INFORMATION SECURITY AND AUDIT
SOLVED PRACTICE QUESTIONS

CLINICAL INFORMATION SYSTEM 

A Clinical Information System (CIS) is a type of health information system that is designed to manage clinical data and support clinical practices in healthcare settings.

Components of a Clinical Information System

  1. Electronic Health Records (EHR) / Electronic Medical Records (EMR):

    • Central repositories for patients' health information, including medical history, diagnoses, treatments, medications, immunizations, allergies, radiology images, and lab test results.
  2. Clinical Decision Support Systems (CDSS):

    • Tools that provide healthcare professionals with knowledge and patient-specific information, intelligently filtered and presented at appropriate times, to enhance patient care.
  3. Computerized Physician Order Entry (CPOE):

    • Systems that allow healthcare providers to enter and manage orders for medications, laboratory tests, imaging studies, and other services electronically.
  4. Medication Management Systems:

    • Tools for managing medication prescribing, dispensing, administration, and monitoring, often integrated with pharmacy systems to ensure safety and efficacy.
  5. Patient Management Systems:

    • Systems for scheduling, admissions, discharge, and transfer (ADT) processes, helping to manage patient flow within the healthcare facility.

Access Principles

Access Principle 1: Each medical record has an access  control list naming the individuals or groups who may  read and append information to the record. The system  must restrict access to those identified on the access  control list.Medical ethics require that only clinicians and the patient  have access to the patient's medical record.

Access Principle 2: One of the clinicians on the access  control list (called the responsible clinician) must have  the right to add other clinicians to the access control list.

Access Principle 3: The responsible clinician must notify the  patient of the names on the access control list whenever the  patient's medical record is opened. Except for situations given in  statutes, or in cases of emergency, the responsible clinician must  obtain the patient's consent.

Access Principle 4: The name of the clinician, the date, and the  time of the access of a medical record must be recorded. Similar  information must be kept for deletions.

Creation Principle: A clinician may open a record, with the  clinician and the patient on the access control list. If the record is  opened as a result of a referral, the referring clinician may also be  on the access control list.