Medical Records Confidentiality In A Changing Health Care Environment

Examines issues relating to medical records confidentiality in a changing health care environment. Witnesses: John Bentivoglio, Counsel for Health Care Fraud, Justice Dept.; Lynne Hunt, Chief, Financial Crimes Section, FBI; Ronald Weich, ACLU; Robyn Shapiro, Center for the Study of Bioethics, Med. College of WI, for the ABA; LaDonna Shedor, Healthcare Leadership Council; Paul Appelbaum, Amer. Psychiatric Assoc.; and John Curd, Genentech, Inc. Also, Chris Koyanagi, Consumer Coalition for Health Privacy; Robert Pyles, Amer. Psychoanalytic Assoc.; Kathryn Sebelius, Nat. Assoc. of Insur. Commiss.; and the Wash. Bus. Group on Health.

Most industries have plunged into data automation, but health care organizations have lagged in moving patients' medical records from paper to computers. In its first edition, this book presented a blueprint for introducing the computer-based patient record (CPR). The revised edition adds new information to the original book. One section describes recent developments, including the creation of a computer-based patient record institute. An international chapter highlights what is new in this still-emerging technology. An expert committee explores the potential of machine-readable CPRs to improve diagnostic and care decisions, provide a database for policymaking, and much more, addressing these key questions: Who uses patient records? What technology is available and what further research is necessary to meet users' needs? What should government, medical organizations, and others do to make the transition to CPRs? The volume also explores such issues as privacy and confidentiality, costs, the need for training, legal barriers to CPRs, and other key topics.

In the realm of health care, privacy protections are needed to preserve patients' dignity and prevent possible harms. Ten years ago, to address these concerns as well as set guidelines for ethical health research, Congress called for a set of federal standards now known as the HIPAA Privacy Rule. In its 2009 report, Beyond the HIPAA Privacy Rule: Enhancing Privacy, Improving Health Through Research, the Institute of Medicine's Committee on Health Research and the Privacy of Health Information concludes that the HIPAA Privacy Rule does not protect privacy as well as it should, and that it impedes important health research.

When you visit the doctor, information about you may be recorded in an office computer. Your tests may be sent to a laboratory or consulting physician. Relevant information may be transmitted to your health insurer or pharmacy. Your data may be collected by the state government or by an organization that accredits health care or studies medical costs. By making information more readily available to those who need it, greater use of computerized health information can help improve the quality of health care and reduce its costs. Yet health care organizations must find ways to ensure that electronic health information is not improperly divulged. Patient privacy has been an issue since the oath of Hippocrates first called on physicians to "keep silence" on patient matters, and with highly sensitive dataâ€"genetic information, HIV test results, psychiatric recordsâ€"entering patient records, concerns over privacy and security are growing. For the Record responds to the health care industry's need for greater guidance in protecting health information that increasingly flows through the national information infrastructureâ€"from patient to provider, payer, analyst, employer, government agency, medical product manufacturer, and beyond. This book makes practical detailed recommendations for technical and organizational solutions and national-level initiatives. For the Record describes two major types of privacy and security concerns that stem from the availability of health information in electronic form: the increased potential for inappropriate release of information held by individual organizations (whether by those with access to computerized records or those who break into them) and systemic concerns derived from open and widespread sharing of data among various parties. The committee reports on the technological and organizational aspects of security management, including basic principles of security; the effectiveness of technologies for user authentication, access control, and encryption; obstacles and incentives in the adoption of new technologies; and mechanisms for training, monitoring, and enforcement. For the Record reviews the growing interest in electronic medical records; the increasing value of health information to providers, payers, researchers, and administrators; and the current legal and regulatory environment for protecting health data. This information is of immediate interest to policymakers, health policy researchers, patient advocates, professionals in health data management, and other stakeholders.

This User’s Guide is intended to support the design, implementation, analysis, interpretation, and quality evaluation of registries created to increase understanding of patient outcomes. For the purposes of this guide, a patient registry is an organized system that uses observational study methods to collect uniform data (clinical and other) to evaluate specified outcomes for a population defined by a particular disease, condition, or exposure, and that serves one or more predetermined scientific, clinical, or policy purposes. A registry database is a file (or files) derived from the registry. Although registries can serve many purposes, this guide focuses on registries created for one or more of the following purposes: to describe the natural history of disease, to determine clinical effectiveness or cost-effectiveness of health care products and services, to measure or monitor safety and harm, and/or to measure quality of care. Registries are classified according to how their populations are defined. For example, product registries include patients who have been exposed to biopharmaceutical products or medical devices. Health services registries consist of patients who have had a common procedure, clinical encounter, or hospitalization. Disease or condition registries are defined by patients having the same diagnosis, such as cystic fibrosis or heart failure. The User’s Guide was created by researchers affiliated with AHRQ’s Effective Health Care Program, particularly those who participated in AHRQ’s DEcIDE (Developing Evidence to Inform Decisions About Effectiveness) program. Chapters were subject to multiple internal and external independent reviews.