Confidentiality, Privacy & Security

EHR Monitoring

  • 1.  EHR Monitoring

    Posted 03-07-2018 06:54
    Seeking information from others regarding what they use as triggers for prompting access reviews. Do you use items such as VIP status, media stories (including social networking platforms), patient type, etc.? If you do, how do you have the items defined and is it continuous monitoring or on a randomized schedule? Thanks!

    Adrienne Dear

  • 2.  RE: EHR Monitoring

    Posted 03-07-2018 08:54
    All of the above but we have a category called "high risk/problem prone" which to me is high profile admissions, colleagues, etc.

    Nancy Davis, MS, RHIA, CHPS
    Director of Compliance & Safety
    Door County Medical Center

  • 3.  RE: EHR Monitoring

    Posted 03-08-2018 17:23

    Great question and hope there are lots of answers as I would like to know also.  Our health system does what is required but personally wish there was more robust monitoring of many categories. We have approx. 11,500 employees and are in 2 states.  Due to minimal staff to perform audits and follow through, we currently do 100% review of same name audits. Random audits are done on a quarterly basis on a different topic each month (high profile & "newsworthy", odd situations such as a trauma victim not in media yet, Managers, FMLA empl pts (with back up from HR), termed employees for cause).  Also monitor 100% of any complaints or empl suspicions brought to our attention by staff. There is talk about contracting in the future for more robust monitoring of red flags such as: 1) average access is 30 pts. per day and on one day pt. accessed 300 pts. 2) Neuro Unit nurse looking at OB or Newborn record, other pts not on their unit, 3)  demographic comparisons between empl. & pts, 4) access by caregiver not associated as part of the care team, 5) employees accessing remotely when not working, on PTO or other leave.  Just ideas and the "nice to have" type of monitoring,

    Barb Beckett, RHIT, CHPS
    System Privacy Officer
    Saint Luke's Health System

  • 4.  RE: EHR Monitoring

    Posted 03-09-2018 09:56
    ​Barb, do you have dedicated staff that run and review those reports?  What system do you use to run your audit reports?


    Carrie Steckler, RHIA
    Director HIM/Privacy Officer
    West Park Hospital District

  • 5.  RE: EHR Monitoring

    Posted 03-08-2018 19:10

    We continuously monitor for access to board members, elected officials, employees looking at their immediate supervisor, immediate supervisors looking at their employees, same last name review, same address review, employee looking at patients where they are listed as next of kin, etc........We use a system that automatically flags these events for review.

    DeAnn Tucker
    Privacy & Security Officer

  • 6.  RE: EHR Monitoring

    Posted 03-09-2018 09:16

    My organization implemented a software for monitoring EHR access from Cognetyx at the end of last year; it has lots of capabilities.  You can run reports daily, weekly, or monthly; you can choose to receive email notification; and you can customize to your preferred criteria.

    Yolette Lecorps
    Manager/HIPAA Privacy Officer

  • 7.  RE: EHR Monitoring

    Posted 03-09-2018 11:23
    ​Thank you for the responses! It is nice to hear what others are doing.

    Do you actively monitor and investigate these types of items daily - with or without software?Or do you conduct scheduled monitoring such as once a quarter you pull random cases that would fall into the categories?
    Also, do you specifically use social media platforms such as Facebook to identify questionable activities that are related to these types of categories?

    Adrienne Dear

  • 8.  RE: EHR Monitoring

    Posted 03-09-2018 11:32

    Barbara - thank you for the details and examples. That helps.

    Any others?

    Adrienne Dear

  • 9.  RE: EHR Monitoring

    Posted 03-13-2018 16:48
    How often is the information monitored? Is it daily, weekly, monthly or quarterly?  I understand that most of you utilize software for this function, does anyone perform the check manually?  If so, what is your process?

    Ta-Tanisha Ingram, MSM, RHIA, CHPS
    Medical Records Administrator/District Privacy Officer