In my career, I have worked with many different hospital and laboratory computer systems. One of my greatest frustrations has been providing software permissions to staff at all levels, from clerical, nursing, technical, and medical—inside and outside the blood bank.
The software permissions that I am specifically referring to are those with the blood bank software. These I directly controlled as Division Head of Transfusion Medicine and Laboratory Information Systems. I am not talking about virtual private networks or Citrix or cloud-based software controlled by the hospital IT department.
Here are some examples of inappropriate permissions:
- All staff share the same access, regardless of position or department
- Technical staff, including non-blood bank staff have global access to all functions
- Non-blood bank staff can modify test results or comments
The golden rule is to only give access that is needed for each staff’s job designation. Staff must sign an agreement not to access the system except for work and not release anything to non-designated personnel.
I recommend separating privileges by:
- Blood bank vs non-blood bank staff
- Blood bank section and location
- Technical privileges by rank: trainee vs base technologist vs senior technologist vs supervisor vs technical director
- Medical privileges by rank: residents/fellows, junior medical staff, senior staff, head of sections/directors
Permissions within a test category may include test ordering, result entry, verification/authorization, and/or purging. In the donor center, it may include registration, donor qualification, collection, donor marker testing, donor immunohematology, component processing, component modification, and/or inter-depot transfer of components. Management tools included in the software may also be restricted to high-level staff.
In this time of COVID and staffing shortages, we may be training new staff to work in the blood bank. During their training, these trainees can be competency assessed and be given access to limited functions. In Medinfo Hematos IIG, you can give staff custom permissions test-by-test so for example, if they are deemed competent for ABO/D typing, you could restrict their access to only those tests as an interim measure.
Having customized access for each employee can be nightmare for the systems administrators so this granular special access must be kept to a minimum. However, it is good to know that you do have this capability if needed.