The private life of files

Thirteen employees at the Medical Centre at the University of California were recently sacked for snooping into Britney Spears' confidential medical records and more faced disciplinary action. Now it is so easy to store data about us electronically, what do we know about our health information? Do we know what is already held, if it's accurate and who has access to it? Should we care? Health reporter Elspeth Mclean explores some of the issues.

When you read about hospital staff snooping though Britney Spears medical records for the second time in three years, it is easy to think it has nothing to do with you.

It is hard to imagine people lining up to pore over the fascinating details of your ingrown toenail removal back in 1989 and selling the story to the tabloids.

You might be less happy, however, if your neighbour, working at a small community hospital, discovered you had HIV and spread that news throughout your home town.

And what if that information in your records was wrong in the first place? How would you know?

The importance of health information accuracy was brought home to privacy commissioner Marie Shroff during a recent visit to the dentist. Lying back in the dentist's chair she was a little surprised to hear about the work planned for her teeth.

Her dentist's discussion with his assistant covered more extensive treatment than she had anticipated. She sat up and looked around.

There was her name on his computer screen - JM Shroff.  But it wasn't her address. It wasn't her file and it wasn't her.

The person the dentist thought he was treating was a distant family connection, sharing her initials and surname, but not her teeth.

Her story illustrates one aspect of the health information debate. The need to get the right information to the right person at the right time. And there's a lot of health information out there.

Dentists, general practitioners, specialists, physiotherapists, pharmacists, ACC, midwives, screening programmes, immunisation programmes, the cancer register and hospitals are just some of the individuals and organisations which may have pieces of it.

The national Health Information Strategic Action Committee manager Dougal McKechnie says patients should assume that when they engage with a health provider some information on them will be collected, but also be aware that they have a right to view what is collected and have their version of it recorded if they find it wanting.

Mr McKechnie says clinicians recording information electronically on patients should be encouraged to make sure they actively discuss what they are gathering with patients.

Some doctors enter information so patients can see it as a matter of course.

Federation of Women's Health Councils co-convener Barbara Robson, a long-time advocate for health consumer rights, says sometimes there is a temptation for practitioners to rely on the information in the electronic record at the expense of clinical examinations and actually talking to the patient.

One of the cases she has heard of involved a person who had used mental health services, but who also suffered from asthma.

She was sent away from the emergency department of a hospital because it was claimed she was having a panic attack when she was actually having an asthma attack.

The mental health history had been noted while the asthma history had been overlooked. No clinical examination or medical history was undertaken.

Ms Robson says while the right to see your own health information and ask to have your view of its correctness recorded was enshrined in the 1994 Health Information Privacy Code, often people are unaware of this.

If inaccurate information is held and not checked, it can lead to adverse events such as inappropriate treatments or wrongly prescribed drugs.

She is one of those who have been concerned about the lack of progress on consumer involvement in the sharing and use of personal information, even though the 2001 national WAVE report (Working to Add Value through E-Information) noted patients should be involved, as a matter of priority, with further developments in health information.

The action committee, which is charged with overseeing the implementation of the Health Information Strategy launched in 2005, has recently acknowledged that there needs to be greater community involvement in issues relating to the use of and access to personal health information.

It hosted a forum for more than 40 health consumer representatives and advocates in February, at which the need to build the confidence and trust of consumers was emphasised.

It accepted the need for consumer representation on the committee and on other groups and subcommittees established by the committee.

It will also conduct further consumer forums to seek views on how to improve communications with the community about information sharing.

The Health Information Strategy signalled a move towards increased information sharing among health-care providers but expressly discounted having a single national repository of personally identifiable health information or a single national Electronic Health Record.

Ms Shroff likes that approach. "Keeping patient information in primary care and sending the aggregated data to where it can be used to improve public health makes sense.''

She emphasises the need for a careful and thorough assessment of privacy risks and impacts of projects designed to move health information around, to analyse and improve it.

While there is no single national electronic record on us, more than 95% of us have a unique National Health Index (NHI) number to help identify us when we use health and disability services and against which a variety of data is stored.

But even though the NHI has been with us for about 20 years, only a few hands straggle up when Ms Shroff asks most audiences if they know what it is.

When she asks if anyone knows what their number is, usually she gets no takers.

If she's talking to doctors or other people in the health sector, the response is better, but Ms Shroff sees that as part of the problem.

"The health sector knows what's going on, at least in part; but no-one else does.''

Among the places where the NHI is used and where individuals may have information held against that number are the national mortality register, the maternity and newborn information system, the New Zealand cancer registry, the national immunisation register, medical laboratories where you may have had tests, the pharmaceuticals database, the Mental Health Information National Collection, public hospitals (if you are admitted) and the national booking reporting system, which records whether a patient is to get priority for publicly funded surgery.

