Electronic health records and patient safety concerns in healthcare

¶ … Electronic Medical/Health Records

Utilizing Electronic Medical Records Increase Patient Safety?

A large majority of the American public expresses deep anxiety about their private health information, and over half of them are concerned that data they provide to insurance companies might be seen by an employer and used against them to reduce job opportunities. This is an upsurge from 1999, when only one-third of the public expressed concern. More precisely, in light of the fact consumers already have agreed to share such information, their concerns are about confidentiality, or the ability to control access to information (Ball, Smith and Bakalar).

In addition, the American public wants to have its own electronic medical/health records. In late 2005, almost two-thirds of Americans said they preferred the establishment of a secure online Electronic Health Record service for their own use. They believed this could improve safety and offer convenience.

Two-thirds of those responding indicated they would use it to check for errors in their health/medical records, and about the same number said they would use the records to check and fill prescriptions. Another 58% said they would use these "Personal Health Records" (PHRs) to get results online, and over half would turn to PHRs to conduct private e-mail correspondence with their doctors (Ball, et al.).

PHR systems are more than just information files for patients; they combine data, knowledge, and software that help people become actively involved in their own care. When PHRs are combined with electronic health record (EHR) systems, they provide greater benefits than would separate systems for consumers (Tang, Ash and Bates).

PHRs are patient-centered records that engage individuals in organizing their own health and healthcare through a composite, all-inclusive view of their health data, including medical history, medications, immunizations, allergies and other personal health information (Kaiser Permanente).

Since the purpose of this paper is not to differentiate between the two types of files and define them, but rather to discuss their safety factor in regards to the patient, we will deal with them under these circumstances as if they are, for the most part, the same. We will use the term "EHR" to serve as all-inclusive, except in those instances that it is necessary to differentiate for reasons of clarity.

Problem Statement

December 23, 2008...This morning, the Los Angeles Times reported that more than 1,000 patients at Cedars-Sinai had their personal information stolen by a former employee in the hospital's billing department. This problem is not unique to Cedars-Sinai.

Similar problems have surfaced at one of the hospital's major competitors, UCLA Medical

Center, where at least 165 staff members have been disciplined for improperly accessing the files of more than 1,000 patients, including California First Lady Maria Shriver, actress Farah

Fawcett and singer Britney Spears (Szwarc).

When a patient's medical records are compromised, it can hurt more than their wallets, experts warn. Victims of this kind of fraud face a greater risk of injury if doctors make treatment decisions based on incorrect information contained in their records. Many employers also demand access to medical records when making hiring, promotion or benefits decisions, according to the nonprofit Patient Privacy Rights Foundation (Szwarc).

And, on the other hand we have the case of Hurricane Katrina which has been the loudest wake-up call so far for the need for electronic health records (EHRs), according to some prominent policy figures. Floods from the storm erased the medical records of about one million people in the central Gulf Coast because they were written on paper and stored in boxes in hospitals and physicians' offices (Byers).

Feeling insecure about your health data security? If so, it is no wonder, considering the frequent security breach headlines and the eHealth Vulnerability Reporting Program's declaration in September that many electronic health record (EHR) systems are at risk for security threats. How worried should providers be, and what should they do to bolster security against would-be hackers (Take extra precautions...)?

"Hackers look for vulnerabilities in it infrastructure," says Norm Martel, president of Medical Technology Research Corp. In East Kingston, NH. "Whether you're a hospital or a high-tech company, the infrastructure is what ties everything together. All of your computers, all of your software, all of your equipment -- and for a hospital that might include x-ray equipment -- is connected to the organization's it infrastructure, which means you need to be concerned about it from a security point-of-view," he says (Take extra precautions...).

"Good security is a fine balancing act between accessibility and privacy. You have to decide how secure you want to be vs. how complex you want to be. You need to think about the ability to access and use your systems," Martel says (Take extra precautions).

Is online security for patient electronic health records adequate to protect the data and individual privacy? And how does online safety compare to physical security for paper files?

Literature Review

There has been much written about the efficiency advantages of systems that electronically provide an individual's health/medical information. There has also been a lot of statements provided regarding the disadvantages of such a system in terms of security and safety of patient records.

There is not an abundance of verifiable, empirical data available testifying to the fact that electronically-delivered health data is safe and secure either while it is being stored or utilized and transferred between physicians and medical facilities.

The Wall Street Journal / Harris Interactive poll quoted in this paper, (Beckey, 2007) also gives some inclination of how Americans feel about the security of their personal health records online. A majority believes electronic data is less likely to keep their personal information private.

