5 Questions About Epic and Privacy

In your job at Carilion, you might have access to Epic (our electronic medical record). Epic contains our patients’ most private information. They put their trust in us to take care of them, and it is up to us to respect their privacy.

If you use Epic, you can access patient records for business-related reasons (treatment, payment, and health care operations). You should only access the minimum amount of information necessary to accomplish your purpose. For example, if you need to review a patient’s allergies, you would access only that portion of the chart.

Read and see if you know the answers to these questions about Epic and Privacy.

Can I access PHI to perform my job duties? 

Yes! Carilion employees are permitted to access and share PHI to perform their official job duties. Official job duties typically include providing patient care, coordinating payments for the services the patient received, or completing other operational tasks to help provide patient care. Please remember, you may only access and share the minimum amount of PHI needed to accomplish the task at hand.

I am an hourly employee who works at the hospital.  When I am off the clock, can I log into Epic to review charts and perform tasks? 

No. Although we appreciate your dedication, you may only perform work-related duties while you are on the clock. For most employees who work at a patient care location, it should be rare for you to access Epic remotely. Of course, some exceptions may apply—we encourage you to discuss your activities with your manager or the Privacy and Information Security team.

I saw a really sad story in the news, and I heard that one of the people involved was brought to Carilion Clinic for care. May I review the patient's chart in Epic? 

Unless you have a legitimate job-related reason for accessing the chart, you may not look up the patient’s information in Epic. All of our patients have the right to privacy, including those who make the news. 

I maintain a personal patient list in Epic of patients that I have treated for quick access if the patient returns to my unit, is that ok?

No. We applaud your willingness to help our patients and to have quick access if the patient returns to your unit, however, accessing this list and viewing the patients without a business-related reason is inappropriate and could lead to privacy issues. It is your responsibility to manually update the list each shift as your assignments change or as your patients are admitted, discharged, or transferred. You may choose to leave a discharge patient on your list until your documentation is complete.

The Emergency Department track board and system unit list is a terrific way to see what is happening around the organization. Can I review the track board or system unit list to learn more?    

The track board and system unit list is a great tool for the individual team to manage the care of patients in their respective units. These lists should not be utilized for the sole purpose of viewing census levels in other departments. The respective unit’s staff may only use the information on the list to provide care to the assigned patients they are treating. Other employees outside the respective units (such as the clinical administrator) may also have a legitimate need to view these lists. However, we have found that some employees may access these lists for other reasons, which may not be permissible. Please think before you click! 

FOR MORE INFORMATION

The Privacy team and your manager are available to answer questions on whether the tools you use are appropriate for your role, as well as any other questions you have about protecting our patients’ privacy. All you have to do is ask!

• Email privacy@carilionclinic.org.
• Call the Privacy Office directly at 540-510-4600.
• Report something through the Integrity Help Line at 844-732-6232 or compliance.carilionclinic.org
  • When reporting anonymously please provide detailed description of the concern