Penn Medicine’s Privacy Officer John Nocito recently shared how his team investigates possible improper patient record access across their health system. The process is described in an article by David Raths. originally published by our sister publication, Healthcare Innovation.

Read an excerpt of the article below.

How Penn Medicine investigates improper patient record access

Philadelphia-based Penn Medicine is a complex health system with seven hospitals and hundreds of clinics, yet its privacy investigation team is actually pretty small — a team of three, including Privacy Officer John Nocito. During a recent summit meeting, Nocito described his team’s process for investigating potential inappropriate access of patient records. 

Nocito was speaking at a summit meeting put on by Bluesight, a company whose PrivacyPro solution is an automated patient-privacy monitoring platform designed for healthcare organizations to track and investigate EHR access. 

He said his team has an interesting mix of background. One has a nursing and clinical background, another has a medical records background, and Nocito has a legal background. “That combination has worked well for us because the cases we deal with obviously can involve clinical workflows, medical records, and employment issues,” he said. “So in a lot of ways, we're bringing three different professional lenses to the same cases, and it helps that collectively we have over 15 years of experience in handling these cases.”

With a team of only three, he said they have to be thoughtful about how they allocate their resources. “We're increasingly spending more and more time on improper disclosures and responding to data security incidents,” he said.  

Nocito said they have found they can learn from their cases and use that experience to make their monitoring better. “Even after we've decided that a case warrants our attention, we don't necessarily handle every case the same way,” he said. “We have a standard investigative process for what we deem as the higher-risk cases — cases where clinical information was viewed, maybe multiple patients were involved, or there were unusual circumstances. We’ve also developed what we call a streamlined process for certain lower-risk cases.”

Some cases involving only demographic information may not always require the same level of investigative resources as a case where someone has entered the clinical portions of a chart, he explained. One example is a coworker case where the employee spent about three seconds in the patient identity report and didn't view clinical information. 

“We've had numerous cases where employees were working on multiple screens and thought they typed a coworker's name into Teams or e-mail, but the cursor is actually still in Epic,” he said. “So the employee inadvertently searched the coworker in Epic, and PrivacyPro did exactly what it's supposed to do — it identified the access, generated an alert, oftentimes with a high suspicion score. But time and experience have told us that a three-second demographic-only access like that doesn't necessarily require us to bring in HR business partners or schedule a formal employee meeting and go through our entire process. In those situations, we may handle the matter with a phone call and re-educate the employee on the spot. We have found that approach can still be very impactful. We do something similar with certain family member cases because, based on our experience, we've found that many of those accesses were authorized by the patient.”

When circumstances are appropriate, the team can handle those cases more efficiently and that helps them move faster and get to the next case, while also being thoughtful about how they use the time of their HR partners, medical leaders and other supervisors. 

“But if there's anything about a case that raises our suspicion, even in a patient identity report only or family member case, we will definitely err on the side of using our standard process and bring the full set of resources to that investigation,” Nocito said. 

Read the full article at Healthcare Innovation