Data using the NHI is held on the medical warnings system, which is designed to warn health and disability services of any known risk factors that may be important when making clinical decisions, such as allergies to drugs and significant medical conditions.

An encrypted form of the NHI number is used in statistical databases.

Information from these databases is used to assist planning, co-ordination and provision of health and disability support services.

Ms Robson said many people did not realise they could find out what was held against their NHI number by contacting the New Zealand Health Information Service privacy officer.

Mr McKechnie agrees there is a lack of understanding about the NHI and the way information linked to it can be used, and sees a need for an awareness-raising campaign.

One of Ms Robson's concerns is the need to protect the NHI number as a health identifier, so it does not gradually develop into some sort of general national identification number.

A Law Commission study paper on privacy, released last month, says the central issue for health information is to get a proper balance between keeping personal health information confidential and getting the right information to the right person at the right time.

"It is not so much a matter of patient consent as of knowledge: of the patient being aware of how his or her information may be used.

"There needs to be some explicit understandings as to how patient information will be used once it is collected,'' the paper said.

There is an expectation that information will be shared and patients need to know that.

The study paper suggests patients have some fundamental concerns about their health information including what is the purpose of collecting health information, how it will be used now and in future, who will have access to it and how, and who decides this?

"An important issue is whether patients have any say or control over how their information will be shared,'' the paper said.

There is a risk that the complexities of the health information system mean that health experts are "flying under the radar'' in the sense that the public are not always aware of what is happening, the paper states.

Ms Robson says district health boards and Primary Health Organisations (PHOs) should be challenged to involve consumers in their information systems developments and information sharing practices, to discuss what is acceptable and what is not, acknowledging any privacy concerns identified and showing how they will be addressed.

She believes there is a lot more information-sharing going on than people realise - the handing over of names to screening or health promotion programmes by some PHOs, for instance.

Such hand-overs are not done for a sinister reason, but because it is seen to be in the patient's interest, but the patient should be asked about it.

ACCESS to patient information has already been the subject of some controversy in New Zealand including insurance companies asking for full patient records from doctors and health workers inappropriately accessing hospital files, supposedly involving celebrities, in Auckland last year.

At Dunedin Hospital last year, there were two complaints alleging unauthorised access to electronic records, but an audit showed these to be unfounded.

Otago District Health Board regional chief information officer Grant Taylor says most of the information about patients is held electronically now and the system, which only allows access through individual log-in, is readily auditable.

He accepted audits would not reveal whether there were six people staring at information on a screen, but the professionalism of staff could play a role in the reporting of any such incidents.

The board views privacy breaches very seriously and in the pre-electronic era had dismissed people found responsible for this.

He believes there will be increased information-sharing between health-care organisations and it will be important that the systems used are compatible.

The best interests of the patient has to be the primary driver for sharing information, not somebody's desire to be able to "look up Jonah Lomu's blood tests''.

The hospital sends electronic records of laboratory and radiology results and discharge summaries to outside providers, including GPs, and is working on a system which will allow GP practices to access patients' electronic records held by the board.

Mr Grant believes it would be in patients' interests to be able to enter any public hospital in an emergency and for staff there to be able to have access to relevant clinical records held elsewhere.

Limits can be placed on the amount of information available to certain practitioners, using what is known as the breaking glass technique.

To get to certain information, restrictions are placed on who can " break the glass'' to get access. This might apply to particularly sensitive information such as that on mental and sexual health and HIV status.

Mr McKechnie says some people already assume that if they are on holiday in Queenstown and need medical treatment, their medical records from Auckland will be readily available, although that is not the case.

Ms Shroff cautions against overselling the benefits of technological change.

"Progress is important, but I have noticed how often it can become its own justification".

Although she does not doubt that we will all have electronic health records one day, and that it will probably be a good thing, she points out that a 2007 study of electronic health records in relation to nearly 2 billion hospital visits in the United States revealed no significant improvements in patient outcomes.

If health consumers were to be told their electronically-held information was going to be shared widely, it was reasonable for them to ask "what's in it for me?''

Following the recent consumer forum, action committee chairman Paul Cressey emphasised that information should primarily be gathered and shared to improve the health and independence of New Zealanders.

It may be easiest to think we should let all those interested in gathering information just get on with it, but Ms Robson says we need to play an active part so we know what is going on and we can help decide what is wise use of information for the public good.

Ms Shroff, who supports moves to increase consumer involvement in health information developments, says if people don't know what is happening to their information they are not well-equipped to take care of it and ensure it is accurate.

"The risk I see is that health consumers may lose their trust in the health system as a result of their health information being spread more widely than they think it should be,'' Ms Shroff said.

"Should that happen, and I worry that it may be only one major scandal away from happening right now, a lot of effort and potential may be wasted.

"And that may, in the end, be to the significant disadvantage of health consumers in New Zealand.''

Add a Comment