Most of the research concentrates on the benefits of the processes of an electronic system and how efficient they are -- (Byers, 2008), (Denmark, 2008), (Tang, 2005). but, it is evident that these sources don't want to discuss the safety issue. They tend to treat it as a given -- which, of course, it is not. I believe that is the one big gap in the research I found -- the lack of the safety discussion in those articles that speak positively of other aspects of electronic records.

This area is open for more study by those whose research reflects these positive benefits of such a system. If not, their conclusions seem unbalanced, and, therefore, rather specious. This is reinforced by the fact that, in this day of serious hacking online, almost nothing can possibly be guaranteed safe. To skip the argument, is to admit that it merits review.

It would seem also that the same argument could be held in reverse for those who claim, and rightfully so, that electronic records bear some vulnerability to discovery and exposure. The gap in their research is that there seems only one consideration==that of safety -- and other benefits are briefly addressed or ignored (Szwarc, 2008), (Hoholik, 2008).

Future research in this subject, particularly in light of President Obama's push for nationwide electronic medical records, should use more empirical data as opposed to opinion. In the past this has been impossible due to the lack of long-term studies of electronic health and medical records' systems, such as the North Bay Healthcare Group case study (Denmark, 2008). It must be noted that this particular study did not discuss the results of electronic record security, yet empirically reported the successful usage of the many capabilities of the system.

I believe the contribution that existing research makes to the field is to reveal the lack of balanced studies to include long-term surveys and empirical data which can prove the safety and security of electronic health and medical studies, one way or another.

Trends, Factors, and Influences in Medical Record Security

The Health Insurance Portability and Accountability Act (HIPAA) is an extension of this age-old concern, consisting largely of common-sense requirements to ensure the continuing confidentiality of patients' medical information in all of its forms. The regulations stemmed from growing concerns about the security of electronically stored and transmitted data. Since its inception, though, the rule has expanded to include not only electronic medical records, but also oral communications and paper medical records (Fiske).

For years, a debate has been waged over the safety and security of paper vs. electronic records in the medical community. On one side is the argument that paper records are easier to manage and control because access is necessarily limited. By their nature, paper records are impervious to computer hackers, and, unless they are manually converted to electronic form, there is far less potential for the errors that occur during the transcription process. Electronic records, others say, are more efficient because most billing, including Medicare and Medicaid, is done electronically. Electronic records are less likely to be misplaced or lost and allow for safety precautions, such as computerized monitoring of prescriptions to prevent allergic reactions or undesirable drug interactions (Fiske).

In the end, most believe that there is, and may always be, a place for both electronic and paper records in the medical industry. The records of many smaller practices and rural hospitals continue to be paper-based. However, because they make billing more efficient, the majority of large urban practice groups and hospitals have already made the switch to electronic records, according to Michael R. Costa, attorney and associate at Greenberg Traurig, LLP, in Boston, Mass. However, he adds, most of these organizations maintain warehouses where they store paper records that have been transcribed to electronic form. "There is resistance from some about going to a completely electronic format because there are still some questions about privacy," Costa says. "There is definitely still a place for paper-based medical records, but the focus from now on will be on making sure that information can be adequately secured" (Fiske).

Frederick Geilfuss, partner in the health law department of Foley & Lardner, in Milwaukee, Wis. says that while many larger providers have already begun the shift, he has not encountered any institutions that have made a complete transition -- an event that he believes is still in the distant future. "There are quite a few doctors out there who are not technologically minded and who prefer paper records," he explains. Changing from paper to electronic records requires organization, as well as technology, because a switch made on a going-forward basis would result in two sets of medical records -- paper and electronic -- with an increased potential for confusion (Fiske).

Health Information Management (HIM) professionals using paper-based systems are confronted by many of the same challenges regarding HIPAA compliance as their colleagues who have switched to electronic records. Although the legislation was originally intended to ensure security and privacy of electronically stored and transmitted information, it has evolved to include all types of communications. "HIPAA extends to any manifestation of patient confidentiality, including what people do in medical offices and what they say about confidential information," explains Henry E. Schwartz, partner in the business and corporate department in the Baltimore, Md., office of Blank, Rome, Comisky, and McCauley, LLP (Fiske).

The HIPAA security requirements for paper-based records are the same as those that apply to oral communications and electronic information, Costa explains. It will be necessary to ensure that the minimal amount of information is disclosed at any time, and providers will need to adhere to restrictions about uses of patient information for medical research and quality assurance purposes. Monetary penalties for noncompliance can range from $10,000 to $250,000, depending upon whether disclosure of information is accidental or for commercial profit, he says. There are also criminal penalties ranging from five to ten years in prison for willful release of patient information without patient consent (Fiske).

While securing paper medical records in either an office or at an off-site facility is often lock-and-key simple, it is always important to monitor and limit employee access to vital and confidential information. "There is really nothing new under the sun, as far as security measures, for paper medical records," says Schwartz. "Medical information has always been confidential, and, in the larger sense, HIPAA didn't change that." Although HIPAA does not specify the means by which requirements must be met, most security measures are simply based on common sense, beginning with an assessment of office practices in order to determine the current state of security for written and oral information, he says (Fiske).

Among the measures that Schwartz recommends are locking medical records files and restricting physical access to them; implementing a policy to ensure that no one enters medical files without authorization and reason to do so; developing a fax policy to ensure that faxed medical information is received by the person for whom it was intended; and, perhaps most simply, not leaving medical files on desks or tables around the office. "It's great that medical records are protected when they are in a storage cabinet," Schwartz comments, "but what happens when someone takes them out to look at them? Does the person leave them lying around while he or she leaves to get a cup of coffee" (Fiske).

As bulky paper records accrue, many healthcare organizations opt to store them in off-site warehouses or storage facilities. Historically, this has not presented any problems of which Schwartz is aware, but he cautions administrators to include security policies in contracts with off-site storage providers. He adds that, when disposed of, paper medical records should always be shredded. "If anyone gets a hold of them," he advises, "they should be unreadable and unrecognizable" (Fiske)

Is Privacy Even Possible?

You might expect health-care providers and insurance companies to use the best security measures to keep your medical information private. But a national expert on patient privacy said it's naive to think that your health record is secure. And with the federal government pushing for more electronic records, security will only get worse.

"Because of the primitive state of health technology, there are a lot of risks with electronic records, frankly far more than paper," said Dr. Deborah Peel, founder of Patient Privacy Rights, a nonprofit organization based in Austin, Texas (Hoholik).

Peel, who recently spoke at a health-policy conference in Columbus, said most people don't know about all of the nonmedical staff people who have access to their electronic health information. And she questions providers who promise privacy.

"The public is not aware that hospital systems allow anyone who's a staff member to see your records," she said. "They can limit employees to certain parts of your record, but most hospital-based systems don't even have that" (Hoholik).

Hospital and insurance officials don't agree.

"They actually are more secure than paper records," said Tiffany Himmelreich, spokeswoman for the Ohio Hospital Association. "The data is encrypted so Joe off the street doesn't have access to it." She said most hospitals can audit records to see who opens them.

Only physicians and medical assistants have access to patients' electronic records at Dr. Michael Waluzak's office in Westerville. The Central Ohio Primary Care office switched completely to electronic records in June 2006 (Hoholik).

"If someone breaks into your office and you have paper charts, you have no security,"

Waluzak said. "Nobody can tell you any system is 100%, but I think it's more secure than paper" (Hoholik).

The Institute of Medicine Speaks Out

The Institute of Medicine issued a report on privacy of medical records in early February that fuels this concern. The IOM started with the premise that protections for electronic medical records are a must, because the benefit of health it is so great. The records will speed up access to a patient's health information, cut down on redundant care, and reduce medical errors. Access to the online digital record by researchers also means massive medical databases can be searched, shared, analyzed, and drawn upon. Epidemiological research would be carried out on a scale never before imagined, to improve care, develop better practice guidelines, and determine cost-effectiveness (Healy).

Recognizing the importance of the public's confidence in the sanctity and confidentiality of medical records, the IOM came down hard on the current privacy protections that are supposed to ensure this. The group concluded that government rules to protect patients' medical records are simply inadequate. At best, they should be scrapped -- or overhauled, at the very least. The report also points to the many security breaches of medical record databases, covering tens of thousands of patients that have occurred in the past two years and cites this as a growing problem (Healy).

Lack of confidentiality protections for a far more extensive national online record system would surely cause major unrest among most Americans. Despite its shortcomings, the paper record distributed across hospitals and doctors' offices has a limited ability for wide dissemination. A centralized, integrated, electronic record with access to all Americans' files would not only contain more information, but its potential distribution could be measured in the millions, not just the few who could lay their hands on a chart. Would most of those unauthorized eyeballs be gazing for the patient's benefit? I don't think so (Healy).

One thing that the IOM calls for is an audit trail of just who accesses online records. In fact, there is no reason that patients themselves should not know who's seen their records, rightly or wrongly, here or elsewhere in the world, where records are now outsourced for insurance review. it's also unseemly that marketers can buy pharmacy information about patients, so they can send them illness-specific advertising, and questionable that insurance companies should send patients mailings that suggest they take a medicine other than the one their doctor has ordered (Healy).

Discussion -- the Positive Side of EHR/EMR Security...maybe?

Finding advantages listed for EHR systems is easy. Finding information that tells one how much safer an EHR is than a paper file is not so easy. My research discovered that there is a lot of "hedging" and "iffy" statements about the safety of "online" records of any sort. It seems that very few are willing to commit to a black and white statement of support that, if you trust your health records to the electronic age, someone (unnamed) will guarantee you they will be safe. I found this quite disconcerting, as my assumption going in was that, of course the EHR is safer than a paper folder sticking out of a shelf in a doctor's office.

Now, that last statement is probably true, overall, as we look at the advantages and disadvantages of electronic vs. paper, and all the ways in which a paper file can be lost, damaged or compromised. There is one significant thought to share about the compromising of paper vs. electronic that bears repeating. As one of my sources points out...when a paper file is compromised it is probably read by a few people. When an electronic file is compromised, it can be read by thousands and perhaps millions.

All that said, we certainly do find that there are a great many positives about electronic health records, so we will look at a few.

A sizable majority of Americans believe electronic medical records have the potential to improve U.S. health care and that the benefits outweigh privacy risks, according to a 2007 Wall Street Journal Online/Harris Interactive poll (Bright).

The survey of 2,153 U.S. adults, conducted Nov. 12-14, 2007 shows three-quarters of respondents agree that patients could receive better care if doctors and researchers were able to share information more easily via electronic systems and 63% agree sharing of such records could decrease medical errors. Fifty-five percent agree this could reduce health-care costs, compared with 15% who disagree. However, about one-quarter of adults remain unsure whether electronic medical records can provide these benefits (Bright).

About one-fourth of respondents say they currently use some form of electronic medical record; most say the record is kept by their physician, while only 2% say they have created and maintain their own record and another 17% said they aren't sure whether they have such a record. Still, 91% of those polled say patients should have access to their own electronic records maintained by their physician.

Among those who have an electronic medical record, half say they are very confident that their physicians and other health-care providers have a complete and accurate picture of their medical history, compared with 27% of those who don't have electronic records (Bright).

But the use of electronic medical records has hit roadblocks over privacy concerns and doctors' resistance to the potential time and financial costs of transferring paper records online. And the latest poll indicates these privacy concerns remain: half of those surveyed say the use of electronic medical records makes it more difficult to ensure patients' privacy, down from 61% in a 2006 poll, while 25% disagree and another quarter say they aren't sure (Bright).

Recommendation for Healthcare Group, Doctor's Office, Hospital

There are evidence-based results to report on the use of an electronic health records system. In 2001, the senior administration at North Bay Healthcare Group decided to convert from a paper-based healthcare system to one that, as much as possible, was completely electronic. The fully integrated EHR improved their ability to track physician activity for re-credentialing purposes, documentation and completion of medical records. It also improved workflow and turnaround time for results. Much appreciated also was the elimination of the notorious cursive handwriting and subsequent need for interpretation (Denmark).

The integrated EHR throughout the system greatly enhanced the clinic provider's ability to monitor their patients while in the hospital. The hospitalist, consulting specialist and ED physician are now able to access the patient's office records while attending the patient in the inpatient setting. This enables them to see results of outpatient investigation and clinical management and reduce the duplication of expensive testing. Medication reconciliation and discharge prescribing become more efficient and safer with greater knowledge of current meds, past failed meds or potential drug-drug interactions from unlisted home meds missed on intake documentation on admission (Denmark).

Notably, the electronic system has worked brilliantly for this healthcare group and has made their lives easier, and medical practice far more effective and efficient. However, it must be noted that no mention was made in this report concerning any opinion about whether or not the physicians and staff felt that the security of the system was satisfactory. Evidently, they did?

Conclusion

Surprisingly, based on our research and the many statements and claims by various "experts" in the medical field, our answer to the subject question -- does utilizing electronic medical/health records increase patient safety (security) -- our answer would have to be "probably not." At least, no one has proved that it does to our satisfaction.

What is clear is that, due to the efficiencies of an electronic system, it seems some security concerns are being "brushed off" as inherent in any online system. However, never has such a massive and intensely personal, single, national electronic system been proposed, as President Obama has asked for.

The efficiencies and affectivity of such as system have been proven -- there is no doubt of that. The enormous government Veteran Affair's medical system has been using electronic patient files for many years without paper backup, and anyone who might witness it, stands in awe of its capacity, efficiency and simplicity. It works. If a patient at a VA medical clinic in one city ends up in a VA hospital in another city, his records -- all of them -- are available to that hospital with the touch of the ENTER key. but, again, what the government can't and won't say is that those electronic records are safe.

Finally, though we covered the expense of such a system in our research, it must be emphasized that the cost to smaller hospitals, medical facilities, healthcare groups, etc. To set up an electronic system and transfer all of their existing paper files, is nothing short of enormous. We mentioned some figures which back up that point.

To push headlong into an all-inclusive, national system of electronic medical files for virtually everyone in the U.S., without further empirical studies on security and unprecedented safeguards on the system, would be dangerous, if not disastrous.