Digital Literacy & Healthcare Information Systems — Surgical Technology

Objective. Students navigate a simulated electronic health record environment, demonstrate correct patient privacy practices consistent with federal health information privacy requirements, and use professional digital communication tools appropriately in a healthcare workplace context.

Digital Literacy in the Surgical Technology Workplace

Modern operating rooms depend on accurate, real-time digital information. As a surgical technologist, you will interact with electronic health records (EHRs), digital imaging systems, barcode medication verification, and professional communication platforms every working day. Using these tools correctly is not only a matter of efficiency — it is a direct patient safety obligation.

The Electronic Health Record (EHR) and Your Role

An EHR is a digital collection of a patient's health information maintained across a healthcare organization. Before any surgical procedure, you will need to locate and verify specific data for each patient. The four items most critical to your preoperative preparation are:

Surgical history — prior procedures that may affect positioning, anesthesia, or instrument selection
Allergy list — documented allergies and sensitivities, including latex, medications, and contrast agents
Current medications — especially anticoagulants, antiplatelet drugs, and herbal supplements that affect bleeding
Consent status — confirmation that a valid, signed informed consent form is on file for the planned procedure

Accessing the wrong patient's record — even briefly — is a serious error. Always confirm the patient's full name and at least one additional identifier (such as date of birth or medical record number) before opening or acting on any EHR entry. This two-identifier rule is a standard patient safety practice in accredited healthcare facilities.

Educational EHR simulators and sandbox environments allow you to practice navigation without risk to real patients. Treat training environments with the same discipline you would apply to a live system — developing good habits now prevents dangerous shortcuts later.

Federal Health Information Privacy Requirements

The primary federal framework governing the privacy and security of patient health information in the United States is the Health Insurance Portability and Accountability Act, commonly known as HIPAA. Under HIPAA, individually identifiable health information that is created, received, maintained, or transmitted by a covered entity is called protected health information (PHI).

PHI includes — but is not limited to — a patient's name, date of birth, address, phone number, medical record number, diagnosis, photographs, and any other detail that could reasonably identify the person and link them to a health condition or treatment.

Key HIPAA obligations for surgical technology students and graduates:

Access only the records of patients you are directly involved in caring for (the minimum necessary standard).
Never share PHI via personal text messages, personal email accounts, or social media platforms.
Do not take photographs of patients, operative fields, or any screen displaying PHI without explicit institutional authorization.
Log out of EHR workstations whenever you step away, even briefly.
Report suspected privacy breaches to your supervisor or privacy officer immediately.

Violations can result in disciplinary action, termination of employment, and federal civil or criminal penalties assessed against both the individual and the facility.

Recognizing and Responding to Privacy Violations

Violations often occur through carelessness rather than intent. Common scenarios you must recognize:

Improper text message: A coworker sends a text to the group chat that reads, "Just had the weirdest case — Mr. [last name], Room 4, came in for a colostomy reversal." This message names a patient and discloses a diagnosis over an unsecured personal messaging application. It violates HIPAA regardless of the sender's intent.

Social media post: A colleague posts a photo to a personal social media account that shows the OR board — the whiteboard listing patient names and room assignments — visible in the background. Even if the post was about something else, the identifiable information in the image constitutes a PHI disclosure.

When you encounter a suspected violation, do not ignore it, confront the coworker publicly, or share the post further. Notify your charge nurse or supervisor and follow your facility's incident reporting procedure.

Professional Digital Communication in Clinical Settings

Communication in a healthcare workplace must reflect professionalism at all times. The tone, format, and content of a message to a charge nurse or surgeon differ significantly from a text to a friend.

Elements of a professional workplace email:

A clear, specific subject line (e.g., "OR Schedule Request — Week of [date]")
A formal greeting using the recipient's title and name
Concise, complete content with correct spelling and grammar
A professional closing and your full name and role
No patient-identifying information unless the communication is through a secured, facility-approved system

Avoid in professional digital communication: slang, emoji, all-caps, vague subject lines, and any statement you would not say aloud in a professional setting.

The Association of Surgical Technologists (AST) Code of Ethics reinforces the obligation to maintain confidentiality and to conduct yourself with integrity in all professional interactions, including digital ones.

Safety Summary

Digital errors in the OR have the same potential to harm patients as physical errors. Pulling the wrong patient record can lead to wrong-site surgery, missed allergies, or delayed consent discovery — all serious sentinel events. Treat every login, every record access, and every digital message as a patient safety action.

Verify two patient identifiers before accessing any record.
Use only facility-approved, secured systems for any communication involving PHI.
When in doubt about whether something is a violation, assume it is and report it.

Key terms9

Electronic Health Record (EHR)A digital system that stores and organizes a patient's health information, including history, medications, allergies, orders, and consent documents, accessible to authorized clinical staff across a healthcare organization.

Protected Health Information (PHI)Under HIPAA, any individually identifiable health information — such as a patient's name, diagnosis, date of birth, or medical record number — that is created, received, maintained, or transmitted by a covered healthcare entity.

HIPAAThe Health Insurance Portability and Accountability Act; the primary federal law in the United States establishing standards for protecting the privacy and security of patient health information.

Minimum Necessary StandardA HIPAA principle requiring that healthcare workers access or disclose only the amount of patient information actually needed to perform their specific job function.

Two-Identifier RuleA patient safety practice requiring confirmation of at least two unique patient identifiers — such as full name and date of birth or medical record number — before accessing records or providing care, to prevent mix-ups.

Informed ConsentA documented process in which a patient (or legal surrogate) voluntarily agrees to a planned surgical procedure after receiving a clear explanation of the procedure, its risks, benefits, and alternatives; the signed consent form must be verified before surgery begins.

Sandbox / Training EnvironmentA simulated, isolated version of a software system — such as an EHR — that uses fictional patient data and allows users to practice navigation and workflows without affecting real patient records.

Privacy BreachAn impermissible use or disclosure of PHI that compromises the security or privacy of the information; facilities are required to investigate breaches and, depending on severity, notify affected patients and relevant federal agencies.

AST Code of EthicsThe professional ethical guidelines published by the Association of Surgical Technologists that outline obligations of surgical technologists, including maintaining patient confidentiality and conducting themselves with integrity in all professional settings.

In class: Complete a guided walkthrough of a training EHR environment (such as a sandbox module from a widely used hospital system or an educational EHR simulator), locating the surgical history, allergy list, current medications, and consent status for three practice patients, and recording findings on a structured preoperative checklist. · Work through two scenario-based exercises in which a coworker sends an improper text message containing patient information and a social media post appears to violate patient privacy; students identify the violations, cite the applicable federal health information privacy framework, and draft a corrective response. · Create a professional email to a hypothetical OR charge nurse requesting schedule information, then revise a sample unprofessional message to meet workplace communication standards; discuss with the group the differences between personal and professional digital communication in a clinical environment.
Materials: Computer workstations or tablets with internet access; educational EHR training software or sandbox access; sample EHR navigation handout; federal health information privacy summary handout; professional email rubric; AST Code of Ethics.
Check: Students correctly complete the three-patient EHR checklist with no patient-identification errors (100% accuracy on patient matching is required) and score 80% or higher on a 20-item scenario quiz covering privacy compliance and professional digital communication.

Practice check8

Answer each question, then check it. Nothing is recorded; this is your own practice.