The health system is undergoing a digital transformation as more health services and practitioners adopt electronic health records. I recently attended a seminar on digital health information held by the International Association of Privacy Professionals, iapp- ANZ, and sponsored by Microsoft, that explored the many benefits, as well as the potential impediments for e-health records.
The panel of experts all acknowledge the benefits of e-health systems, especially for big data analysis supporting better disease recognition, familial tracing and diagnosis and the linking of screening program and treatment data. We are only at the beginning of health system improvements based on digital health records. Researchers are gaining new insights as existing data is enriched, digital images are captured and made accessible for improved or remote diagnosis. Data analytics and new tools can identify disease and treatment patterns in large datasets.
Individuals receive better health care from fully informed practitioners. Practitioners need to know that frail or elderly patients are being prescribed a wide variety of medicines that may interact to cause adverse reactions. Hospitals need timely access to diagnostic test results and avoid the costs incurred when tests have to be duplicated because data cannot be accessed. Complete medical history can be accessed when a patient moves hospitals or to a new provider or is frail or incapacitated. Digital access, flexibility and sharing of data leads to better health outcomes and reduced health system costs. Australian governments are currently making significant investments developing e-health platforms to achieve these benefits.
Trust and privacy protection
How will government win trust so that patients accept e-health records? Can patients ensure that their privacy is protected? Can patients control what information is shared, who can access it, and they can withdraw their consent?
Individuals will only agree to upload and maintain their e-health records when they trust the system, when they trust the government to act as the custodian of their private information. A new regime of documented and specific consent is needed that empowers patients to control their e-health record.
Managing consent: what, how and when
1. Consent for a specific purpose
Legislation requires that e-health data can only be used for the purpose that it was collected, in most cases for individual treatment, unless the patient provides consent that information can be used for a secondary purpose. So we have the situation that data has been collected e.g. for a medical research purpose, and now we could re-use this data for analysis, treatment reviews and modelling using new techniques, but this re-use requires patients consent for a secondary purpose. However, gaining patient consent retrospectively is impractical, and requesting consent for potential and future uses is problematic when these are not yet known. Consent will need to become a more nuanced and updateable record which enables a user to withdraw consent at some future time.
2. Consent must not be a pre-condition for service delivery
Health services will need to ensure that default consent is not required or required as a condition to receiving a service. So when a patient gives permission to share test results, that doesn’t give consent for the data to be shared with others, to be sold or re-used for commercial purposes.
3. Keeping records of consent
Health practitioners and consumers need better awareness about privacy protection and the management of user’s consent. A draft consultation paper from the UK’s Information Commissioner provides guidelines on how to manage patient consent, including advice on the recordkeeping requirements for user consents. The guidance is based on principles and supporting guidelines:
- Consent should offer genuine choice and control,
- Requires a positive opt-in, not opt out
- Explicit consent requires clear and specific statement of consent
- Make it easy to withdraw consent, and tell people how
- Keep evidence of consent,
- Avoid making consent a precondition of a service.
- Consent should be clear, concise and easy to understand
- Consent should be separate from other terms and conditions.
- Health services should provide instructions if the patient wants to withdraw their consent.
Health service providers should keep records of consent, including when and how consent was given, and updated. Health services will need to retain records to show evidence of consent. Although there is an overhead to keep sound records, the long term benefits will be a trusted e-health system.
Without trust, without explicit consent and the confidence that consent is controlled by patients, users are less likely to accept and use e-health systems.
About the Author
Kerry Gordon is a Director and Consultant with Recordkeeping Innovation. She works on digital recordkeeping and archives for clients in Australia and SEAsia. Kerry delivers regular training programs in records management and managing digital records. Kerry has a Masters Degree in Information Management from Monash University, Melbourne and has experience in developing large scale strategic studies for digital transition, classification and retention, managing administrative and organisational change, project management and communications supporting information governance.