Enhancing information security on the frontline of healthcare
Adherence to patient identity protocols is important, but when a patient’s life is on the line, they can get in the way.
A key theme for Health Data Management in the July and August timeframe is addressing the cost and burden of care, with a focus on the question, “What could be possible if healthcare data were safe, secure and trusted?”
To achieve this data security, there are some steps that could be considered to facilitate better trusted communication and protection of patient health information (PHI) and personally identifiable information (PII).
Challenges in emergency care
In emergency medicine, there is a need for rapid communication of patient assessments, vital signs, treatments and findings. This typically occurs between patients and pre-hospital healthcare professionals (HCPs), patients and in-hospital HCPs, pre-hospital HCPs and in-hospital HCPs. These exchanges occur during treatment and interaction with the patient as part of triage, establishing the history of present illness, current medications and plans of care.
All these communications take place in forms ranging from electronic charts to oral and written communications; all these media contain personal health and personal identifying information related to the patient.
Healthcare professionals receive regular training on protection of health information through training in requirements of the Health Information Portability and Accountability Act (HIPAA), as well as through regular refreshers and a culture of personal information protection that has been built into operational settings over time. Despite this, there is still a significant amount of information that is not in electronic form, and which must be managed appropriately through shredding paper copies and through best practices.
For example, a practice that had been used historically was recording patient vital signs and other information on the back of a clinician’s nitrile gloves. This practice has been discouraged because it can result in the exposure of patient information to unauthorized individuals. But in the emergency care setting, there are frequently patients who are in significant distress, and in those cases, the focus of HCPs is on the management and care of the patient. Best practices for protecting information and ensuring proper procedures are still active in this environment, but they are not the primary concern when a patient’s life is on the line.
When patient care is the only concern
As a frontline HCP, both in the emergency and critical care settings, I have experienced many situations when a patient in extremis requires our full attention. There can be tremendous confusion in these environments, and anyone who has encountered a code-blue or rapid response in the emergency setting also may have experienced what the setting looks like, with many people performing separate functions and in differing roles.
In these extreme emergencies, communications are rapid; orders are continuous; actions are intentional. Debris often accumulates on floors, countertops and beds, as equipment, supplies and medications are administered to the patient. Capturing information is normally the function of one or two individuals through a workstation or even through handwritten notes that are then transcribed into the electronic health record system.
In these cases, a patient’s identity may not be known or may be obtained through a family member or if the patient’s mental status facilitates this communication. Verification of patient information and any current findings may be relayed between the pre-hospital team and the in-hospital team. These communications can often be loud and direct because the object is ensuring positive acknowledgement of the information necessary to support treatment in the transfer of and in the continuing management of care.
The key to protecting and securing information must be the acknowledgment that the principle focus of the HCPs is the patient. So, the technology needs to “join” the HCPs in the treatment workflow and not require them to perform functions that cause them to deviate from care.
For example, and referring to the patient in extremis, one’s gloved hands are often busy, and if information technology functions require interacting with a device to handle a matter such as logging into an electronic system, this action is an impediment.
Tech that supports emergency care
Consider technologies that can support hands-free interaction, including voice-activation and translation, with the ability to discriminate specific HCPs from one another. Consider authentication methods other than badges or passwords that can both positively identify the HCP and establish their need-to-know over the information they require or need to enter.
Biometrics, including image capture, are examples that come to mind that are in use today (consider the face-identification capability of an iPhone, even when the user’s face is masked). Improvements in information security can also be achieved by supporting methods for reducing the need to record information manually.
However, it is often easier and faster to record a piece of information on a scrap of paper or an emergency short form than it is to record the same information in a chart, because of access requirements and the mechanics of the recording process. The ability to capture information simply and positively through oral communication is a possible approach to this, as well.
As a healthcare provider, paramedic and critical care clinician, my focus is primarily on taking care of the patient, and most of the patients I take care of require immediate and emergent care, often necessary as lifesaving measures. I take data and information security and protection of patient health information quite seriously and am cognizant of the need to secure all patient information and not treat it haphazardly.
As the focus of HDM’s theme on the cost and burden of care continues, I can speak with some authority and experience on the benefits that can be achieved through improved and seamless data and information access, which will have a direct impact on frontline patient care.
John Zaleski, Ph.D., NRP, FP-C, FACHDM, is a clinician, healthcare technology, executive, clinical Informaticist and inventor. He is a clinical informatics leader and clinician for Philips. He is a Fellow of the American College of Health Data Management.