What should be the policy on access to electronic health records (EHRs)?

Policy on Access to Electronic Health Records (EHRs)

Electronic health record access policies must prioritize patient confidentiality through encrypted connections, secure authentication methods, and role-based access controls while maintaining compliance with HIPAA and state-specific privacy regulations. 1

Core Security Requirements for EHR Access

Authentication and Access Controls

• Implement role-based access control (RBAC) to limit access to only necessary personnel 1
• Require secure authentication methods:
  • Strong password requirements
  • Two-factor authentication
  • Digital certificates where appropriate 1
• Configure all mobile devices to protect patient information if lost or stolen 1
• Implement mobile management solutions that allow remote disabling of devices 1

Secure Communication Infrastructure

• Use only encrypted or virtual proxy network connections for all patient information exchange 1
• Avoid public, unsecured wireless networks and cellular device networks for EHR access 1
• Ensure all electronic communications are incorporated directly into the standard EHR using secured and certified technology 1
• Configure digital devices to protect patient information if misplaced or stolen 1

Patient Portal Access Considerations

Patient Engagement Through Portals

• Despite 90% of healthcare systems offering patient portals, only 15-30% of patients use these platforms 1
• Implement one-on-one patient training to increase portal usage rates 1
• Address barriers for patients with limited health or digital literacy 1
• Establish clear expectations between medical teams and patients regarding what information will be shared 1

Adolescent Privacy Protections

• Ensure EHR systems have adequate technology to protect adolescent privacy regarding protected laboratory results, diagnoses, and other clinical information 1
• Recognize state-specific laws allowing minors to access certain medical care without guardian consent 1
• Implement technical solutions that maintain confidentiality of adolescent health information while complying with legal requirements 1

Data Management Best Practices

Documentation and Data Integrity

• Support "write once, reuse many times" functionality with appropriate tagging of original information sources 1
• Maintain provenance of all data in clinical records, including patient-generated data 1
• Avoid requiring redundant documentation of the same information 1
• Ensure proper deidentification of radiographic images used for educational purposes 1

Device Management

• Follow institutional policies for home access of EHRs 1
• Properly manage disposal of old devices with hospital-based connectivity 1
• Implement mobile device management systems for smartphones and tablets 1

Institutional Policy Requirements

Organizational Responsibilities

• Establish systems that promote awareness of risks, benefits, and limitations of electronic communications 1
• Create communication agreements between healthcare teams and patients/guardians 1
• Ensure healthcare teams are aware of state and federal requirements 1
• Develop workflows that support patient use of portals in routine practice 1

Consent and Education

• Document patient consent and awareness of security risks 2
• Provide clear understanding of limitations of electronic communication to guardians 1
• Train system users and health staff in security and privacy practices 2, 3

Common Pitfalls to Avoid

• Using unsecured communication channels for protected health information 1, 2
• Accessing EHRs through public WiFi networks 1
• Failing to maintain confidentiality of sensitive information, which can lead to fines or adverse licensure actions 1
• Using electronic communication in isolation without confirmation of receipt and comprehension 1, 2
• Overstructuring clinical records and overloading with extraneous data 1
• Neglecting to address the needs of diverse patients, including those with limited health or digital literacy 1

By implementing these evidence-based policies for EHR access, healthcare organizations can balance the benefits of electronic health information sharing with the critical requirements for security, privacy, and effective patient care.