Implementing access control to protect the confidentiality of patient information in clinical information systems in the acute hospital

In this paper, a practical approach to managing the confidentiality of patient information in large-scale clinical information systems in the acute hospital is described. The traditional approach of limiting the functions that hospital staff can undertake is necessary but not sufficient. Control over access to the individual patient is required, with this access only being granted when the member of staff’s rights match a patient’s current clinical contacts. In our experience, the setting-up and maintenance of such rights is a non-trivial, but achievable, task.