(inter)national privacy regulations may have a negative impact on patient care, especially safety and efficiency. This presentation shows the measures taken by the Spaarne Hospital, Hoofddorp (NL)

1. PRIVACY & PATIENT SAFETY

2. Disclosure slide
• Nothing to disclose
https://www.linkedin.com/pub/dr-arjen-noordzij/17/486/791
dokter_no

3. Spaarne Hospital
11/6/2014 © 2012–2014 Healthcare Information and Management Systems Society (HIMSS) 3

4. EMR in Spaarne Hospital
• Since 2008: Epic
– Introduction in 2 phases
– Enterprise
– Integration: 1 patient, 1 record
• Medical
• Financial
– Complete order management
– Closed medication loop

5. Dutch data protection act
• Access to (electronic) patientdata
is strictly restricted to the
employees directly involved in the
execution of the treatment
contract of a patient.
• Influence on patient safety?

6. Dutch data protection act
• Risks
– Type of data
– Processing
• Appropriate security level
• Technical & organizational
– Technical possibilities
– Costs
• Prevention

7. Organizational measures
• Information
– Code of conduct
– 10 golden rules
– Cases on intranet
– Broad privacy meetings
• Privacy functionary
• Privacy as distinct category in secure reporting of
incidents registry
• Immediate dismissal of 2 nurses

8. Technical measures
• Password policy
• Single sign-on
• Epic
– Audit trail
– (smart logging)
– Breaking-the-glass

9. Privacy Protection Commission
According to those signals access to electronic
patientdata is not strictly restricted to the employees
directly involved in the execution of the treatment
contract of a patient.
Balance between behavioural and technical measures

10. Process
• outpatient & inpatient
• Scoring system
– Satifies PPC requirements
– Impairs patient safety
– Impairs daily practice (efficiency)
– Additional personnel necessary
– Technically feasible

11. Proposal (1)
• Access defined on speciality level
• Outpatient personnel: access to known patients
• Inpatient personnel
– Access around admission
– Patients admitted for own speciality (or consultation)
– ICU personnel: access to all clinical patients
• ‘unlimited’ access: ICU, OR & ED patients

12. Proposal (2)
• Breaking-the-glass
– Very effective
– Fear to ‘break the glass’
• Smart queries on breaking-the-glass files
• Manual check

13. Does privacy impair safety?
• Potentially: yes
• With proposed measures: most probably not
• It does impair efficiency (breaking-the-glass)
• Balance between desirability and feasibility
• Opinion PPC versus legislation