Designing for privacy management in hospitals: Understanding the gap between user activities and IT staff's understandings

A scoping review of the drivers and barriers influencing healthcare professionals' behavioral intentions to comply with electronic health record data privacy policy

Objective: Electronic Health Records (EHRs) are now an integral part of health systems in middle and high-income countries despite recognized deficits in the digital competencies of Healthcare Professionals (HCPs). Therefore, we undertook a scoping review of factors influencing compliance with EHR data privacy policies. Methods: Seven databases revealed 27 relevant studies, covering a range of countries, professional groups, and research methods. The diverse nature of these factors meant that 18 separate theoretical frameworks representing technology-acceptance to behavioral psychology were used to interpret these. Results: The predominant factors influencing compliance with EHR data privacy policies included confidence and competence to comply, perceived ease of use, facilitatory environmental factors, perceived usefulness, fear that non-compliance would be detected and/or punished and the expectations of others. Conclusion: Human factors such as attitudes, social pressure, confidence, and perceived usefulness are as important as technical factors and must be addressed to improve compliance.

Healthcare workers' communicative constitution of health information technology (HIT) resilience

Purpose

Although resilience is heavily studied in both the healthcare and organizational change literatures, it has received less attention in healthcare information technology (HIT) implementation research. Healthcare organizations are consistently in the process of implementing and updating several complex technologies. Implementations and updates are challenged because healthcare workers often struggle to perceive the benefits of HITs and experience deficiencies in system design, yet bear the brunt of the blame for implementation failures. This combination implores healthcare workers to exercise HIT resilience; however, how they talk about this construct has been left unexplored. Subsequently, this study explores healthcare workers' communicative constitution of HIT resilience.

Design/methodology/approach

Twenty-three physicians (N = 23), specializing in oncology, pediatrics or anesthesiology, were recruited from one healthcare organization to participate in comprehensive interviews during and after the implementation of an updated HIT system DIPS.

Findings

Thematic analysis findings reveal physicians communicatively constituted HIT resilience as their (1) convictions in the continued, positive developments of newer HIT iterations, which marked their current adaptive HIT behaviors as temporary, and (2) contributions to inter-organizational HIT brainstorming projects in which HIT designers, IT staff and clinicians jointly problem-solved current HIT inadequacies and created new HIT features.

Originality/value

Offering both practical for healthcare leaders and managers and theoretical implications for HIT and resilience scholars, this study's results suggest that (1) healthcare leaders must work diligently to create a culture of collaborative HIT design in their organization to help facilitate the success of new HIT use, and (2) information technology scholars reevaluate the theoretical meaningfulness a technology's spirit and reconsider the causal nature of a technology's embedded structures.

Workarounds in Electronic Health Record Systems and the Revised Sociotechnical Electronic Health Record Workaround Analysis Framework: Scoping Review

BACKGROUND

Electronic health record (EHR) system users devise workarounds to cope with mismatches between workflows designed in the EHR and preferred workflows in practice. Although workarounds appear beneficial at first sight, they frequently jeopardize patient safety, the quality of care, and the efficiency of care.

OBJECTIVE

This review aims to aid in identifying, analyzing, and resolving EHR workarounds; the Sociotechnical EHR Workaround Analysis (SEWA) framework was published in 2019. Although the framework was based on a large case study, the framework still required theoretical validation, refinement, and enrichment.

METHODS

A scoping literature review was performed on studies related to EHR workarounds published between 2010 and 2021 in the MEDLINE, Embase, CINAHL, Cochrane, or IEEE databases. A total of 737 studies were retrieved, of which 62 (8.4%) were included in the final analysis. Using an analytic framework, the included studies were investigated to uncover the rationales that EHR users have for workarounds, attributes characterizing workarounds, possible scopes, and types of perceived impacts of workarounds.

RESULTS

The SEWA framework was theoretically validated and extended based on the scoping review. Extensive support for the pre-existing rationales, attributes, possible scopes, and types of impact was found in the included studies. Moreover, 7 new rationales, 4 new attributes, and 3 new types of impact were incorporated. Similarly, the descriptions of multiple pre-existing rationales for workarounds were refined to describe each rationale more accurately.

