I read with interest Dr. Halamka’s blog from Monday, September 27, 2010 dealing with the unconscious in the emergency department. He raises some excellent points with regard to “engineering” an approach to accessing electronic records when the patient is unable to provide access.
Having recently read the final definitions for Meaningful Use, I have been pondering the data accessibility issue, but perhaps from a slightly different perspective. In a government-mandated setting, how does one protect the privacy of data? In government-managed healthcare, does the government have the right to access Patient Health Records (PHR’s)?
In reviewing the Stage 1 Objectives, I noted that some of the data elements are potentially controversial: for example, BMI, and smoking preferences. While I appreciate the medical benefit for such information, I am equally concerned about the prospect of this information, as well as other personal characteristics, falling into the hands of those who may not have strictly medical intentions in mind. Sure, one can argue that from a preventative medicine perspective, I should receive a warning when I order that Big Mac with bacon and cheese. But will this information be used for other purposes as well?
I have recently read about broad new regulations being drafted by the Obama administration that would make it easier for law enforcement and national security officials to eavesdrop on Internet and e-mail communications like social networking Web sites and BlackBerries. Does this mean that they would also have access to PHR’s?
If I start with the premise that the patient owns his/her medical records, then I like the notion of Dr. Halamka’s suggestion of an “electronic medical home,” where data from various healthcare entities could be pushed to a central repository for patient-managed retention. The question is – how to protect the integrity and accessibility to such information? I have recently been playing with Google Health, and investigating the security policies to determine who has access and how the data is stored. Ideally, I would like to think that the data is encrypted in such a way that if someone cracks the site they will be unable to successfully access my stored information.
One option would be the use of encryption keys to allow access to the data. The patient would be the owner of the key. Anyone desiring access, such as a health-related entity could request access from the patient, preferably from the PHR or via email. The patient owner could then provide the entity with access rights via email or some other secure means. Rights could be time or content sensitive depending on the entity’s access needs. As Dr. Halamka addresses for the unconscious ER patient, the use of biometric devices could be another option.
The world of paper presented its own challenges. I am especially reminded of my local pharmacy when the first regulations came out for patient privacy. When I went in for a prescription refill, the pharmacist handed me a clipboard with a signoff page acknowledging I understood my rights to privacy. The funny thing is the signoff sheet was not a single piece of paper, but rather a list of everyone who had signed! I attempted to point out the irony of acknowledging my right to privacy on a list where everyone else signing it could see who had signed, but I don’t think they understood. They were just following orders.
The good news for paper records is that there typically is only an original, and if a request is made, it is copied for that request. Access is limited only to those who have access to the original or a copy (legally or illegally). In the case of electronic records, anyone who gains access has the ability to copy the records, presenting a much more difficult (albeit more efficient) means of handling accessibility and authorization.
Secure access mechanisms such as security keys, coupled with encryption will be essential to the viability of electronic medical records.
