Confidentiality issues within a clinical information system: moving from data-driven to event-driven design.

Area of Science:

• Health Informatics
• Information Security
• Hospital Management

Background:

• The shift from retrospective to prospective clinical information systems in hospitals necessitates robust patient data confidentiality measures.
• Traditional matrix models for access control may not adequately address the dynamic nature of patient data access in modern healthcare.

Purpose of the Study:

• To describe an improved access control method using an event-driven model for enhanced patient data confidentiality.
• To ensure that user access to patient data is based on a validated "need-to" relationship.

Main Methods:

• An event-driven model was developed, defining specific data events (e.g., admission, discharge, prescription) that trigger user-patient relationship management.
• The model relies on real-time management of patient repositories and working lists, closely aligned with clinical care processes.
• Access control is dynamically updated based on the occurrence and resolution of defined clinical events.

Main Results:

• The event-driven model dynamically manages user-patient access relationships based on real-time clinical events.
• This approach improves the security of patient data within prospective clinical information systems.
• Implementation requires significant organizational adjustments to manage hospital activities in real-time.

Conclusions:

• The event-driven model offers a viable solution for enhancing patient data confidentiality in evolving hospital information systems.
• While effective, the model introduces considerable organizational constraints that need careful management.
• Real-time alignment of data management with patient care processes is crucial for the model's success.