Health Information Exchange User Access - EGEN.01

Responsibility for User Access

All physicians in a medical practice must sign a Practitioner Systems Access Agreement verifying that they will uphold the requirements stated in the Conformance Standards, and are responsible for their staff's access to health information exchange (HIE) systems.

Physicians are also responsible for identifying the most appropriate functional role for each staff member and ensuring the role does not provide greater access than what is appropriate (e.g., ensuring a medical office assistant (MOA) is not identified as fulfilling a prescriber role).

Non-physician staff accessing services must read and sign an Undertaking of Confidentiality and Security form. All staff accessing services must have a business or clinical purpose for searching for patient's and/or patients clinical information. General browsing is not permitted.

Before providing treatment, the client's identity must be confirmed using proper documentation. Definitive identification helps ensure clinical information is associated with the correct patient. Medical practices must safeguard their patient's personal information by ensuring individuals are who they say they are before accessing or disclosing any information.

All staff accessing non-production environments for training purposes must read and agree to abide by the terms specified in the Acceptable Use Policy for Non-production Environments.

Requesting User Access to Health Information Exchange Systems

For a medical practice electronic medical record (EMR) user to access the ministry's HIE systems, the following activities must take place:

1. For each user, assign a role and unique ID within the software application. Contact your software provider for assistance, if required. The functional role determines the level of access the user has to data within the HIE system. It is essential that the correct role be requested. If the wrong role is assigned, the user will either have access to too little or too much data for their job function, both of which are problematic.
2. Determine the user's functional role in your office
3. All users (both health professionals and support staff) requiring access to ministry HIE systems must be authorized. Contact the Ministry of Health at HLTH.HnetConnection@gov.bc.ca to initiate the registration process. Complete a registration form specifying information about the individual, including their EMR user ID and the functional role they occupy.
4. When the ministry has set up the user, the minsitry will contact your software provider to configure the user's access.
5. Receive confirmation from your software provider that the user has been set up to access the HIE system.

Note: These steps apply to all staff members including temporary replacements such as physician locums or temporary MOAs.

Changing Existing User Access

If one of the users in your clinic assumes different duties requiring a new clinic role, you must contact the Ministry of Health to identify their new functional role to ensure they have the correct level of access for their new duties.

Removing User Access

If a user (i.e., a practitioner or staff member) leaves your clinic or will not be accessing the HIE system for a period greater than three months:

• contact the Ministry of Health to have their account deactivated; and
• contact your software provider to have their application ID deactivated.

Reinstating User Access

If a previous user (i.e., a practitioner or staff member) returns to work at your clinic, you can apply to the Ministry of Health to have the account reinstated.