HI300 Unit 6 User Access Matrix Example

Nine Roles, Six Permissions, One Quarterly Review: A Unit 6 User Access Matrix for a Perinatal Documentation System, With the Reasons Behind Every Yes and Every No

[Student Name]

Purdue University Global

HI300: Information Systems for Health Care

Unit 6 User Access Matrix

[Instructor Name]

[Date]

The hospital and its roles are composite; the regulations and sources cited are real.

The Principle

The HIPAA Security Rule requires a covered entity to implement policies for authorizing access to electronic health information and technical controls that allow access only to persons or programs that have been granted it (45 C.F.R. § 164.312). The matrix below applies one working principle: each role gets the access its work on this unit needs, and no more. Access is granted by role rather than by person, so a nurse who moves to another unit loses labor unit access when her role changes, not when someone remembers. Role-based access also makes the rules easier to audit. When a question arises about why someone opened a record, the reviewer can compare what the person did with what the role allows, rather than reconstructing what one manager approved for one employee years earlier.

Permissions Defined

View: open the patient's record and tracing. Document: create entries, such as interpretations or assessments. Sign: finalize an entry so it becomes part of the legal record. Order: enter orders. Amend: correct a signed entry with the original preserved and the change attributed. Release: produce the record or parts of it for disclosure.

The Matrix, Role by Role

Labor and delivery registered nurse: view, document and sign. The nurse interprets tracings and charts care for her assigned patients and must see the whole unit for coverage. No order permission, since nurses carry out orders under protocols built as standing orders in the system. Amend her own entries only. Charge nurse: the nurse's access plus the unit summary view and the ability to reassign patients. The charge nurse needs to see every patient at once. No additional amendment rights. Obstetric attending physician: view, document, sign and order for patients on the unit. Amend own entries. Obstetric resident: view, document, order with cosignature by the attending. Signing of the delivery note requires the attending's cosignature, which the system enforces. Certified nurse midwife: view, document, sign and order for patients under her care, matching the scope written in her privileges. Anesthesiologist: view the whole record; document and sign anesthesia entries only; order medications related to anesthesia. Anesthesia needs the tracing to judge a patient's tolerance of an epidural but has no reason to write labor assessments. Unit clerk: view demographics and the census; no access to clinical notes or tracings. The clerk's work is registration and scheduling. NICU nurse: view the mother's record from the time of the delivery call and document in the newborn's record. Access to the mother's record ends at the mother's discharge. HIM coder and release of information specialist: view the complete record after discharge; release permission for the release specialist only; no documentation rights. No role may amend another person's signed entry. Corrections run through the author or, if the author has left, through an HIM process that preserves the original and records who changed what.

Three Decisions That Were Argued

The anesthesiologist's view of the full record was debated. Some members of the team wanted anesthesia limited to its own notes and the medication list. The obstetricians argued that an anesthesiologist judging whether a patient can tolerate a top-up of an epidural during a prolonged deceleration needs the tracing and the nurse's interpretations, and the team agreed. The NICU nurse's access to the mother's record was also argued. The mother's labor history, including fever, rupture of membranes and medications, shapes the newborn's first hours, so the team granted view access from the delivery call to the mother's discharge, and no longer. The unit clerk's lack of clinical access drew complaints, because clerks are often asked by families how a patient is doing. The team kept the restriction. A clerk who cannot see clinical notes cannot be asked to repeat them, and questions go to the nurse.

Break-the-Glass Access

A physician from another service called to an obstetric emergency may need the record immediately. The system offers emergency access that requires the user to state a reason and alerts the privacy officer, who reviews every use within two business days. Emergency access is not a back door; it is logged and explained.

Review

Access is reviewed every quarter. The nurse manager reviews the nursing and clerk roles, the chair of obstetrics reviews physicians and midwives, and the HIM director reviews HIM roles. Each reviewer receives a list of users with their roles and last sign-on date and must confirm or remove each. Any account unused for ninety days is suspended automatically. The administrative safeguards of the Security Rule call for this kind of periodic review of access authorization (45 C.F.R. § 164.308). Audit records of who opened which record, reviewed separately, show whether people with access are using it as their role requires, which is why the matrix and the audit review are designed together (Rule et al., 2020).

References

45 C.F.R. § 164.308 (2024).

45 C.F.R. § 164.312 (2024).

Rule, A., Chiang, M. F., & Hribar, M. R. (2020). Using electronic health record audit logs to study clinical activity: A systematic review of aims, measures, and methods. Journal of the American Medical Informatics Association, 27(3), 480-490. https://doi.org/10.1093/jamia/ocz196