Record Access Restriction Activity Report

Display the Report Library: On the Main Menu, click Reports. Under General, click Report Library. Click the Clinicals tab. In the Standard Reports section of the tab, click run next to Record Access Restriction Activity.

To access reports on the Clinicals tab of the Report Library, you must have the Clinicals user permission and the Report: Report Library: Clinicals permission. The Report: Report Library: Clinicals permission is included in the following roles:

• Practice Superuser role
• Report Reader role

1. Display the Report Library: On the Main Menu, click Reports. Under General, click Report Library.
2. Click the Clinicals tab.
3. Click run next to Record Access Restriction Activity in the Standard Reports section of the tab.
   The Run Report: Record Access Restriction Activity page appears.

4. Select the criteria for the report:
   

   • From date - To date — Enter the start and end dates for the report or select a range from the drop-down menu.

     Note: You must apply at least one type of date filter.

   • Accessing User — Leave the default to view access of restricted patient records by all users, or click Selected and search for and select specific users to include in the report.
   • Patient by ID — Leave the default value ALL to view access of all records with a record access restriction, enter a specific patient's ID, or enter a list of patient IDs separated by commas.
   • Report Format — Select the format for your report results.
     • HTML table — Display the report results on your screen.
     • Text (tab-delimited) — Export the report results to a .csv file in tab-delimited format.
     • Text (comma-delimited) — Export the report results to a .csv file in comma-delimited format.
   • Report Options — Select report options.
     • Suppress Column Headings — Select this option to remove column headings from the report results.
     • Suppress Report Name — Select this option to remove the report name from the report results.
     • Show Filter Criteria — Select this option to include your selected filter criteria in the report results.
     • Run Offline (will appear in your Report Inbox tomorrow morning) — Select this option for very long reports. Reports that are run offline appear in your Report Inbox the morning after the request.

5. Click Run Report.

Each time a restricted record is accessed, the access is logged, and information about the access can be displayed in the Record Access Restriction Activity Report. The report helps your organization track access to sensitive data by answering these questions:

• Who is the patient and when are they receiving care? This includes Patient ID, Patient Name, (Date of) Patient’s Last Appointment, Department of Last Appointment, (Date of) Patient’s Next Appointment, and Department of Next Appointment.

• Who is the user and what is their role in the practice? This includes Accessing User, and User Role.

  Note: If an athenahealth employee accesses a restricted access patient record, the access is logged and displayed in the Record Access Restriction Activity Report with “EMPLOYEE” in the User Role column.

• How and when did the access occur? This includes Access Location, Access Date and Time, and whether the user viewed the patient record.

• What was the reason for the access?

  Two types of users are allowed to access patient records that have a record access restriction privacy protection note:

  • A free access user is the rendering, scheduling, or supervising provider assigned to an appointment for a patient with a record access restriction and can access the patient’s record for 15 days before and after the appointment.

     

    When a free access user accesses a restricted access patient record during the 15 days before or after an appointment for that patient, the access is logged and displayed in the Record Access Restriction Activity Report with "Rendering provider,” "Scheduling provider," or "Supervising provider" as the Reason for Access.

  • A restricted record access user is someone who is not the rendering, scheduling, or supervising provider, but requires access to the record of a patient with a record access restriction. This user must have either the Privacy: Access Blocked Patients or the Emergency Access: Privacy: Access Blocked Patients permission. When accessing the record, a restricted record access user must provide a reason for the access and can access the record for only 12 hours. If the user attempts to access the record after 12 hours, they must again provide a reason for the access.

     

    When a restricted record access user accesses a restricted access patient record, each reason for access is logged and displayed in the Record Access Restriction Activity Report.