CONCLUSIONS

SEWA is now grounded in the existing body of peer-reviewed empirical evidence on EHR workarounds and, as such, provides a theoretically validated and more complete synthesis of EHR workaround rationales, attributes, possible scopes, and types of impact. The revised SEWA framework can aid researchers and practitioners in a wider range of health care settings to identify, analyze, and resolve workarounds. This will improve user-centered EHR design and redesign, ultimately leading to improved patient safety, quality of care, and efficiency of care.

A scoping review of qualitative research in JAMIA: past contributions and opportunities for future work

OBJECTIVE

Qualitative methods are particularly well-suited to studying the complexities and contingencies that emerge in the development, preparation, and implementation of technological interventions in real-world clinical practice, and much remains to be done to use these methods to their full advantage. We aimed to analyze how qualitative methods have been used in health informatics research, focusing on objectives, populations studied, data collection, analysis methods, and fields of analytical origin.

METHODS

We conducted a scoping review of original, qualitative empirical research in JAMIA from its inception in 1994 to 2019. We queried PubMed to identify relevant articles, ultimately including and extracting data from 158 articles.

RESULTS

The proportion of qualitative studies increased over time, constituting 4.2% of articles published in JAMIA overall. Studies overwhelmingly used interviews, observations, grounded theory, and thematic analysis. These articles used qualitative methods to analyze health informatics systems before, after, and separate from deployment. Providers have typically been the main focus of studies, but there has been an upward trend of articles focusing on healthcare consumers.

DISCUSSION

While there has been a rich tradition of qualitative inquiry in JAMIA, its scope has been limited when compared with the range of qualitative methods used in other technology-oriented fields, such as human-computer interaction, computer-supported cooperative work, and science and technology studies.

CONCLUSION

We recommend increased public funding for and adoption of a broader variety of qualitative methods by scholars, practitioners, and policy makers and an expansion of the variety of participants studied. This should lead to systems that are more responsive to practical needs, improving usability, safety, and outcomes.

Assessment of Doctors' Knowledge and Attitudes Towards Confidentiality in Hospital Care

The physician's duty of confidentiality is based on the observance of the patient's privacy and intimacy and on the importance of respecting both of these rights, thus creating a relationship of confidence and collaboration between doctor and patient. The main objective of this work consists of analyzing the aspects that are related to the confidentiality of patients' data with respect to the training, conduct and opinions of doctors from different Clinical Management Units of a third-level hospital via a questionnaire. The present study aimed to define the problem and determine whether the opinions of these professionals correspond to those observed in a previous work conducted at the same center. Of the 200 questionnaires that were collected, 62.5% were from consultants and the rest were from residents (37.5%) with an average of 14.4 ± 12.5 years in professional practice. The respondents noted habitual situations in which confidentiality was breached in the reference hospital (74%). The section on their attitudes and behaviors towards situations related to confidentiality showed a slightly lower average score than that of their medical knowledge; significant differences in these scores were observed between the consultants and residents as well as between the extreme age groups (≤ 30 vs. ≥ 51 years) and years of professional practice, thus more inadequate attitudes were consistently noted in younger doctors who had fewer years of experience. Finally, the respondents answered that the training of doctors in the aspects of healthcare law and ethics was the most important measure that the hospital could adopt regarding confidentiality practices.

Qualitative study exploring the phenomenon of multiple electronic prescribing systems within single hospital organisations

Background

A previous census of electronic prescribing (EP) systems in England showed that more than half of hospitals with EP reported more than one EP system within the same hospital. Our objectives were to describe the rationale for having multiple EP systems within a single hospital, and to explore perceptions of stakeholders about the advantages and disadvantages of multiple systems including any impact on patient safety.

Methods

Hospitals were selected from previous census respondents. A decision matrix was developed to achieve a maximum variation sample, and snowball sampling used to recruit stakeholders of different professional backgrounds. We then used an a priori framework to guide and analyse semi-structured interviews.

Results

Ten participants, comprising pharmacists and doctors and a nurse, were interviewed from four hospitals. The findings suggest that use of multiple EP systems was not strategically planned. Three co-existing models of EP systems adoption in hospitals were identified: organisation-led, clinician-led and clinical network-led, which may have contributed to multiple systems use. Although there were some perceived benefits of multiple EP systems, particularly in niche specialities, many disadvantages were described. These included issues related to access, staff training, workflow, work duplication, and system interfacing. Fragmentation of documentation of the patient’s journey was a major safety concern.

