The only one I found was that a locked door of emergency supplies had the combination written on the door. Nobody would deny doctors and nurses access to emerg

The only one I found was that a locked door of emergency supplies had the combination written on the door. Nobody would deny doctors and nurses access to emergency supplies. The article is missing a few things about the environment and its pressures. For example, you have physical access restrictions on many aspects of a hospital. Pharmacy, controlled drug dispensaries, materiel storage, biowaste, nurse's stations, isolation, certain patient rooms, OR, etc. These all have their own rules and many of them have access badges to enter, or combination locks, or software processes to gain access. There is HIPAA (or other patient data control restrictions in other jurisdictions). HIPAA has internal and external controls. Some of it is actually required by law, some by regulation, some as part of accreditation, some is recommended by consultants, and a lot is dreamed up by people apparently out of nowhere. HIPAA internal controls require shielding of patient data from spying eyes. HIPAA external controls require restricting egress of data except as authorized by the patient or permitted by law and regulation. With paper records, you use file folders and clipboards that can cover the data and you try to not leave it unattended. It can be shared internally in the hospital with the people who need it and you can generally trust the providers to do the right thing. With electronic data it can be easier to lock it down but harder to provide access. Hospital IT is incentivized to not have a big data exfiltration embarrassment so they will probably set policy on a strict level and require complaints before they make it easier to access. In most hospitals, the workforce is quite fluid. There are many temporary employees at all levels, and providers join and leave various provider groups that are connect to, but not part of, the hospital. There are many contractors walking around. Some people low on the payscale have access to almost the whole hospital (such as the constantly working painters required by accreditation). Some people high up are not always given access permission to areas they are not typically working but may need to access one day. The same is true electronically, the doctor may not be able to access some information that the IT temp can access. In addition, the integration of systems is a constant headache. Every little system is built with its own patient management system and usually has its own usernames and passwords. Many hospitals are eventually able to harmonize these systems but not all of them can be done cost-effectively. Finally, as the article mentions, there is the fact that a clipboard can be moved with the patient but an EMR may not have a terminal convenient to where data needs to be entered. All of these things (and more, I'm sure) provide a lot of friction to using the standard means of access control, and workarounds abound.