The After-Hours Access Request
You are the EHR operations coordinator for a 12-provider clinic. At 7:30 PM on a Tuesday, a front-desk employee, Dana, calls your personal cell phone. She says she is at home and needs to look up a patient's insurance information because the patient is at the pharmacy and the pharmacy says the coverage is inactive. Dana says she has her laptop and can log in remotely if you 'just reset my password' because she forgot it. The clinic's remote access policy allows VPN access for clinical staff only; Dana is administrative staff. The pharmacy is waiting, and the patient is upset.
1. Should you reset Dana's password and grant remote access? Explain your reasoning.
Read the worked answer
No. Resetting the password and granting remote access would violate the clinic's policy and create security risk.
Reasoning:
- Policy scope: Remote VPN access is limited to clinical staff. Dana is administrative staff, so she is outside the authorized group.
- Identity verification: A password reset requested by phone to a personal cell cannot be safely verified; this is a common social-engineering vector.
- Least privilege: Even if Dana needed access, the request should go through the proper channel and be limited to what her role requires.
- Audit and accountability: Off-policy access at 7:30 PM could be flagged in an audit and is hard to justify.
The correct response is to explain the policy, decline the reset, and offer the proper path: Dana can contact the on-call clinical staff or the practice manager, or the issue can be handled the next business day through the normal workflow.
2. What alternatives could resolve the patient's immediate problem without violating policy?
Read the worked answer
Alternatives:
- On-call clinical staff: If a clinical staff member is on call, they can access the record and relay the insurance information to the pharmacy, within their role.
- Practice manager escalation: The manager may authorize a one-time exception if policy permits, with documentation.
- Pharmacy coordination: The pharmacy may be able to verify coverage through the payer directly or process the prescription and bill later.
- Next business day: If the medication is not urgent, the insurance issue can be resolved when the clinic opens.
- Patient portal or phone: The patient may be able to view coverage information through their portal or insurer.
The coordinator should document the request, the decision, and the alternative offered.
3. The next day, Dana's manager asks why the request was denied and says, 'She was just trying to help the patient.' How would you explain the decision, and what process improvement would you recommend?
Read the worked answer
Explanation:
- The denial was not about Dana's intent; it was about protecting patient data and following policy.
- Remote access is restricted to clinical staff because administrative access from unmanaged locations increases breach risk, and password resets by phone are a known attack vector.
- Allowing an exception would set a precedent that undermines the policy.
Process improvement recommendations:
- Publish a clear after-hours escalation path so staff know whom to call.
- Define a formal exception process with manager approval and documentation.
- Provide self-service password reset with multi-factor authentication so legitimate resets don't require a phone call.
- Train staff on social-engineering risks and the reason for access controls.
- Review whether administrative staff need limited remote access for specific tasks, and if so, scope it narrowly.