Discussion

The complexity of EP systems’ adoption and deficiencies in IT strategic planning may have contributed to multiple EP systems use in the NHS. In the near to mid-term, multiple EP systems may remain in place in many English hospitals, which may create challenges to quality and patient safety.

Electronic supplementary material

The online version of this article (10.1186/s12913-018-3750-1) contains supplementary material, which is available to authorized users.

Challenges of using Hospital Information Systems by nurses: comparing academic and non-academic hospitals

Background and aim

Hospital Information Systems (HIS) are used for easy access to information, improvement of documentation and reducing errors. Nonetheless, using these systems is faced with some barriers and obstacles. This study identifies the challenges and the obstacles of using these systems in the academic and non-academic hospitals in Kerman.

Methods

This is a cross-sectional study which was carried out in 2015. The statistical population in this study consisted of the nurses who had been working in the academic and non-academic hospitals in Kerman. A questionnaire consisting of two sections was used. The first section consisted of the demographic information of the participants and the second section comprised 34 questions about the challenges of HIS use. Data were analyzed by the descriptive and statistical analysis (t-test, and ANOVA) using SPSS 19 software.

Results

The most common and important challenges in the academic hospitals were about human environment factors, particularly “negative attitude of society toward using HIS”. In the non-academic hospitals, the most common and important challenges were related to human factors, and among them, “no incentive to use system” was the main factor. The results of the t-test method revealed that there was a significant relationship between gender and the mean score of challenges related to the organizational environment category in the academic hospitals and between familiarity with HIS and mean score of human environment factors (p<0.05). The results of the ANOVA test also revealed that the educational degree and work experience in the healthcare environment (years) in the academic hospitals have a significant relationship with the mean score related to the hardware challenges, as well, experience with HIS has a significant relationship, with the mean score related to the human challenges (p<0.05).

Conclusion

The most important challenges in using the information systems are the factors related to the human environment and the human factors. The results of this study can bring a good perspective to the policy makers and the managers regarding obstacles of using HISs from the nurses’ perspective, so that they can solve their problems and can successfully implement these systems.

Compliance With Electronic Medical Records Privacy Policy: An Empirical Investigation of Hospital Information Technology Staff

The employment of Electronic Medical Records is expected to better enhance health care quality and to relieve increased financial pressure. Electronic Medical Records are, however, potentially vulnerable to security breaches that may result in a rise of patients’ privacy concerns. The purpose of our study was to explore the factors that motivate hospital information technology staff’s compliance with Electronic Medical Records privacy policy from the theoretical lenses of protection motivation theory and the theory of reasoned action. The study collected data using survey methodology. A total of 310 responses from information technology staff of 7 medical centers in Taiwan was analyzed using the Structural Equation Modeling technique. The results revealed that perceived vulnerability and perceived severity of threats from Electronic Medical Records breaches may be used to predict the information technology staff’s fear arousal level. And factors including fear arousal, response efficacy, self-efficacy, and subjective norm, in their turn, significantly predicted IT staff’s behavioral intention to comply with privacy policy. Response cost was not found to have any relationship with behavioral intention. Based on the findings, we suggest that hospitals could plan and design effective strategies such as initiating privacy-protection awareness and skills training programs to improve information technology staff member’s adherence to privacy policy. Furthermore, enhancing the privacy-protection climate in hospitals is also a viable means to the end. Further practical and research implications are also discussed.

A Knowledge-Constrained Access Control Model for Protecting Patient Privacy in Hospital Information Systems

Current access control mechanisms of the hospital information system can hardly identify the real access intention of system users. A relaxed access control increases the risk of compromise of patient privacy. To reduce unnecessary access of patient information by hospital staff, this paper proposes a knowledge-constrained role-based access control (KC-RBAC) model in which a variety of medical domain knowledge is considered in access control. Based on the proposed Purpose Tree and knowledge-involved algorithms, the model can dynamically define the boundary of access to the patient information according to the context, which helps to protect patient privacy by controlling access. Compared with the role-based access control model, KC-RBAC can effectively protect patient information according to the results of the experiments.