MD & DO Would this be a HIPAA violation?

[Zombiegirl]

Hi friends, I just want to get your opinion on something. I work at my uncle's medical practice every summer and have access to our EHR system that also goes with the hospital system. I was invited to do a research project this summer with two physicians at the hospital and they have asked me to use my own log-in for the research to collect data.

Obviously, as a medical student and general non-terrible person, I want this to be as above-board as possible and I don't want to break any rules. Do you see any issue with this? My uncle says it's fine and I'm just being paranoid, and the physicians are fine with it too. I emailed our compliance person to ask, but she doesn't have a tendency of getting back to us quickly (or at all). What do you think?

---

Members don't see this ad.

 

[Small Cell Carcinoma]

I am lost. There is nothing here that remotely sounds like it would violate HIPPA unless I am missing something. It could be if you were caught using someone else's log in, but I don't see what the issue would be with using your own so long as you have been given access by the system.

 

[Zombiegirl]

I am lost. There is nothing here that remotely sounds like it would violate HIPPA unless I am missing something. It could be if you were caught using someone else's log in, but I don't see what the issue would be with using your own so long as you have been given access by the system.

Haha, well thank you for your response. I'll admit, I'm a major scaredy cat about getting in trouble, probably too much so. I guess my concern was using my log-in that I use to help my uncle's private practice patients, to do research with these other doctors on a different subset of patients? I feel like its fine? I just have never operated in this space before. I'm sure the research is all above board and has been approved, the MD's are both medical directors.

 

[deleted947265]

I'm confused. This reeks of a phishing attack with the way you've worded it.

Are they asking you to use your login so they can use your account to access data?

Have you ever met these people face to face?

What is the research project and what are they asking you to do exactly?

 

[aSagacious]

Is the hospital system associated with a university? In any case if you want to do your due diligence you could look into whether there is an IRB board. For most retrospective chart reviews you'll submit an expedited IRB or may be IRB exempt.

 

[aSagacious]

I'm confused. This reeks of a phishing attack with the way you've worded it.

Are they asking you to use your login so they can use your account to access data?

Have you ever met these people face to face?

What is the research project and what are they asking you to do exactly?

I think you're misunderstanding. Nobody is asking to use the OP's login. The three attendings obviously have their own EMR access. It's just good form for anyone perusing through charts (OP included) to use their own login.

 

[Zombiegirl]

I think you're misunderstanding. Nobody is asking to use the OP's login. The three attendings obviously have their own EMR access. It's just good form for anyone perusing through charts (OP included) to use their own login.

Haha, thank you. Yes, I have met with them and worked with them before on research. The hospital is affiliated with my medical school, I think the project is exempt like you said, because it is a quality improvement project. I really appreciate your feedback, like I said I'm just a bit of a worry wart, I think I will make sure I see a copy of the protocol before I do anything further.

 

[Mass Effect]

Haha, thank you. Yes, I have met with them and worked with them before on research. The hospital is affiliated with my medical school, I think the project is exempt like you said, because it is a quality improvement project. I really appreciate your feedback, like I said I'm just a bit of a worry wart, I think I will make sure I see a copy of the protocol before I do anything further.

So your uncle's medical practice is affiliated with the hospital that's affiliated with your medical school? So it's all the same healthcare system?

 

[Zombiegirl]

So your uncle's medical practice is affiliated with the hospital that's affiliated with your medical school? So it's all the same healthcare system?

Yep, that's exactly right!

 

[TAVR4life]

You will absolutely need to submit an IRB expedited review for retrospective chart review. Once approved by IRB, that will allow you to go through patient medical records for research purposes.

 

[Zombiegirl]

You will absolutely need to submit an IRB expedited review for retrospective chart review. Once approved by IRB, that will allow you to go through patient medical records for research purposes.

Yes, I think they are preparing to submit it now, and just wanted to make sure I had access! I will make sure I have a copy of the protocol before I get started. Thanks!

 

[Tenk]

If it’s IRB approved you can go through charts. I’ve viewed thousands of charts of people I never took care of during med school for research.

 

[Zombiegirl]

If it’s IRB approved you can go through charts. I’ve viewed thousands of charts of people I never took care of during med school for research.

Okay, awesome thank you! It really helps to hear this is a normal thing. After all those scary HIPAA training modules I feel guilty even looking at our EMR haha. I appreciate it!

 

[Cakepop514]

Okay, awesome thank you! It really helps to hear this is a normal thing. After all those scary HIPAA training modules I feel guilty even looking at our EMR haha. I appreciate it!

just make sure you are actually listed on the IRB protocol as a study staff member. yes, you definitely need an active protocol for study activity but you also need to be approved by the IRB as someone who will be doing the data collection.