Question

Worst Case Example

Dr. Rogers is ordering a prescription by using electronic order entry for a nursing home resident in the geriatric outpatient clinic at City Hospital A on October 15. The patient with dementia presents to the clinic with a nursing assistant from Nursing Care Facility A, she is registered as Ethel Mertz, and her health records are placed in queue for Dr. Rogers.

Nursing Care Facility A had been contacted the previous day to gather information for the appointment. The registration clerk from the hospital asked only for the patient’s name then used the lookup feature in the EHR system to locate existing health records and place them in Dr. Roger’s authorized access list for the upcoming appointment. The City Hospital A system automatically populates registration data and places patient records in an authorized access queue for scheduled patients in the clinics on the day of the visit.

The nurse has downloaded a printout from the EHR system for Dr. Rogers to use in the examination room while caring for the patient, but he doesn’t see that the Ethel Mertz in the record is 27 years old and has an address in another city. It’s easy to locate Ethel’s record in the system by typing in the first three numbers of her Social Security number (also stamped on the fee ticket) used to bill Medicaid for services. The clinic staff has already verified that Ethel is eligible for Medicaid.

The physician order entry software provides the capability for default self-selection upon entering the first three letters of the drug. The physician wanted to order Norfloxacin for an eye infection. As soon as “Nor” was entered, the software prompted for Norflex, which was accepted. The prescription/medication order was received in the pharmacy and was filled for Norflex, which is a muscle relaxant rather than an antibiotic. Both are oral medications, although muscle tightening or spasms could result from Norflex. The order was signed electronically, the medication was made available for the nursing assistant to pick up, and the patient was returned to the nursing facility.

The patient with an infection requiring treatment with Norfloxacin began taking Norflex and returned to the emergency room later the same week with septic shock due to a very serious bacterial infection of the left eye. When the emergency room staff accessed her health record, there was no entry for a geriatric clinic visit on October 15, so the findings from her care were not available.

City Hospital A filed a Medicaid claim for Ethel Mertz and was paid for a clinic visit on October 15 with pharmacy charges for a Norflex prescription. Unfortunately, the Nursing Care Facility A patient’s name is Ethel Mertz, age 93. She has a number of chronic health problems, takes a number of medications, and has an allergy to drugs containing quinolone.

Assignment

1. Using the 8 key principles of the AHIMA Information Governance Principles for Healthcare (IGPHC), review the case and determine which of the principles were violated in this scenario. Give specific examples of the violation.

2. Develop two policies that would protect the integrity of the data City Hospital A in the future.

Answer 1

answer-

1- In this case, the principles were violated are-

Principle of accountability: One member of the organization's leadership will be responsible for information governance.

Principle of protection: All information will be kept secure.

Principle of compliance: The information governance program will follow all applicable laws, standards or policies.

all above three principles were violated like Dr. Rogers should know who is their patient and their personal information and medical conditions before making and prescribing and medication to Ethel Mertz. this violates the principle of accountability.

Principle of protection is violated where anyone can see information of patient or any other information as soon as someone can type three letters in the ordering system. as th

Principle of compliance as there was no proper governance of software and data of records in the clinic.like there were wrong information were recorded like age of Ethel and wrong address and wrong prescription ordered.

The two policies would be -

Proper administration of data management in which the person recording the data should fill all the information of patients and drugs separately and compeletely so that accurate results comes out when they type the name in the system.

second policy would be Protection protocols like passwords, firewall etc on system so that data remains confidential and only be available to its stakeholders.