Hacker News Reader

Comment by pookeh | Hacker News Reader

Here in Canada if you have access to the central medical records you can look up anyone but (a) if you are not a doc and are not assigned to the case or (b) you are looking up yourself or a family member, you immediately get a call and get fired on the spot.

(Source: Wife works at the hospital and has seen some people get fired shortly after unauhorized access.)

View on HN

My hospital system has similar policies in place. I like to tell people, "If I look at your record, I'll probably get fired. If I look at my own record, I will absolutely get fired."

Of course, both of them are prohibited (without a valid business reason), but the latter is easier to detect in an automated fashion.

Everyone should be able to look at their own record...

Just curious - why is looking up yourself an offense?

You don't really own your medical record, also doctors add notes to your medical record that you may not like. For example your medical record may say that you don't follow up with medication, abuse drugs, have psychiatric/personality problems, etc. which patients could be sensitive about.

That's not true. In the US at least as an adult you have a legal right to see everything in your medical record.

And trying to exercise that right by using tools you have access to as an employee of your own health care provider rather than going through the proper channels that any other patient goes through to request such access (which involve the employer having documentation of the request, and auditability as to the purpose of any access involved in serving that request), is likely to violate internal procedures designed both to protect PHI and assure that all access is within job function.

Almost, but not quite. There are exceptions, such as psychotherapy notes. (Cite: https://www.hhs.gov/hipaa/for-professionals/privacy/laws-reg... section “Access”.)

Not infrequently there are notes in patients charts that only care providers can see. This practice is becoming frowned upon in some circles however, in lieu of more transparency. I imagine it being really useful for certain scenarios (e.g. mental illness or documentation a sensitive domestic relationship, where you wouldn't want a potentially abuse family member to see comments about their behavior in a relative's chart).

Abuse of employer resources for personal purposes, probably.

You would think that if they have the ability to audit at that level and with such prompt responses they would have the resources to lock down the systems properly and to implement a consent policy that works. Allowing everybody access is a bit like binding the cat to the bacon and then getting upset because the cat can not be trusted with bacon.

Better to keep the cat and the bacon separate, the temptation to peek is large and if there is one thing I know about people then it is that curiosity is a pretty common affliction.

And that is assuming that those accesses are on purpose, people can make honest mistakes as well and they will also look like unauthorized access.

Except putting barriers can cause even worse problems. If I can’t look up someone’s allergies because the system doesn’t think I should, fuck them right?

Exactly, barriers to looking up a patient's information can be fatal. I need to give someone medication now to stabilize them. What medications are they on now? Can't look it up? Better give it to them and hope there's no adverse reaction.

Better to avoid that situation and implement auditing while making sure people know the rules are enforced.

"override authentication" -> You have chosen to override the authentication protocol, you are logged in as John Doe, all your actions will be subject to internal affairs review, continue yes / no?

That tends to happen when the user logs in, so they'll probably see it multiple times per day. I think that's pretty standard. The system doesn't have to be the wild west. But if someone can click through an authentication override then it's not really doing anything.

At least that is what they tell everyone.

Reply on news.ycombinator.com