Legal Issues in Health Information and Electronic Health Records

Legal Issues in Health Information and Electronic Health Records

Nola M. Ries (University of Alberta, Canada and University of Victoria, Canada)
DOI: 10.4018/978-1-60960-561-2.ch708

Abstract

This chapter discusses key legal issues raised by the contemporary trend to managing and sharing patient information via electronic health records (EHR). Concepts of privacy, confidentiality, consent, and security are defined and considered in the context of EHR initiatives in Canada, the United Kingdom, and Australia. This chapter explores whether patients have the right to withhold consent to the collection and sharing of their personal information via EHRs. It discusses opt-in and opt-out models for participation in EHRs and concludes that presumed consent for EHR participation will ensure more rapid and complete implementation, but at the cost of some personal choice for patients. The reduction in patient control over personal information ought to be augmented with strong security protections to minimize risks of unauthorized access to EHRs and fulfill legal and ethical obligations to safeguard patient information.
Chapter Preview
Top

Introduction

Healthcare providers have long observed an ethical imperative to respect privacy of patient information. For physicians, this ethical duty originates in the Hippocratic oath, which states:

Whatsoever things I see or hear concerning the life of man, in any attendance on the sick or even apart therefrom, which ought not to be noised abroad, I will keep secret thereon, counting such things to be as sacred secrets (quoted inRozovsky & Inions, 2002, p. 86).

In the past, individuals often had a longstanding relationship with a very small number of care providers and health records were maintained in paper files and seldom shared with other health practitioners, or even the patient. Contemporary healthcare is much more complex. Highly mobile individuals seek healthcare in different geographical locations and, with the growth in collaborative, multidisciplinary care, patients are treated not only by family physicians, but by medical specialists and complementary and alternative care providers. Care is delivered in a wide range of settings: practitioners’ offices, walk-in clinics, acute care hospitals, long-term care facilities, and home care situations. To provide appropriate services, patient information must be shared among a wider range of care providers working in different locations. Additionally, many patients take a more active approach to their healthcare and seek access to their records.

Health information technology—including electronic health records (EHR)—can facilitate sharing of information in all these ways to the benefit of both patients and professionals. As a longitudinal record of an individual’s healthcare history, EHRs may include summaries of physician visits and care provided in hospital or other facilities, medical test results, x-ray images, prescription drug histories, immunization history, and known allergies. One commentator asserts that EHRs “will transform the purpose of the medical record from a record of information generated by health professionals primarily for their own reference into a shared resource produced and used by all concerned with the process of care” (Cross, 2006b, p. 656). However, the ease with which information can be handled electronically compels special attention to matters of privacy, confidentiality and security. Advances in modern healthcare heighten this responsibility. Novel diagnostic and testing procedures reveal highly sensitive information about patients (e.g., genetic predisposition to a serious disease) and a growing range of pharmaceuticals and procedures are used to treat conditions about which the patient may feel ashamed or embarrassed (e.g., sexual/reproductive health, mental health). Patients are likely to have special concern about safeguarding information that would reveal a stigmatizing medical condition.

EHRs attract particular concern about unauthorized access and disclosure of personal information contained in the records. Although electronic records have the potential to be more secure than paper records with implementation of sophisticated technical safeguards, they also have potential to reveal vast detail about an individual’s health history. Unauthorized access may occur intentionally or accidentally by persons internal or external to an organization. A major New York City hospital reportedly “thwarted 1,500 unauthorized attempts by its own employees to look at patient records of a famous local athlete” (Freudenheim & Pear, 2006, p. 1). Hackers may also infiltrate EHR systems for nefarious purposes, such as identity theft. Canada’s federal privacy commissioner articulates these concerns:

Complete Chapter List

Search this Book:
Reset