkins University, funded by the Department of Health and Human Services, Office of the National Coordinator for Health Information Technology under Award Number IU24OC000013.