Canada’s federal and provincial governments are all on board: Electronic health records will mean more efficient, safer health care.
That, however, means a whole new ball game for information protection and privacy.
Canada Health Infoway Inc., which includes Canada’s 14 federal, provincial and territorial deputy health ministers, is seeking tens of billions of dollars over the next decade to effectively build and secure a massive network of interoperable patient databases.
Reflecting the primacy of privacy issues, Infoway hired a chief privacy strategist last year. Joan Roch, formerly chief privacy officer with the Canadian Institute for Health Information, has been tasked with ensuring that the EHR system complies with the federal Personal Information Protection and Electronic Documents Act as well as the various provincial privacy and information protection acts.
Advanced technologies provide all sorts of locks and bolts for protecting information – things like user identification and authentication, access control, data encryption, network firewalls and intrusion prevention systems.
“So when people say they’re worried about EHRs because of privacy concerns, it’s almost backwards,” says Steven Lewis, a Saskatoon-based policy and research consultant with the Health Council of Canada.
To understand EHRs properly, says Lewis, people need a context. “And the context is, the best way to protect personal health information privacy is by making it electronic.
“If you had to choose between paper and electronic methods, you would choose electronic in a nanosecond.”
Technology may well build a better fortress around private information in an electronic world. But the reality is that security measures will go only so far before they begin to inhibit the health care workflow and actually impede practitioners.
Doctors and nurses need ready access to information, especially in emergency situations. Access can be role-based, but once a health care provider is inside the arena, for the most part information flows freely.
“People have the right to expect a safe, secure and vigilant system,” says Lewis. “It’s unreasonable to expect an absolute 100 per cent certainty that [a breach of privacy] could never happen. But people can certainly expect, and the system can achieve, an extremely high level of reliability.”
Privacy watchdogs and other advocates are far from satisfied. Ann Cavoukian, Ontario’s information and privacy commissioner, says access is still too broad and role definitions are too crude.
A recent breach at Ottawa Hospital caught a nurse fingering patient records she had no right to access and this underscores the problem with EHRs and the existing software systems, says Cavoukian.
“None of them have very strong restricted access. There have to be better systems with better protection. I’m a big fan of EHRs and there’s no question this is the way of the future, but we are nowhere near having the necessary protections that we need.
“I don’t think the balance is strong enough. I think the balance right now, and I understand why, is too much on the side of wide open access to a patient’s EHR.”
EHRs have the advantage of electronic audit trails to log file access, but Cavoukian wants to see tighter role-based access and stricter policy enforcement.
“Health information, unlike any other personal information I’m aware of, is truly bimodal in nature,” she says, “On the one hand, you want it accessed immediately and readily by all the health care providers treating you, and on the other hand you want to protect it as strongly as possible from those who shouldn’t have access to it.”
Cavoukian says someone has to be accountable for overseeing the protections that need to be built in, following through and ensuring that the policies are embedded within the broader policies of the hospital.
“One of the problems is when you build privacy-protected systems, they’re new. So they’re not interwoven within the broader policies of the hospital, and basically they’re not followed.”
Most people trust medical practitioners to behave professionally. It’s when the EHR moves outside the circle of health care that patient privacy and information protection are at greatest risk, notes Frank Work, Alberta’s information and privacy commissioner.
One of the biggest issues now is orphaned or abandoned databases, he says. “Some of these databases are outliving their usefulness, and we don’t know where these things are winding up.
“There’s no law that says what you have to do with a database once you decommission it.”
The B.C. government was stung earlier this year when it auctioned off some old backup tapes which hadn’t been properly erased, exposing thousands of sensitive, identifiable health records.
Databases are also used for medical research. In fact, they’re coveted by researchers and drug companies as veritable treasure troves.
“The whole research question is huge because these interconnected, interoperable systems are very attractive to researchers,” says Work. “This is going to be socially the toughest to deal with, the faster and further you go linking health records.”
Requests for access to health information have to come before a research ethics board for approval, but Work says the whole process is cause for concern. “The system is terrible, it’s a very bad system,” he says.
Research ethics boards are based in hospitals or universities and they’re all made up of volunteers, explains Work. “And they’re just not equipped to deal with the size of the databases and the complexity of the research that’s being proposed.
“We’re still using this very antiquated system of approving research. Databases are becoming bigger and richer and more attractive, yet the process by which we approve access and use of the health information is not keeping up with those complexities.”
Data can be de-identified or completely anonymized, but in many cases neither is an option for longitudinal studies, where researchers track patients over an extended period of time.
David Loukidelis, information and privacy commissioner of British Columbia, says the system architects and policy makers have to be clear in their own minds about what the end uses of the data will be.
When they do their privacy impact assessments and sketch out their architecture, how are they designing the system and why?
“Why is it you need identifiable data?” asks Loukidelis. “That should always be the first question in the electronic environment.
“Longitudinal studies are a different issue, but it seems to me a lot of the stuff that’s being done could conceivably be done with anonymized or de-identified data.”
Loukidelis agrees EHRs can offer a lot of benefits to researchers. “But at the same time we have to be sure we have appropriate privacy principles and protections, both policy and technological, in place.
“You also have to have the absolute determination, will and vigilance on the part of management to take these things on.”
Another concern is how freely data can walk out the door. As we increasingly move to an online or electronic environment, we’re more and more going to see health data stored on portable devices like BlackBerrys, smart phones and laptop computers.
“It’s just another example of where we’ll have to start looking at technologies like encryption,” says Loukidelis.
One stolen laptop was recently reported to contain financial and other personal information about an estimated 8,000 clients of MD Management, a subsidiary of the Canadian Medical
Association. It’s but one of countless other stolen laptops that have placed sensitive information at the risk of identity theft.
There are all sorts of database management issues, admits Bill Pascal, the CMA’s chief technology officer. But ultimately it’s about finding the right balance and setting up a consistent policy environment throughout Canada.
The system has to be both physician-friendly and respectful of a patient’s private information, and according to Pascal most of these policies around therapeutic care have been nailed down.
“Information is shared based on a judgment call by the referring physician on what information is relevant,” he says. “Where the discussion is going now is determining what information is really necessary and belongs in that minimal data set.
“We’ve worked through it at a detailed level, and now what we’re getting to are some of the nuances. This is the tougher stuff, this gets into some very ethical questions.”
A lot more debate is needed to determine the rules for how information will be used for secondary purposes such as research and administrative system management.
Pascal notes that none of these issues had really been sorted out in the paper world. And now, because you can create huge databases and you can manipulate them quickly and more easily, there’s a lot more demand to get at the databases.
“We have to respect that the individual has provided the information for one purpose and now we’re using it for another.”
It’s a world that needs constant attention, says Pascal. “It’s not something you write a bunch of policies for and walk away.”
Mark Els (mels@itworldcanada.com) is a senior writer for NetworkWorld and a regular contributor to CIO Government Review.
