St. John’s Hospital, Research Paper Example

Paper Introduction

In examining this particular topic patient security and privacy, I have chosen the following scenario to write this plan on:

A) Scenario Introduction

Case Scenario 1 (Security Breach)
The administration at St. John’s Hospital takes pride in its sound policies and procedures for the protection of confidential client information. In fact, it serves as a model for other institutions in the area, however, printouts discarded in the restricted-access IS department are not shredded. On numerous occasions, personnel working late have observed the cleaning staff reading discarded printouts. What actions, if any, should these personnel take toward the actions of the cleaning staff? What actions, if any, should be taken by IS administration?

Before addressing the explicit actions that should be taken by the IS administration, the basics of the situation should be examined. St. John’s Hospital is a renowned institution that not only takes pride in its sound policies and procedures, but also seems to have an emphasis on protecting confidential client information. This principle, however, either seems not to have been properly followed, or, seems to lack the proper policies. This is because it was discovered that confidential IS department print outs, print outs that should be confidential, were found to be in the hands of cleaning staff after they were thrown away. This practice is dangerous for a number of reasons, but perhaps the most important breach is the patient’s (unfounded) expectation that their medical information should remain confidential.

I would respond to this potentially hazardous in four ways: 1) Provide a full-on diagnosis of what needs to be changed with current practices; 2) Propose a training program for the IS and cleaning staff involved in this incident; 3) Provide ways that it can be implemented at the hospital; 4) Provide a code of conduct.

Diagnosis of what needs to change from current departments

The diagnosis of changes will be broken down along two different departments: 1) The cleaning department; 2) The IS administration.

A) Cleaning Department Changes

The role of cleaning behavior staff in the reading of confidential IS printouts, that could include confidential information such as patient information that could lead to potential HIPAA infractions for the hospital. In order to prevent this from happening, the following steps should be taken by the cleaning administration:

• Cleaning staff shall be tasked with examining if there are any confidential documents that are found in the trash. If they find that there are documents in the receptacle, they should immediately return them to IS personnel that will be identified as part of a special task force created between the two departments.
• If cleaning staff disobey this order and look at documents that are not shredded, or, if they disseminate the materials to others, they shall be severely punished according to the following rubric:
  • First Time- Warning and discussion with supervisor
  • Second Time- Meeting with supervisor and mark on permanent record
  • Third Time- Dismissal from current position

B) IS Department Changes

In theory, the IS Department is the source of this problem in that it provides the material that is being looked at by the cleaning staff, endangering both the trust the patients have in the hospital, as well as the reputation of the hospital as a whole. In order to prevent this behavior from happening again, the following steps should be taken.

• The IS staff should have a rule that all printouts needed to be shredded in a certain period of time: That is, regardless of the content, it should be shredded before a certain time period
• There should be a new division created in the IS that focuses on the compliance efforts of the department to make sure that rules are being followed, particularly in the case of confidential information potentially being disseminated to other individuals. The following punnishments should be issued if an “infraction” is found to have occurred:
  • First Time- Warning and discussion with supervisor
  • Second Time- Meeting with supervisor and mark on permanent record
  • Third Time- Dismissal from current position

Training Program

In order to make sure that the following incident does not become part of the culture in St. John’s Hospital, there also needs to be on-going training programs. Since the training needs to be coordinated across departments, due to the inter-disciplinary nature of the offenses, an administrative-level taskforce that consists of representatives from the IS department, the cleaning department, and hospital operations should be created.

The following training tasks should be allocated to the following departments:

A) Hospital Operation Taskforce

The hospital operation taskforce will serve as the main coordinating body for the training activities that will take place between the IS department and the cleaning department:

• The hospital operations team will serve as the key stakeholders in making sure that both departments are notified regarding the training times and staff that need to participate;
• The hospital operations team will serve as the main aggregators of the training curriculum, working with the two teams to make sure that both are satisfied with the curriculum and its training goals
• The hospital operations team will also serve as the main mechanism of feedback: that is, rather than having the two different departments communicate with each other regarding dissatisfaction in the training, the hospital operations team will serve to help elicit that feedback and move to change the training based on the existing feedback.

B) Hospital Cleaning Department Responsibilities

The hospital cleaning department’s main role in training will be to liaise with the hospital operation task force, while also making sure that training objectives are meant by employees of the cleaning department

• The hospital cleaning department will nominate one individual to serve as a representative of the department for all training activities;
• This representative will be responsible for ensuring the attendance of cleaning employees at training; he/she will also be responsible for giving feedback to the main committee on how the training can be improved
• This representative, along with division leaders, will be responsible for metting out punishment to individuals that either do not (willingly) participate in the training; or for individuals that have gone through the training and still do not meet the necessary objectives.

C) IS Department Responsibilities

The IS department’s in training will be to liaise with the hospital operation task force, while also making sure that training objectives are meant by employees of the IS department. The hospital cleaning department will nominate one individual to serve as a representative of the department for all training activities.

• This representative will be responsible for ensuring the attendance of IS employees at training; he/she will also be responsible for giving feedback to the main committee on how the training can be improved- particularly in the area of IS.

• This representative, along with division leaders, will be responsible for metting out punishment to individuals that either do not (willingly) participate in the training; or for individuals that have gone through the training and still do not meet the necessary objectives.

• In addition, IS department will be responsible for developing a new (paperless) interface that will attempt to substantially reduce the amount of paper used in this hospital. This initiative will focus on the use of information technology, such as smart phones and I-pads, in order to make sure that confidential information is not listed on paper, and that employees cannot look at it.

Although implementation of this agenda will be difficult to achieve in the short-term, I believe that the focus on having three different divisions on the project will allow it to be successful. In particular, the implementation responsibilities for the project will be on the leaders from each department to make sure that it will happen. In order to facilitate this goal, there will also be a set of meetings over a three month time period that will focus on the implementation of the goals. The meeting schedule will look like something of the following:

• Kick-off meeting: The kick-off meeting will facilitate the training sessions and bring all of the different stakeholders together before the project kicks off;
• Two operational meetings a month- There will be two operational meetings a month that focus on dealing with operational issues that have come up in training and department initiatives. These will hopefully smooth the path for a more successful training.
• A closing (post-mortem) meeting- the post-mortem meeting will look at the training and identify whether there are further goals needed in order to accomplish the goals.

Code of Conduct for St. John Hospital Employees

• All patient printouts , after they have been looked at and acknowledged by relevant medical personnel, shall be shredded to the extent that they cannot be read in any intelligible form.
• The shredding shall take place with the mandated shredder that will now be available in every department- if the department does not have access to a shredder they should notify the administration immediately
• The shredding must also be conducted within an hour after the printouts are no longer needed; that is, an hour after they have been looked at by personnel. If it is conducted after an hour, there will be a stiff penalty assessed.

References:

Assaf, A.F. (1993). The Textbook of Total Quality in Healthcare.

Charney, H. (2009). Handbook of modern hospital safety. ASHE.

Kuhn, K. (1999). Building a hospital information system. Proc AMIA Symp, 834-838.

Lowey, T. (2002). Textbook of Healthcare Ethics. ASHE.

Healthcare IT News. (2011). Website.

Hospital IT (2012). Website.

Charney, H. (2009). Handbook of modern hospital safety. ASHE.