California legislators have raised the hackles of the state’s hospitals with a new bill demanding that they track EMR usage far more closely.
The bill, which has already passed to state’s Senate, would demand that hospitals automatically track who modifies or deletes EMR records. More controversially, it would require hospitals to give patients a list of such changes, as well as the authors of said updates, if patients ask for their medical records.
The bill was sparked in part by the case of Diane Stewart, a woman who died abruptly after knee surgery at Stanford University Medical Center. After Stewart’s death, state investigators found that parts of her file had been erased and that entries had been added postmortem.
Hospitals are screaming bloody murder, arguing that state legislators are pulling out the big guns over a rarely-seen issue.
In her ignorance, your humble blogger had assumed that the hospitals’ complaints were mostly politics and posturing, but maybe not. Kaiser Permanente, owner of perhaps the world’s most expensive Epic installation (a rumored $3 billion plus investment), has gone on record saying that their system can’t meet the proposed standard.
The truth is, it’s actually pretty sad that hospitals can’t generally meet this standard. Seems to me that if you’re handling sensitive medical information — even with out HIPAA to punish you — you’d want to have a super-clear idea of who’s playing with it. But apparently, access log management isn’t what it could be, even in the case of gold-plated top-tier gazillion dollar enterprise EMRs.
So, California hospitals, I’m sorry to see that you actually put systems into place that can’t provide this capability. Not knowing who edits patient records is simply unacceptable, in my mind.
But hey, maybe I’m naive. Are there better places to spend your security bucks than keeping your eye on access controls? Are vendors head-faking you out of demanding these capabilities? Or were you just waiting for the other shoe to drop and you were forced to crack down on access? Just wondering…