| Course | HLTH 4403 Healthcare Information Management |
|---|---|
| Module | Module 5 |
| Paper type | Technology adoption proposal with privacy safeguards |
| Length | 1,180 words, about 4 pages plus title and reference pages |
| Format | APA 7 student paper |
| School | American College of Education |
| Program | B.S. in Healthcare Administration |
| Updated | September 2026 |
Free sample paper for HLTH 4403 Module 5
One Shared Password on a Sticky Note: A Technology Adoption Proposal for Continuous Glucose Monitoring at a Community Health Center Network, With the Privacy Safeguards It Needs
Student Name
American College of Education
HLTH4403: Healthcare Information Management
Module 5 Assignment
Instructor Name
November 2, 2026
Purpose of the Proposal
The previous module weighed glucose sensors for the type 2 diabetes patients of our composite network of community health centers and recommended starting with a professional model, in which the clinic places the sensor and reviews the data with the patient. This proposal asks leadership and the compliance committee to approve that program for 150 patients over six months, to fund an interface that brings glucose summaries into the electronic health record, and to adopt the privacy and security safeguards set out below.
The safeguards are not a formality. While preparing this proposal, I found that three of the network's centers already view glucose data from patients' personal sensors through the manufacturer's clinic website, using one shared login whose password was written on a note at a nursing station. That practice would be the starting point for the new program unless it is corrected first.
Why Technologies Fail to Take Hold
Many promising health technologies are never adopted, are abandoned after a pilot or fail to spread. Greenhalgh et al. (2017) developed the NASSS framework to explain why, drawing on a review of earlier frameworks and several years of case studies. Its questions fall into seven domains: the illness itself; the device or software; what value it offers and to whom; the people who must use it, meaning staff, patients and caregivers; the organizations involved; the broader institutional and social setting; and how all of these adjust to one another over time. They classified challenges in each domain as simple, complicated or complex, and found that programs complicated in several domains were difficult but possible to implement, whereas those that were complex in multiple domains rarely, if ever, became part of routine practice.
The framework is useful here because it forces a proposal to look beyond the device. The goal of this plan is to keep each domain as simple as possible.
The Proposal Through Seven Domains
The condition, type 2 diabetes with an A1c above 9%, is common and well understood, though often complicated by poverty and competing health problems. The technology is mature; professional sensors are worn for up to two weeks and read at the clinic, requiring no patient smartphone. The value proposition rests on modest but consistent evidence: a meta-analysis found continuous monitoring lowered A1c by about 0.3 percentage points in type 2 diabetes, with a similar effect in people using oral medications only (Jancev et al., 2024), and the network gains data it can use in its registry. The adopter system is the most complicated domain. Medical assistants must place sensors, diabetes educators must review reports with patients, and clinicians must act on them, all within full schedules. The organization must build an interface and assign educator time. The wider context includes limited coverage for patients not using insulin and a vendor market that changes quickly.
No domain is complex in the framework's sense, but the adopter system and the organization are complicated. The plan therefore funds educator time explicitly and limits the pilot to three centers.
Budget
The six-month pilot costs about $66,400. Sensors for 150 patients, two wear periods each, cost about $20,400 at the vendor's quoted price of $68 a sensor. A half-time diabetes educator for six months costs about $22,000. The interface that brings each patient's time in range, time below range and average glucose into structured fields in the record is quoted at $18,000, a one-time cost that serves any later expansion. Staff training and the security risk analysis described below cost about $6,000. The billing office will determine which of the network's payers reimburse professional monitoring before the first placement, and any revenue will offset the sensor line.
Privacy and Security Safeguards
Glucose data collected by the clinic are electronic protected health information, and the HIPAA Security Rule sets out three families of protection for such data, administrative, physical and technical, with a risk analysis of threats to their confidentiality, integrity and availability as the required first step (Security Standards for the Protection of Electronic Protected Health Information, 2024). The program will follow that structure.
Administrative safeguards: before go-live, the privacy officer will complete a risk analysis covering the vendor's clinic website, the interface and the readers; the network will sign a business associate agreement with the vendor for data held in the clinic account; access will be limited to named educators and clinicians by role; and the shared login will be retired immediately, with each user given an individual account. Physical safeguards: sensor readers will be stored in locked cabinets, logged in and out, and cleared of data before reuse. Technical safeguards: individual accounts with multifactor authentication for the vendor website, encrypted transmission for the interface, and audit logs reviewed monthly for access by anyone not on the patient's care team.
Patients will also be told, in English and Spanish, what data are collected, who can see them, how long they are kept, and that data are reviewed at visits rather than monitored between them. A safeguard patients do not understand protects the network, not the patient.
Personal Sensors and Consumer Apps
Patients who buy their own sensors raise a different issue. Data a patient keeps in a manufacturer's consumer app are held under the company's own terms, not the network's. When such a patient links the app to the clinic account, the data the clinic receives come under its safeguards, but the app itself does not. Clinicians will receive a one-page guide explaining this difference so they can answer patients' questions accurately, and any device named in the network's patient handouts will first have its privacy terms read by the privacy officer. The network will not recommend a specific consumer app until that review is done. The guide will also tell clinicians what to do when a patient shows glucose readings on a phone during a visit: review them as the patient presents them, record the summary figures in the structured fields, and avoid photographing the screen with a personal phone, a habit two clinicians admitted to during preparation of this proposal. Small practices like that are where well-designed safeguards most often leak.
