When a computer service bureau either erases or destroys records, there are procedures in place to notify a physician. If the service's relationship with the physician is terminated, all computer files must be physically given back to the physician who supplied them. The destruction/erasure of records can only be done if a physician has their own copy of the information. Any routine or needed file erasure must be verified in writing to the physician. Constant communication and checking-in between a physician and computer service bureau is essential to maintaining transparency. 6. Should individuals and organizations with access to the databases be identified to the patient?

Computerized databases can have a myriad of people with access to them, and as such should be included in any disclosures to the patient in regards to inclusion within a database. In fact the AMA specifically states that, "All individuals and organizations with some form of access to the computerized data bases, and the level of access permitted, should be specifically identified in advance" (AMA 5.07). Without these notifications there is no full disclosure and the patient cannot consent to a given treatment. If any data will be distributed that retains patient identifiable characteristics, both the physician and patient most be notified in advance. Only after notification is given and a patient has consented to the distribution, can the computer service bureau release reports to any organizations that are outside of the care environment. Everyone that could have access to a patient's information must be made clear to a patient so that they have the express say in the dissemination of any information that is in regards to themselves. This gives an unprecedented control to the patient in reference to information that refers to them specifically.

7. Does the AMA mention encryption as a technique for security? Define encryption and explain any methods mentioned.

Because...

The AMA mentions guidelines for access, in particular that it should stay internal to the clinical facility and that any individuals or organizations outside of the clinic should not be granted online access to records that contain any identifiable data concerning patients. Any off-site access will have no patient identifiers that could breach patient trust. Access the database itself should have levels of security including, "passwords, encryption of information, and scannable badges or other user identification" (AMA 5.07). Encryption is nothing but the encoding of data so that it is unable to be deciphered by outside sources. Additional security with regards to personnel includes auditing procedures in the event of the unauthorized disclosure of medical data. When personnel no longer work for the agency in question, all access should be terminated with the end of their tenure. All of these measures and even more clinic created policies should be in place in order to protect digitized information.
8. What does the AMA say about disclosure by recipients of authorized data to third parties?

The trusting relationship between a patient and their doctor is fundamental and must be maintained throughout any dissemination of information. It is only through the patient's written consent that identifiable information can be disclosed. Any confidential medical information from a database must be confined to the purpose in which it was requested. Authorized release of data to any organizations does not authorize a further release to third parties. This arrangement allows for the continued confidentiality of a patients history by maintaining the original arrangements for distribution.

Works Cited

"Opinion 5.07- Confidentiality: Computers."Code of Medical Ethics. American Medical Association, 2010. Web. 08 June 2010. .