Legal Issues in Health Information and Electronic Health Records

Introduction

Healthcare providers have long observed an ethical imperative to respect privacy of patient information. For physicians, this ethical duty originates in the Hippocratic oath, which states:

In the past, individuals often had a longstanding relationship with a very small number of care providers and health records were maintained in paper files and seldom shared with other health practitioners, or even the patient. Contemporary healthcare is much more complex. Highly mobile individuals seek healthcare in different geographical locations and, with the growth in collaborative, multidisciplinary care, patients are treated not only by family physicians, but by medical specialists and complementary and alternative care providers. Care is delivered in a wide range of settings: practitioners’ offices, walk-in clinics, acute care hospitals, long-term care facilities, and home care situations. To provide appropriate services, patient information must be shared among a wider range of care providers working in different locations. Additionally, many patients take a more active approach to their healthcare and seek access to their records.

Health information technology—including electronic health records (EHR)—can facilitate sharing of information in all these ways to the benefit of both patients and professionals. As a longitudinal record of an individual’s healthcare history, EHRs may include summaries of physician visits and care provided in hospital or other facilities, medical test results, x-ray images, prescription drug histories, immunization history, and known allergies. One commentator asserts that EHRs “will transform the purpose of the medical record from a record of information generated by health professionals primarily for their own reference into a shared resource produced and used by all concerned with the process of care” (Cross, 2006b, p. 656). However, the ease with which information can be handled electronically compels special attention to matters of privacy, confidentiality and security. Advances in modern healthcare heighten this responsibility. Novel diagnostic and testing procedures reveal highly sensitive information about patients (e.g., genetic predisposition to a serious disease) and a growing range of pharmaceuticals and procedures are used to treat conditions about which the patient may feel ashamed or embarrassed (e.g., sexual/reproductive health, mental health). Patients are likely to have special concern about safeguarding information that would reveal a stigmatizing medical condition.

EHRs attract particular concern about unauthorized access and disclosure of personal information contained in the records. Although electronic records have the potential to be more secure than paper records with implementation of sophisticated technical safeguards, they also have potential to reveal vast detail about an individual’s health history. Unauthorized access may occur intentionally or accidentally by persons internal or external to an organization. A major New York City hospital reportedly “thwarted 1,500 unauthorized attempts by its own employees to look at patient records of a famous local athlete” (Freudenheim & Pear, 2006, p. 1). Hackers may also infiltrate EHR systems for nefarious purposes, such as identity theft. Canada’s federal privacy commissioner articulates these concerns: