Unauthorized Data AccessNCT05251844
The Effectiveness of Email Alerting on Reducing Employees' Unauthorized Access to Protected Health Information
A study testing receiving an email in people with Unauthorized Data Access, run by Protenus, Inc. at 1 site in United States.
Trial summary
To assess the effectiveness of email warnings on reducing repeated unauthorized access to Protected Health Information (PHI), a randomized trial was conducted in a large academic medical center to understand the effectiveness of email warning on reducing repeated unauthorized access to PHI. Read more about this study
- Who is it for?
- Any age
- Conditions the study is for
- Unauthorized Data Access
- What is being tested?
- receiving an email
- Could I receive a placebo?
- No, everyone receives an active treatment
- How many people
- 444 participants
- Where
- 1 siteUnited States
- Study dates
- 1 Jan 2018to 30 Sep 2021
- Phase
- Interventional
- Are there results?
- None posted in the registry
Key requirements
Who can take part, as listed by the sponsor. Only the study team can confirm whether you are eligible, so take this list to your doctor.
- Ages Any age
- All sexes
- No healthy volunteers
- Child, Adult, Older adult
Who may be able to join
- violators of patients' privacy rights
Who cannot join
- -
Trial locations and contacts
1 site in 1 country.
About this study
Official title: Effectiveness of Email Alerting on Reducing Hospital Employees' Unauthorized Access to Protected Health Information: A Nonrandomized Controlled Trial
To assess the effectiveness of email warnings on reducing repeated unauthorized access to Protected Health Information (PHI), a randomized trial was conducted in a large academic medical center to understand the effectiveness of email warning on reducing repeated unauthorized access to PHI.
Read the detailed description
From January 1, 2018, to July 31, 2018, a large academic medical center's PHI access monitoring system flagged all unauthorized accesses to patient electronic medical records from 444 employees (all professional medical staff), who were not part of the patient's intervention team and did not have access permission. 219 employees (49%) were randomly selected to receive an email warning on the night of their access, while the remaining employees (225, 51%) served as controls. The email informed that the employee has had been identified as having accessed a patient's electronic medical record without a known work-related purpose and that unauthorized access is a privacy violation. A sample email was attached at the end of the protocol.
The system tracked all these individuals' violations within the sample period. Later on, all cases with the violators' ID and patients' ID fully de-identified (see the following excerpt as examples) were shared with researchers at John Hopkins and Michigan State for data analyses. Because researchers do not have the ability to link the data with an identifier, the study was exempted from Michigan State University's IRB review.
Violator ID Patient ID Date Intervention 01B1NSYX3CEXZ86UZXU7R9JQ4VEK R7Z8RTZQL4B9IAC13F6EXQJVWAI7 1/2/2018 No Email
01B1NSYX3CEXZ86UZXU7R9JQ4VEK R7Z8RTZQL4B9IAC13F6EXQJVWAI7 1/3/2018 No Email
- Conditions
- Unauthorized Data Access
- Being tested
- receiving an email
What participants receive
What participants receive. In a randomised study each person is assigned to one group by chance.
receiving an emailOther
The email informed that the employee has had been identified as having accessed a patient's electronic medical record without a known work-related purpose and that unauthorized access is a privacy violation.
| Study group | Role | What they receive |
|---|---|---|
| Email warning | Experimental | some individuals that accessed patients' data without authorization were randomly selected to receive an email warning. A sample email:
Dear Colleague,
The {Organization} proactive electronic record monitoring system has flagged you as having accessed the electronic patient record of {Patient_Name} on {Case_Event_Date}. A clear work-related purpose has not been identified for this access, and there are no approvals in place by the {Organization} Privacy Office to allow access to this record for personal purposes in accordance with A065. {Organization} takes the privacy of patient information very seriously. The {Organization} Privacy Office is now investigating this access as a potential privacy breach.
This potential noncompliance needs to be resolved immediately. To help determine whether a privacy breach has occurred, please respond to this email with answers to the following questions no later than 5 days from the date of this email...omitted due to length Receives: Other: receiving an email |
| No eamil warning | No intervention | individuals that were flagged as accessing patients' data without authorization on the same day as the experimental group were used as the control group |
What is being measured
The primary outcome is the main question the study is designed to answer.
the number of subsequent unauthorizated access violations
The investigators monitored and collected all the subsequent unauthorized access violations for both the experiment and the control group
Measured: 12 weeks starting from the first time a violation was flagged
Timeline
From the start of the study to its completion; the mark is today. Estimated dates are the sponsor’s plan.
- First posted23 Feb 2022
- Study start1 Jan 2018
- Primary completion31 Jul 2018
- Study completion30 Sep 2021
Resources
- Official record on ClinicalTrials.govThe registry entry this page is built from, with its full change history.
- Other trials for Unauthorized Data AccessStudies of the same condition, open and under way.
- What the trial phases meanHow a treatment moves from first tests in people to approval.
More details
For doctors and researchers: how the study is designed, who runs it, and its registry IDs.
Study design
- Study type
- Interventional
- Phase
- Phase N/A
- Primary purpose
- Other
- Allocation
- Randomised
- Intervention model
- Parallel groups
- Model description
- one group received email notice while the group didn't
- Masking
- Quadruple blind
- Who is masked
- Participant, Care provider, Investigator, Outcomes assessor
- Enrolment
- 444 participants (actual)
Sponsor and investigators
- Lead sponsor
- Protenus, Inc.
- Sponsor type
- Industry (pharma, biotech, devices)
- Responsible party
- Sponsor
- Investigators
- Nick Culbertson, BS, Study chair, Protenus, Inc.
IDs, dates and publications
- ClinicalTrials.gov ID
- NCT05251844
- Sponsor's protocol ID
- email_alert_effectiveness
- Status last verified
- Feb 2022
- First submitted
- 1 Feb 2022
- Last updated
- 23 Feb 2022
- Results posted
- No
- Data monitoring committee
- No
- FDA-regulated drug
- No
- FDA-regulated device
- No
- Individual data sharing
- No: The data were collected from a large academic medical center that wanted to remain anonymous
Study at a glance
From the registry record, last updated by the sponsor on 23 Feb 2022. Recruitment status is as the sponsor reported it: confirm with the study team.
- Official title
- Effectiveness of Email Alerting on Reducing Hospital Employees' Unauthorized Access to Protected Health Information: A Nonrandomized Controlled Trial
- ClinicalTrials.gov ID
- NCT05251844
- Acronym / sponsor ID
- email_alert_effectiveness
- Conditions
- Unauthorized Data Access
- Study type
- Interventional
- Recruitment status
- Completed
- Enrolment
- 444 participants (actual)
- Lead sponsor
- Protenus, Inc.Industry (pharma, biotech, devices)
- Study start
- 1 Jan 2018 (actual)
- Primary completion
- 31 Jul 2018 (actual)
- Study completion
- 30 Sep 2021 (actual)
- First posted
- 23 Feb 2022 (actual)
- Results
- Not posted in the source record
Clinical summary
The research question as the sponsor registered it. This describes what the study plans to test, not what it found.
To assess the effectiveness of email warnings on reducing repeated unauthorized access to Protected Health Information (PHI), a randomized trial was conducted in a large academic medical center to understand the effectiveness of email warning on reducing repeated unauthorized access to PHI.
Detailed description
From January 1, 2018, to July 31, 2018, a large academic medical center's PHI access monitoring system flagged all unauthorized accesses to patient electronic medical records from 444 employees (all professional medical staff), who were not part of the patient's intervention team and did not have access permission. 219 employees (49%) were randomly selected to receive an email warning on the night of their access, while the remaining employees (225, 51%) served as controls. The email informed that the employee has had been identified as having accessed a patient's electronic medical record without a known work-related purpose and that unauthorized access is a privacy violation. A sample email was attached at the end of the protocol.
The system tracked all these individuals' violations within the sample period. Later on, all cases with the violators' ID and patients' ID fully de-identified (see the following excerpt as examples) were shared with researchers at John Hopkins and Michigan State for data analyses. Because researchers do not have the ability to link the data with an identifier, the study was exempted from Michigan State University's IRB review.
Violator ID Patient ID Date Intervention 01B1NSYX3CEXZ86UZXU7R9JQ4VEK R7Z8RTZQL4B9IAC13F6EXQJVWAI7 1/2/2018 No Email
01B1NSYX3CEXZ86UZXU7R9JQ4VEK R7Z8RTZQL4B9IAC13F6EXQJVWAI7 1/3/2018 No Email
Study design
- Primary purpose
- Other
- Allocation
- Randomised
- Intervention model
- Parallel groups
- Masking
- Quadruple blind (participant, care provider, investigator, outcomes assessor)
- Number of arms
- 2
- Model description
- one group received email notice while the group didn't
| Arm | Type | Receives |
|---|---|---|
| Email warning | Experimental | Other: receiving an emailsome individuals that accessed patients' data without authorization were randomly selected to receive an email warning. A sample email: Dear Colleague, The {Organization} proactive electronic record monitoring system has flagged you as having accessed the electronic patient record of {Patient_Name} on {Case_Event_Date}. A clear work-related purpose has not been identified for this access, and there are no approvals in place by the {Organization} Privacy Office to allow access to this record for personal purposes in accordance with A065. {Organization} takes the privacy of patient information very seriously. The {Organization} Privacy Office is now investigating this access as a potential privacy breach. This potential noncompliance needs to be resolved immediately. To help determine whether a privacy breach has occurred, please respond to this email with answers to the following questions no later than 5 days from the date of this email...omitted due to length |
| No eamil warning | No intervention | –individuals that were flagged as accessing patients' data without authorization on the same day as the experimental group were used as the control group |
Who may qualify
- Sex
- All
- Healthy volunteers
- Not accepted
- Age groups
- Child, Adult, Older adult
Key inclusion criteria (1 listed)
- violators of patients' privacy rights
Key exclusion criteria (1 listed)
- -
Eligibility is decided by the study team after screening; this overview does not establish that a patient qualifies. Full inclusion and exclusion criteria.
Interventions
| Intervention | Type | Arms |
|---|---|---|
| receiving an emailThe email informed that the employee has had been identified as having accessed a patient's electronic medical record without a known work-related purpose and that unauthorized access is a privacy violation. | Other | Email warning |
Primary outcome
the number of subsequent unauthorizated access violations
Time frame: 12 weeks starting from the first time a violation was flagged
The investigators monitored and collected all the subsequent unauthorized access violations for both the experiment and the control group
Results and safety
The study is completed, but results are not available in the source record. That does not mean the treatment did or did not work.
Research links
- Official record on ClinicalTrials.govLast updated by the sponsor 23 Feb 2022.
- Individual participant dataSharing planned: No. The data were collected from a large academic medical center that wanted to remain anonymous
Referral and contact
AzTrials does not enrol participants or take referrals. Contact the study team or a site listed below; they decide who can take part. This study is not recruiting at the moment.
Nick Culbertson, BS study chair
Protenus, Inc.
1 site in 1 country: see every site and its status.
Questions about this trial
What is this clinical trial studying?
A study testing receiving an email in people with Unauthorized Data Access, run by Protenus, Inc. at 1 site in United States.
The full registered description is in the About this study section and the official record.
Who may be eligible to take part?
The sponsor lists 1 inclusion and 1 exclusion criteria. Eligibility is decided by the study team after screening, so read the full criteria and contact a listed site.
Is this clinical trial currently recruiting?
The record says: finished, as of the sponsor's last update on 23 Feb 2022. Status can change between updates, so confirm with the study contact before making plans.
Where is the study taking place?
The record lists 1 site in United States. Whether a site is taking part right now should be confirmed with that site. See every site.
What are the possible benefits and risks?
They depend on the study and the treatment, and no study can promise a benefit. The study team explains the known risks during informed consent, before anyone joins; the record itself does not list them.
Are results available for this study?
The study is completed, but results are not available in the source record. That does not mean the treatment did or did not work.
How can a doctor refer a patient or contact the research team?
The record lists no contact. The official record names the sponsor, who can be asked directly. AzTrials does not enrol participants or take referrals.
What does the primary outcome measure?
the number of subsequent unauthorizated access violations (time frame: 12 weeks starting from the first time a violation was flagged). It is what the study was designed to measure, not a finding.
Where can I read the original study information?
Does a listing mean the treatment is approved or proven to work?
No. A listing means the study is registered. It does not show that the treatment is safe, works, or is approved by a regulator.
How often is this information updated?
AzTrials copies changed records from ClinicalTrials.gov every night and reloads the whole registry every week. The sponsor last updated this record on 23 Feb 2022.