1. Confidential medical information should be entered into the computer-based record only by authorized personnel. Additions to the record should be time and date stamped, and the person making the additions should be identified in the record.
2. The patient and physician should be advised about the existence of computerized data bases in which medical information concerning the patient is stored. Such information should be communicated to the physician and patient prior to the physician’s release of the medical information to the entity or entities maintaining the computer data bases.
3. Procedures for purging the computerized data base of archaic or inaccurate data should be established and the patient and physician should be notified before and after the data has been purged. There should be no mixing of a physician’s computerized patient records with those of other computer service bureau clients. In addition, procedures should be developed to protect against inadvertent mixing of individual reports or segments thereof.
4. The computerized medical data base should be online to the computer terminal only when authorized computer programs requiring the medical data are being used. Individuals and organizations external to the clinical facility should not be provided online access to a computerized data base containing identifiable data from medical records concerning patients.
5. Upon termination of computer services for a physician, those computer files maintained for the physician should be physically turned over to the physician. They may be destroyed (erased) only if it is established that the physician has another copy (in some form). In the event of file erasure, the computer service bureau should verify in writing to the physician that the erasure has taken place.
6. All individuals and organizations with some form of access to the computerized