# What's going on with computerizing medical records? **URL:** \ **Category:** Factual Questions\ **Created:** [January 20, 2015, 8:38pm UTC](https://boards.straightdope.com/t/whats-going-on-with-computerizing-medical-records/710409 "2015-01-20T20:38:51Z")\ **Posts on this page:** 20\ **Page:** 2
**Author:** ![slash2k](https://avatars.discourse-cdn.com/v4/letter/s/439d5e/32.png) [@slash2k](https://boards.straightdope.com/u/slash2k)\ **Post date:** [January 21, 2015, 4:32pm UTC](https://boards.straightdope.com/t/whats-going-on-with-computerizing-medical-records/710409/21 "2015-01-21T16:32:39Z")
> [@USCDiver](#): > > I’m not sure what kind of cite you’d need for this. When your hospital chart was on paper, only the people who took the time to go track down your folder could access your information. Now anyone with a login can look you up. > > HIPAA provides for some very stiff penalties for these kind of shenanigans, of course, but certainly the shear number of people who can see your history has gone up considerably. Now anyone with a login providing access to your records can look you up, AND the system is capable of recording who looked you up (which has gotten people fired when the audit trail shows people with no business looking you up have been in your record). With paper records, there’s no trail: anybody who could access your folder could do whatever they wanted with almost no fear of repercussion, because proving who looked at or photocopied the file was often impossible. (Plus, pre-HIPAA, what consequences could there be anyway?) ---
**Author:** ![bump](https://avatars.discourse-cdn.com/v4/letter/b/7c8e57/32.png) [@bump](https://boards.straightdope.com/u/bump)\ **Post date:** [January 21, 2015, 5:37pm UTC](https://boards.straightdope.com/t/whats-going-on-with-computerizing-medical-records/710409/22 "2015-01-21T17:37:52Z")
> [@psychobunny](#): > > Finally, let’s not forget HIPPA. The security needed is so tight it makes it near impossible to share information anyway. I work in health care IT, and this is really the bigger issue than anything else. Just because one of our clinics sees a person, and their medical information is in our EMR doesn’t mean that we can share it with any other health care providers without certain very restrictive sorts of consent on the patient’s part. Once the HIPAA stuff is satisfied, then you get into the fun that **Shodan** mentions. There are vendors trying to fix this situation- Microsoft Health Vault and Dossia are a couple of examples of personal health records that allow the patient to manage their own health records, but from what I gather, they’re not proving to be particularly popular. ---
**Author:** ![GrumpyBunny](https://avatars.discourse-cdn.com/v4/letter/g/bc8723/32.png) [@GrumpyBunny](https://boards.straightdope.com/u/GrumpyBunny)\ **Post date:** [January 21, 2015, 5:46pm UTC](https://boards.straightdope.com/t/whats-going-on-with-computerizing-medical-records/710409/23 "2015-01-21T17:46:58Z")
> [@bump](#): > > I work in health care IT, and this is really the bigger issue than anything else. Just because one of our clinics sees a person, and their medical information is in our EMR doesn’t mean that we can share it with any other health care providers without certain very restrictive sorts of consent on the patient’s part. I think it depends on how the clinic interprets HIPAA laws. My doctors are all hospital-based, and they all have access to my records within the EMR. They can easily pull up my last set of blood work rather than asking for a new bunch of tests; or they can look at existing radiology films rather than take yet another x-ray of my foot with the weird toe. This is really pretty handy. Even better, it prevents wasteful use of healthcare dollars. (My podiatrist saw my blood work from last month, saw that my liver tests were fine, and prescribed a medication without having to order another test.) Usually when you can access that much data, your training tells you that doing so without a legit business need is verboten and a violation of HIPAA. Again, YMMV based on the facility’s understanding of HIPAA and how they choose to implement it. ---
**Author:** ![psychobunny](https://avatars.discourse-cdn.com/v4/letter/p/54ee81/32.png) [@psychobunny](https://boards.straightdope.com/u/psychobunny)\ **Post date:** [January 21, 2015, 6:14pm UTC](https://boards.straightdope.com/t/whats-going-on-with-computerizing-medical-records/710409/24 "2015-01-21T18:14:49Z")
The larger groups and hospitals can’t restrict people on a case by case basis so they rely on tracking to keep people from inappropriately accessing records they are not allowed to see. I can technically view any chart from any patient seen at a hospital where I have privileges but I am only supposed to look at those where I have a legitimate need to see the data. Just for fun I looked up my own EMR (Athena) and they are up to 3% of the market and they are getting into hospitals now too, so hopefully they are around for awhile. I find it interesting that one article noted that they had half of the doctors who successfully certified for meaningful use stage 2. I must say that they have been absolute rock stars in regards to MU and PQRS. I basically chose them because they worked mainly with very small practices and because the billing was integrated. ---
