Re: [Gnumed-devel] GNUmed access permissions

[Karsten Hilbert]

On Fri, Jun 22, 2012 at 08:30:20AM -0700, Jim Busser wrote:

> >> I have pushed code into gitorious.org which implements a
> >> non-clinical staff account.
> 
> Patient care often needs the exchange of documents and if
> it must always be the doctor or clinician level worker who
> takes care of it (as a result of access restrictions) then
> IMO that would be an inefficient (poor) use of this category
> of person's time.

Maybe so - this is a pragmatic argument.

However, one needs to decide what one wants. Either one
wants non-clinical staff or not.

Non-clinical staff cannot write bills either, because (in
Germany) they typically contain diagnoses. Also, billing
codes can convey some idea of the care rendered.

In practice this amounts to

- most staff in most praxi having access to most data, including clinical

- most patients in most praxi signing a waiver that staff at each
  praxis may process any data as required (the "as required"
  is crucial)

In that vain I believe GNUmed should, first of all, define
clinical and non-clinical staff.

There IS a solution for the special case of document entry:

Non-clinical staff will be able to write a default episode
but not ready any :-)

Of course, this is just a smokescreen because such staff
will inevitably need to be able to physically touch the
paper they are scanning -- which will contain more or less
highly sensitive clinical data !

This, again, shows that "levels" of clinical access are a
social issue and cannot be solved by technology alone.

> This would also be consistent with the non-clinician's
> current (as coded) ability to attach documents.

Have you tried ?

> Therefore, should it be possible for the non-clinician to

non-clinicAL, not non-clinicIAN

> generate an EMR summary (this would mean to provide them
> access to the Write letter function).

Certainly not. What use would that be ?

> Concerns about any abuse of privilege could be lessened by
> the fact that such report-writing is always captured in the
> EMR Journal, even if the user did not attach the document,
> even without the need for GNUmed to operate in a HIPAA mode.
> 
> Maybe, however, this would over-complicate the access privileges?

I think it is a big waving of hands.

Karsten
-- 
GPG key ID E4071346 @ gpg-keyserver.de
E167 67FD A291 2BEA 73BD  4537 78B9 A9F9 E407 1346