Legal protections of electronic health records: issues of consent and security.

• Author: Ries, Nola M.
• Position: Canada

Introduction

Electronic health records (EHRs)--comprehensive compilations of a person's health care history, accessible by health care providers and others through electronic networks (2)--are a growing issue in Canada. In 2002, the Kirby Report (3) and the Romanow Report (4) made EHRs hot topics for media and policymakers by recommending their national implementation. While both reports recognized the potential of EHRs to improve health care delivery and enhance health system reform, they were also sensitive to growing concerns over the privacy of personal health information. (5) In this paper, we discuss how health information protection laws in Canada seek to provide specific safeguards for personal health data collected, used and disclosed by electronic means. We begin with an overview of EHR initiatives in Canada and other jurisdictions. Next, we discuss some of the purported benefits and risks associated with EHRs. We then identify and comment on specific legal protections that have been enacted to address concerns regarding privacy and security of health information on electronic networks. In particular, we focus on statutory provisions that permit individuals to limit the inclusion and disclosure of their information via EHRs and that oblige those responsible for EHRs to implement specific technical measures to safeguard against unauthorized access and disclosure. We conclude by commenting on the competing interests legislators must balance in enacting legal protections for EHRs.

Overview of EHRs Initiatives in Canada and Abroad

Even before the Romanow and Kirby recommendations, EHR initiatives were well underway across Canada. Manitoba and Saskatchewan started basic planning in 1995, and by 1999, federal coordination efforts had commenced. In its final report, the Advisory Council on Health Infostructure recommended the creation of Canada Health Infoway, a not-for-profit corporation designed to create and synchronize EHR initiatives nationally. (6) In 2000-2001, the federal government committed $500 million to Infoway to fulfill this mandate. (7) To date, Infoway has invested $158 million in 17 initiatives across Canada. (8)

Alberta's Wellnet program is currently the most comprehensive of these initiatives, aiming to combine medical and prescription histories, allergies and lab test results by 2005. A $50,000 fine exists for improper use. (9) The Saskatchewan Health Information Network is also reaching an advanced stage, projecting basic EHRs to be available in all regions by 2006. (10) Manitoba had linked five hospitals to its pilot Health Information Network by 1998, but program implementation has since stalled. British Columbia's healthnetBC is a newer project integrating five current EHR initiatives and numerous regional databases. (11) These western provinces, along with Network 99 in the Northwest Territories, Nunavut and Yukon, are coordinated regionally by the Western Health Information Collective.

Ontario established its Smart Systems for Health Agency in 2002, aiming to connect 24,000 sites across the province. (12) In 2004, Quebec became a partner in the Infoway corporation in order to develop an EHR system. (13) The Maritime provinces are all in similar stages of EHR development under the coordination of Health Infostructure Atlantic. (14)

Extensive EHR pilot projects are also being undertaken internationally. In 2003, the United Kingdom's National Health Service completed its three-year Electronic Record Development and Implementation Programme, in which health communities across England carried out detailed trials of EHR use. The trial results are currently being used to shape the construction of the nation-wide Integrated Care Records Services, a public initiative that aims to have a comprehensive EHR system online by 2008. (15)

Trials are underway in Australia for the proposed Health Connect system, a national infrastructure intended to coordinate the development of standardized EHRs. Starting in 2001, national, state and territory governments commenced a research and trial phase for the project, with implementation expected to begin in 2005. (16)

European Union countries such as Italy, France and Germany are also currently researching EHR initiatives. (17) Although numerous EHR initiatives exist in the United States, no comprehensive national coordination program exists, nor is one currently in development. However, in April 2004, the Bush administration announced a goal to have a purely voluntary national EHR program implemented within ten years. (18)

Benefits and Risks of EHRs

The pivotal role ascribed to EHRs by Romanow and Kirby may be warranted. Academic and technical literature suggests that EHR implementation could greatly improve health care delivery to individual patients. (19)

Surveys have shown that medical professionals have long-recognized the need to share accurate patient health information quickly and easily across different health systems. (20) Lawrence Gostin argues "the ability of the health care system to function effectively depends in part on the accuracy, currency, completeness, and availability of health data." (21) High injury levels occur internationally as a result of medical information errors. (22) Accessible medical records significantly decrease the risk of these events, allowing clear medical information to be shared among health care providers and facilities. (23)

By improving and standardizing the communication between patients and health providers, patients can make more informed choices among health options, thus enhancing patient autonomy. EHRs also have the potential to advance health care research, improve public health functions such as disease monitoring and cut costs in health systems by scrutinizing areas that need improvement. (24) Some commentators identify a related economic imperative: "the primary driving force behind health care networks is that they will help institutions survive as economic (even if they are nonprofit) entities." (25)

This increased flow of information, however, raises significant concerns about the privacy and confidentiality of health information. Patient records would no longer be singular paper documents kept in a locked filing cabinet. They would instead be stored on multiple computers and servers, prone to weaknesses in electronic security and human judgment.

Implementation poses one of the most obvious obstacles. Some government agencies and health informatics experts are cautious about implementing a system using current privacy and encryption protocols, citing the "heavy reliance [the Public Key Infrastructure] places on governance and policy management and on users maintaining the confidentiality of their key." (26) Elaine Gibson points out that planning, selection and training are often not carefully executed prior to implementation, resulting in health care providers with weak skills in using EHR systems. (27) Arguments have also been made that rapid health care leadership turnover leads to repeated tactical errors in EHR implementation. (28)

These weaknesses in EHR implementation and security have serious implications for health...