**Author:** ![bump](https://avatars.discourse-cdn.com/v4/letter/b/7c8e57/32.png) [@bump](https://boards.straightdope.com/u/bump)\ **Post date:** [January 21, 2015, 7:08pm UTC](https://boards.straightdope.com/t/whats-going-on-with-computerizing-medical-records/710409/25 "2015-01-21T19:08:02Z")
> [@GrumpyBunny](#): > > I think it depends on how the clinic interprets HIPAA laws. My doctors are all hospital-based, and they all have access to my records within the EMR. It’s the practice that you’re granting access to- typically, since they’re hospital-based, that means the entire hospital. But if Dr. Quacko MD as a sole practicioner wanted access, you’d have to specifically grant him access- he’s not part of the hospital you already granted access to as part of the new patient registration. ---
**Author:** ![DSeid](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/dseid/32/20194_2.png) [@DSeid](https://boards.straightdope.com/u/DSeid)\ **Post date:** [January 21, 2015, 7:43pm UTC](https://boards.straightdope.com/t/whats-going-on-with-computerizing-medical-records/710409/26 "2015-01-21T19:43:30Z")
Not the way I understand it. I can and do get access to all of my patient records from anywhere that is part of the [EpicEverywhere](http://www.epic.com/CareEverywhere/) system, no special permissions from patients needed. [Details.](http://www.epic.com/software-interoperability.php) ---
**Author:** ![TheSeaOtter](https://avatars.discourse-cdn.com/v4/letter/t/ed655f/32.png) [@TheSeaOtter](https://boards.straightdope.com/u/TheSeaOtter)\ **Post date:** [January 21, 2015, 8:21pm UTC](https://boards.straightdope.com/t/whats-going-on-with-computerizing-medical-records/710409/27 "2015-01-21T20:21:51Z")
I have a friend who does software development at Epic, and gave me a tour of their offices last year. It’s a pretty impressive place. They’re expanding at an astonishing rate, and he seems pretty confident they’re going to conquer the world (or at least the EMR market). ---
**Author:** ![Quartz](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/quartz/32/267_2.png) [@Quartz](https://boards.straightdope.com/u/Quartz)\ **Post date:** [January 21, 2015, 9:54pm UTC](https://boards.straightdope.com/t/whats-going-on-with-computerizing-medical-records/710409/28 "2015-01-21T21:54:56Z")
Paging **Irishgirl** for how it works in the U.K. It’s years since I worked for the NHS, but they were rolling out national access to records back then. ---
**Author:** ![USCDiver](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/uscdiver/32/354_2.png) [@USCDiver](https://boards.straightdope.com/u/USCDiver)\ **Post date:** [January 22, 2015, 5:46am UTC](https://boards.straightdope.com/t/whats-going-on-with-computerizing-medical-records/710409/29 "2015-01-22T05:46:09Z")
HIPAA restricts shouldn’t apply if the information you are looking for is related to care of a mutual patient. Most clinics or hospitals have policies in place to have a release form be filled out, but it isn’t required. ---
**Author:** ![Senegoid](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/senegoid/32/6606_2.png) [@Senegoid](https://boards.straightdope.com/u/Senegoid)\ **Post date:** [January 22, 2015, 6:02am UTC](https://boards.straightdope.com/t/whats-going-on-with-computerizing-medical-records/710409/30 "2015-01-22T06:02:53Z")
> [@USCDiver](#): > > Most clinics or hospitals have policies in place to have a release form be filled out, but it isn’t required. My HMO has policies in place to have a release form be filled out, and I did all that, and they STILL wouldn’t release my information to the party I needed it released to. ETA: My HMO is so uptight with HIPAA rules (which is mostly a good thing, I think) that when I go there for a scheduled appointment, they won’t even tell me if _I’m_ a patient there! :dubious: ---
