Prevalence of Sharing Access Credentials in Electronic Medical Records
1
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
Objectives: Confidentiality of health information is an important aspect of the physician patient relationship. The use of digital medical records has made data much more accessible. To prevent data leakage, many countries have created regulations regarding medical data accessibility. These regulations require a unique user ID for each medical staff member, and this must be protected by a password, which should be kept undisclosed by all means. Methods: We performed a four-question Google Forms-based survey of medical staff. In the survey, each participant was asked if he/she ever obtained the password of another medical staff member. Then, we asked how many times such an episode occurred and the reason for it. Results: A total of 299 surveys were gathered. The responses showed that 220 (73.6%) participants reported that they had obtained the password of another medical staff member. Only 171 (57.2%) estimated how many time it happened, with an average estimation of 4.75 episodes. All the residents that took part in the study (45, 15%) had obtained the password of another medical staff member, while only 57.5% (38/66) of the nurses reported this. Conclusions: The use of unique user IDs and passwords to defend the privacy of medical data is a common requirement in medical organizations. Unfortunately, the use of passwords is doomed because medical staff members share their passwords with one another. Strict regulations requiring each staff member to have it’s a unique user ID might lead to password sharing and to a decrease in data safety.
Abstract
Objectives: Confidentiality of health information is an important aspect of the physician patient relationship. The use of digital medical records has made data much more accessible. To prevent data leakage, many countries have created regulations regarding medical data accessibility. These regulations require a unique user ID for each medical staff member, and this must be protected by a password, which should be kept undisclosed by all means. Methods: We performed a four-question Google Forms-based survey of medical staff. In the survey, each participant was asked if he/she ever obtained the password of another medical staff member. Then, we asked how many times such an episode occurred and the reason for it. Results: A total of 299 surveys were gathered. The responses showed that 220 (73.6%) participants reported that they had obtained the password of another medical staff member. Only 171 (57.2%) estimated how many time it happened, with an average estimation of 4.75 episodes. All the residents that took part in the study (45, 15%) had obtained the password of another medical staff member, while only 57.5% (38/66) of the nurses reported this. Conclusions: The use of unique user IDs and passwords to defend the privacy of medical data is a common requirement in medical organizations. Unfortunately, the use of passwords is doomed because medical staff members share their passwords with one another. Strict regulations requiring each staff member to have it’s a unique user ID might lead to password sharing and to a decrease in data safety.
참고문헌 (22)
- Aghadiuno M, "Hippocrates appraises 21st century doctors", Br J Gen Pract, 53(497), pp.984~985 (2003)
- Dorr Goold S, "The doctor-patient relationship:challenges, opportunities, and strategies", J Gen Intern Med, 14(Suppl 1), pp.S26~S33 (1999)
- Hesse BW, "Social participation in Health 2.0", Computer(Long Beach Calif), 43(11), pp.45~52 (2010)
- Benaloh J, "Patient controlled encryption: ensuring privacy of electronic medical records", Proceedings of the 2009 ACM Workshop on Cloud Computing Security, pp.103~114 (2009)
- Fernandez-Aleman JL, "Security and privacy in electronic health records : a systematic literature review", J Biomed Inform, 46(3), pp.541~562 (2013)
- Zurita L, "Patient opinion: EHR assessment from the users perspective", Stud Health Technol Inform, 107(Pt 2), pp.1333~1336 (2004)
- Chhanabhai P, "Consumers are ready to accept the transition to online and electronic records if they can be assured of the security measures", Med Gen Med, 9(1), pp.8~ (2007)
- Strickland JH Jr, "A computer-controlled ventilator weaning system : a clinical trial", Chest, 103(4), pp.1220~1226 (1993)
- "The HIPAA Privacy Rule" (2016)[URL]
- Protecting information in health related computer systems, "Afek A", Israel Ministry of Health, ~ (2015)
- "Response of the Ministry of Health CEO Circular -Protection of Information in Computerized Systems in the Health System - Circular 9/12" (2012)[URL]
- "Lost flash drive at core of Kaiser Permanente Data Breach" (2013)[URL]
- "Mass email by Dent Neurologic inadvertently breaches privacy of 10,200 patients" (2013)[URL]
- "Patient data may have been leaked, doctors group warns" (2013)[URL]
- Health information security survey, "Hassidim A.", ~ (2014)
- Reason J, "Human error : models and management", BMJ, 320(7237), pp.768~770 (2000)
- Flink CW., "Weakest link in information system security", Proceedings of the Workshop for Application of Engineering Principles to System Security Design (WAEPSSD) (2002)
- Haas S, "Aspects of privacy for electronic health records", Int J Med Inform, 80(2), pp.e26~e31 (2011)
- Gino F, "Contagion and differentiation in unethical behavior the effect of one bad apple on the barrel", Psychol Sci, 20(3), pp.393~398 (2009)
- Welsh DT, "The slippery slope : how small ethical transgressions pave the way for larger future transgressions", J Appl Psychol, 100(1), pp.114~127 (2015)
- Buhrmester M, "Amazon,s Mechanical Turk: a new source of inexpensive, yet highquality, data?", Perspect Psychol Sci, 6(1), pp.3~5 (2011)