Question

Margaret found herself facing a tough situation. Her babysitter called and cancelled 10 minutes before she needed to leave for work. She had a meeting with her manager that she could not miss. She brought her 12-year-old daughter, Molly, with her to work. Margaret sat Molly down in front of the computer in the office, telling her to play solitaire and surf the Internet until she returned. After the meeting, they went home.

Three days later, the chief privacy officer (CPO) confronted Margaret about her access of patient information. Several patients had received phone calls telling them that they had avian flu. The patients had all panicked. Margaret was the only user who had access to all of the patient accounts. She denied the accusations, but then realized that her daughter had had access to her computer. She relayed the story to her CPO.

1. What actions should be taken?

Hint: as a CPO, you have to follow the policy at the facility and act upon such obvious privacy breach. Please specify what you would do.

2. What could have been done to prevent this situation from happening?

Hint: What should be specified in the policy in case an employee has to bring a family member to the workplace? If the family member has to stay in the HIM area, what procedures should the employee follow to protect the computer system? How should the system be technically protected, so that it would not have been active to allow unauthorized access to patient information?

Answer 1

1., This incident will be reported to the manager or administrator of the hospital. Margeret is asked to submit an explanation of the incident. The clients will be contacted and a proper genuine apology will be given and they will be assured that such incidents will not be repeated. An inquiry committee will be set up and prompt corrective actions will be taken on Margeret based on hospital policies.

2. There must be some restrictions on bringing minors HIM area, it is not a BEST PRACTICE TO bring family members to the HIM area. If someone brings their friends or family members to the hospital they are supposed to wait in the visitor's lounge. Even if a family member has to stay in the HIM area they must be informed that they are under CCTV surveillance and they should not touch/use the computer system. If an employee brings a minor or kid (as in this case) to the HIM area it must be ensured that kids are supervised by another relative or friend or colleague. If this not possible a security guard shall supervise and take care of the kid. In any case, kids should not be given access to the system.

It is highly recommended that all the systems should be protected with a password and every employee should be given a login id and password, with this it is easy to understand who were logged in to the system and what did they do. This will also prevent unauthorized access to sensitive patient data.