**Author:** ![bob\_2](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/bob_2/32/3341_2.png) [@bob\_2](https://boards.straightdope.com/u/bob_2)\ **Post date:** [January 22, 2015, 1:14pm UTC](https://boards.straightdope.com/t/whats-going-on-with-computerizing-medical-records/710409/31 "2015-01-22T13:14:05Z")
Computerisation in the NHS lurches from one expensive failure to another. "_The Fujitsu Connecting for Health contract was part of the £12bn NHS national programme for IT, large parts of which have had to be abandoned at a cost estimated by the National Audit Office to be £2.7bn._ [Government 'loses £700m NHS IT legal battle with Fujitsu' - BBC News](http://www.bbc.co.uk/news/uk-politics-28464002) "_A report by the influential Public Accounts Committee (PAC) concluded an attempt to upgrade NHS computer systems in England ended up becoming one of the “worst and most expensive contracting fiascos” in public sector history._[NHS IT system one of 'worst fiascos ever', say MPs - BBC News](http://www.bbc.co.uk/news/uk-politics-24130684) There are sporadic moves forward - My GP surgery now deals with all requests for and repeat prescriptions online and transmits them straight to the pharmacy of my choice. You might have thought that hospital doctors would be doing their rounds with a tablet in hand. Not so at the one my wife was in - they still use paper. ---
**Author:** ![Qadgop\_the\_Mercotan](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/qadgop_the_mercotan/32/83_2.png) [@Qadgop\_the\_Mercotan](https://boards.straightdope.com/u/Qadgop_the_Mercotan)\ **Post date:** [January 22, 2015, 2:45pm UTC](https://boards.straightdope.com/t/whats-going-on-with-computerizing-medical-records/710409/32 "2015-01-22T14:45:29Z")
> [@USCDiver](#): > > HIPAA restricts shouldn’t apply if the information you are looking for is related to care of a mutual patient. > > Most clinics or hospitals have policies in place to have a release form be filled out, but it isn’t required. This. It is such a struggle to get many hospitals and physician offices to understand that HIPAA does NOT require me to get my patient’s consent in order for me to get their records on my patient. ---
**Author:** ![bump](https://avatars.discourse-cdn.com/v4/letter/b/7c8e57/32.png) [@bump](https://boards.straightdope.com/u/bump)\ **Post date:** [January 22, 2015, 4:27pm UTC](https://boards.straightdope.com/t/whats-going-on-with-computerizing-medical-records/710409/33 "2015-01-22T16:27:24Z")
> [@DSeid](#): > > Not the way I understand it. > > I can and do get access to all of my patient records from anywhere that is part of the [EpicEverywhere](http://www.epic.com/CareEverywhere/) system, no special permissions from patients needed. > > [Details.](http://www.epic.com/software-interoperability.php) That’s just a framework for information sharing using Epic, but it doesn’t necessarily mean that two hospitals/doctors/whatever running Epic automatically share all their information. It just means that if they do, it’s much, much easier to do so. ---
**Author:** ![SmellMyWort](https://avatars.discourse-cdn.com/v4/letter/s/ea5d25/32.png) [@SmellMyWort](https://boards.straightdope.com/u/SmellMyWort)\ **Post date:** [January 22, 2015, 5:01pm UTC](https://boards.straightdope.com/t/whats-going-on-with-computerizing-medical-records/710409/34 "2015-01-22T17:01:13Z")
> [@TheSeaOtter](#): > > I have a friend who does software development at Epic, and gave me a tour of their offices last year. It’s a pretty impressive place. They’re expanding at an astonishing rate, and he seems pretty confident they’re going to conquer the world (or at least the EMR market). They just signed [Mayo Clinic.](http://www.channel3000.com/health/Epic-gets-Mayo-Clinic-contract/30856674) ---
**Author:** ![Qadgop\_the\_Mercotan](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/qadgop_the_mercotan/32/83_2.png) [@Qadgop\_the\_Mercotan](https://boards.straightdope.com/u/Qadgop_the_Mercotan)\ **Post date:** [January 22, 2015, 5:27pm UTC](https://boards.straightdope.com/t/whats-going-on-with-computerizing-medical-records/710409/35 "2015-01-22T17:27:32Z")
Yeah, I wish we would have been able to get EPIC to consider our system. So many of our affiliated systems and consultants use it. But we were too small for them, having only 23,000 active current patients strung out through 40+ different sites. They wouldn’t give us the time of day. ---
**Author:** ![GrumpyBunny](https://avatars.discourse-cdn.com/v4/letter/g/bc8723/32.png) [@GrumpyBunny](https://boards.straightdope.com/u/GrumpyBunny)\ **Post date:** [January 22, 2015, 5:49pm UTC](https://boards.straightdope.com/t/whats-going-on-with-computerizing-medical-records/710409/36 "2015-01-22T17:49:06Z")
> [@bump](#): > > It’s the practice that you’re granting access to- typically, since they’re hospital-based, that means the entire hospital. > > But if Dr. Quacko MD as a sole practicioner wanted access, you’d have to specifically grant him access- he’s not part of the hospital you already granted access to as part of the new patient registration. Exactly so. I’ve found that it’s pretty easy to get records released to a doctor outside the hospital-based doctors. My pain management team is not associated with the hospital; however, I just sign a form to have records released from my orthopedic surgeon. It was no problem at all, they had the records the next day. YMMV with the requesting and requestee physician offices, though. ---