Measures and Decision Points
The pilot will be judged at six months on five measures: change in A1c for pilot patients compared with similar patients at the other centers; the share of pilot patients completing both wear periods and educator visits; the percentage of reports reaching structured fields in the record within a week; educator and clinician time per patient; and any security incident, including access by users outside the care team found in the audit log. If A1c improves, completion exceeds 70%, data capture is reliable and no significant incident occurs, the network should extend the program to all 12 centers in its next budget. If data capture fails, the program should pause until the interface works, because a program whose data cannot be used would repeat the problem this course began with.
References
Greenhalgh, T., Wherton, J., Papoutsi, C., Lynch, J., Hughes, G., A'Court, C., Hinder, S., Fahy, N., Procter, R., & Shaw, S. (2017). Beyond adoption: A new framework for theorizing and evaluating nonadoption, abandonment, and challenges to the scale-up, spread, and sustainability of health and care technologies. Journal of Medical Internet Research, 19(11), Article e367. https://doi.org/10.2196/jmir.8775
Jancev, M., Vissers, T. A. C. M., Visseren, F. L. J., van Bon, A. C., Serné, E. H., DeVries, J. H., de Valk, H. W., & van Sloten, T. T. (2024). Continuous glucose monitoring in adults with type 2 diabetes: A systematic review and meta-analysis. Diabetologia, 67(5), 798-810. https://doi.org/10.1007/s00125-024-06107-6
Security Standards for the Protection of Electronic Protected Health Information, 45 C.F.R. §§ 164.302-164.318 (2024).
What the HLTH 4403 Module 5 instructions ask for
HLTH 4403 Module 5 generally asks you to bring the course together in a proposal to adopt a health information technology. Prompts typically ask you to describe the technology and why the organization needs it, plan its implementation, estimate costs and set out how patient privacy and data security will be protected, then define how success will be measured. Many versions name HIPAA explicitly and expect safeguards organized by the Security Rule's categories, and some ask you to address consumer apps or third-party vendors. Expect to cite regulation directly, not summaries, and to support the value of the technology with research. Build on your earlier modules where you can, and confirm in Canvas who the audience is, since a board and a compliance committee need different emphasis.
How the HLTH 4403 Module 5 example is put together
The proposal begins by stating the request and reporting a real security weakness in current practice. It then introduces an implementation framework and applies each of its seven domains to the program, identifying the adopter system and the organization as the hardest parts and designing around them. The budget is itemized with one-time and recurring costs separated. The safeguards section follows the Security Rule's structure, naming specific administrative, physical and technical measures for this program, and adds plain-language notice for patients. A separate section explains how consumer apps differ from clinic-held data. Five measures and explicit decision rules close the paper and connect the pilot to the next budget.
Where the points sit in the HLTH 4403 Module 5 rubric
Adoption proposal rubrics tend to reward a clear need, a feasible implementation plan, specific privacy and security measures and a measurable evaluation. The privacy criterion is usually weighted heavily in this course, and graders give most credit to safeguards tied to the Security Rule's categories and to the specific technology, rather than a general promise of HIPAA compliance. An implementation criterion rewards anticipating barriers, often through a framework. Budget or resource criteria look for itemized costs. The evaluation criterion rewards measures with thresholds and decisions attached. Integration of earlier modules, sources and APA 7 formatting account for the remaining points in most sections.
Common HLTH 4403 Module 5 mistakes, and how to avoid them
Proposals often lose points on privacy by stating that the system will be HIPAA compliant and saying nothing more. Name the safeguards, who carries them out and when. Another frequent gap is ignoring the vendor: a business associate agreement and the vendor's own access controls matter as much as internal policies. Students also propose a full rollout without a pilot or decision rules. Look for what could stop adoption, such as staff time, and fund it. Do not claim that HIPAA covers every consumer app. If your proposal concerns telehealth, a new portal feature or remote blood pressure monitoring instead, share what you wrote in the earlier modules along with the grading guide, and we will shape a Module 5 proposal from that work.
Write yours, or have the desk draft it
This paper is an original model document written by our desk, not a submitted student paper and not an official American College of Education document. Read it for the moves, then write your own to the instructions in your classroom. If you want one built to your exact prompt and rubric, the first custom sample is free and arrives in 24 to 48 hours.
More HLTH 4403 and B.S. in Healthcare Administration sample papers
- HLTH 4403 Module 1: EHR Data Analysis
- HLTH 4403 Module 2: Patient Portal Evaluation
- HLTH 4403 Module 3: Online Risk Assessment Analysis
- HLTH 4403 Module 4: Wearable Device Assessment
- HLTH 4363 Module 3: Positioning and Message Strategy
- HLTH 4203 Module 2: Policy Impact Analysis
- HLTH 4303 Module 1: HIPAA Privacy Incident Analysis
- HLTH 4303 Module 3: Elopement Risk Management Plan
HLTH 4403 Module 5 questions, answered
What does HLTH4403 Module 5 usually ask for?
HLTH4403 frequently closes with a technology adoption proposal: the technology and its value, an implementation plan, costs, privacy and security safeguards, and measures for judging success. Your classroom's instructions decide the technology and audience.
What does the HIPAA Security Rule require?
Administrative, physical and technical safeguards for electronic protected health information, starting with a risk analysis of threats to its confidentiality, integrity and availability.
What is the NASSS framework?
A framework for predicting whether health technologies will be adopted and sustained. It examines seven domains, from the condition and technology to the organization and wider context, and classifies each as simple, complicated or complex.
Where can I find a free HLTH 4403 Module 5 sample paper?
You are reading the page that has it: the complete Module 5 proposal for continuous glucose monitoring at a health center network, with the NASSS analysis, a $66,400 budget, Security Rule safeguards and decision rules.
Does HIPAA cover health data in consumer apps?
Not always. Data a patient keeps in an app under the company's own terms are generally outside the provider's control, while data the provider receives and holds fall under its safeguards.