This article is an excellent description of some of the serious problems related to IT security in healthcare.
Even though medical staff actively circumvent “security” in a myriad inventive ways, it’s pretty clear that 99% of the blame lies with IT staff and vendors being completely out of touch with the actual institutional mission. To be able to create working and useable systems, you *must* understand and be part of the medical work. So far, I’ve met very few technologists even remotely interested in learning more about the profession they’re ostensibly meant to be serving. It boggles the mind, but not in a good way.
Some quotes:
“Unfortunately, all too often, with these tools, clinicians cannot do their job—and the medical mission trumps the security mission.”
“During a 14-hour day, the clinician estimated he spent almost 1.5 hours merely logging in.”
“…where clinicians view cyber security as an annoyance rather than as an essential part of patient safety and organizational mission.”
“A nurse reports that one hospital’s EMR prevented users from logging in if they were already logged in somewhere else, although it would not meaningfully identify where the offending session was.”
This one, I’ve personally experienced when visiting another clinic. Time and time again. You then have to call back to the office and ask someone to reboot or even unplug the office computer, since it’s locked to my account and noone at the office is trusted with an admin password… Yes, I could have logged out before leaving, assuming I even knew I was going to be called elsewhere then. Yes, I could log out every time I left the office, but logging in took 5-10 minutes. So screen lock was the only viable solution.
“Many workarounds occur because the health IT itself can undermine the central mission of the clinician: serving patients.”
“As in other domains, clinicians would also create shadow systems operating in parallel to the health IT.”
Over here, patients are given full access to medical records over the ‘net, which leads physicians to write down less in the records. Think this through to its logical conclusion…