**Author:** ![filmore](https://avatars.discourse-cdn.com/v4/letter/f/7993a0/32.png) [@filmore](https://boards.straightdope.com/u/filmore)\ **Post date:** [January 22, 2015, 6:20pm UTC](https://boards.straightdope.com/t/whats-going-on-with-computerizing-medical-records/710409/37 "2015-01-22T18:20:22Z")
There was a PostSecret a while ago from someone who worked in a hospital. It said that when he was bored, he would look up records of friends and local celebrities. That’s the downside of trusting that users only view information they are supposed to be viewing. How would they police that kind of inappropriate use? Are there any validation processes that look at logs or whatnot to find suspicious activity? ---
**Author:** ![bump](https://avatars.discourse-cdn.com/v4/letter/b/7c8e57/32.png) [@bump](https://boards.straightdope.com/u/bump)\ **Post date:** [January 22, 2015, 6:36pm UTC](https://boards.straightdope.com/t/whats-going-on-with-computerizing-medical-records/710409/38 "2015-01-22T18:36:58Z")
> [@GrumpyBunny](#): > > Exactly so. I’ve found that it’s pretty easy to get records released to a doctor outside the hospital-based doctors. My pain management team is not associated with the hospital; however, I just sign a form to have records released from my orthopedic surgeon. It was no problem at all, they had the records the next day. > > YMMV with the requesting and requestee physician offices, though. Oh, it’s not hard to do usually, and AFAIK, they can’t deny you that information, seeing as how it’s technically YOUR data, not theirs. It’s just something you have to personally shepherd and make happen, not something automated and centrally stored. As for policing the internal users; that’s hard to do unless you have access logs on certain tables or records, which tend to be something that uses a lot of space and a lot of time. I’d bet a lot of IT and legal departments specifically choose not to do those, under the theory that unless they’re legally required to do something like that, they’re less liable in a case where they just didn’t collect some non-required data, versus collecting it and showing conclusively that someone did violate the law. Put another way, they can say “We collected all the data required by law, and it doesn’t give us any way to tell if person X did action Y at all” as opposed to “Yes, we have those logs and Person X did action Y on date Z.” Which one is more likely to get the hospital/doctor/whatever nailed to the wall for a judgement. ---
**Author:** ![suranyi](https://avatars.discourse-cdn.com/v4/letter/s/e36b37/32.png) [@suranyi](https://boards.straightdope.com/u/suranyi)\ **Post date:** [January 22, 2015, 6:53pm UTC](https://boards.straightdope.com/t/whats-going-on-with-computerizing-medical-records/710409/39 "2015-01-22T18:53:44Z")
> [@filmore](#): > > There was a PostSecret a while ago from someone who worked in a hospital. It said that when he was bored, he would look up records of friends and local celebrities. That’s the downside of trusting that users only view information they are supposed to be viewing. How would they police that kind of inappropriate use? Are there any validation processes that look at logs or whatnot to find suspicious activity? There are logs kept of who has accessed the files of everyone. Normally nobody pays attention to them, but in the case of celebrities and other notable people, sometimes they look back and see who looked into their files. If they find anybody snooping who shouldn’t have, there can be consequences. In a related note, a few years ago my father had surgery at Cedars-Sinai hospital in Los Angeles, so he was there for a few days. That is a hospital known for treating celebrities all the time. It had posters all over the place, including in the elevators, indicating that anyone caught comprimising any patient’s privacy would be dealt with severely. ---
**Author:** ![USCDiver](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/uscdiver/32/354_2.png) [@USCDiver](https://boards.straightdope.com/u/USCDiver)\ **Post date:** [January 22, 2015, 7:01pm UTC](https://boards.straightdope.com/t/whats-going-on-with-computerizing-medical-records/710409/40 "2015-01-22T19:01:25Z")
In addition to being a physician in a large hospital system (using EPIC of course) I am a patient. Early on in my treatment, I signed a HIPAA form releasing my records to myself. I don’t know if it would actually protect me from getting in trouble if I were to ever be caught looking at results in my own chart, but fuck 'em. [Previous page](https://boards.straightdope.com/t/whats-going-on-with-computerizing-medical-records/710409.md?page=1) [Next page](https://boards.straightdope.com/t/whats-going-on-with-computerizing-medical-records/710409.md?page=3)