82 PART III Rollout of an HCM
✔✔Step 3: exceptional access to patient data.
For emergencies or exceptional medical circumstances, users must be able
to access data they are otherwise not authorized to access. An HIS already
allows these special permissions, thus allowing access to such data by
invoking
the multi-format viewer. Optimally, an HCM system provides
this functionality by itself.
Check whether your HCM system grants special privileges for accessing
data that is otherwise outside the scope of authorization and whether it
logs these activities, including the reason for such access.
Speaking about users and user groups: it would certainly be a great relief if these
were centrally managed for all IT systems including the HCM system. If you use
a central directory service with an LDAP interface in your institution, this would
be easily possible, provided that the HCM system supports this interface.
Once your authorization concept has been defined and implemented,
you should verify its functional capability. For example, you can
use test data and the multi-format viewer to simulate authorized and
unauthorized
access, and to ensure that the desired data is displayed.
Furthermore, verify whether access to data – special access in particular
–
is logged correctly.
Step five: importing data
Once you have successfully completed the first four steps, you can finally start importing
data into the system. But first you should ask yourself a question: what is
the processing status of data imported into the HCM system?
Medical data of a patient should be available to all users involved in the treatment
process as early as possible. This is the core aspiration of an HCM system. Let’s
take a look at how it can be accomplished. Findings documents, doctor’s letters
or similar things are often not finalized in one step. Instead, the physician creates
preliminary versions of the document. Storing such preliminary versions in
an HCM system and thus making them available to users harbors risks. If the
content of the document changes significantly before its final approval, the users
who have only read the preliminary document must be identified and informed
about the new content.
You should only enter data into an HCM system that typically does
not subsequently change, such as approved findings, signed doctor’s
letters or complete radiological image data.