EHR access rights and the role of the patient

Abstract

Background: The amount of patients being treated beyond the borders of one institution in so-called shared care models has constantly increased over the last years. This development led to a substantial amount of EHR (Electronic Health Record) projects aiming to facilitate those shared care processes. An essential requirement for the introduction of an EHR is an access right concept fulfilling simultaneously all regional and national data privacy requirements in order not to violate the patient’s rights as the requirements of all participating partners. Objectives: The scope of this paper is to examine whether and if how a generally applicable access concept could be designed that fulfils all above mentioned requirements and is at the same time implementable with the existing capabilities offered by the IT systems. Methods: Results of a requirements analysis were used to examine how patient, care provider, and data privacy requirements can be fulfilled with the existing technical possibilities to manage access rights. Results: It could be demonstrated that there is no access concept fulfilling all requirements. Conclusions: There are only two possible solutions for the dilemma: a) to completely abstain from a sophisticated access rights management or b) to focus on the patient and give him the full ownership of his data and empower him to manage the access rights. Considering the currently occurring strong shift towards “personalized medicine” and the inclusion of an increasing amount of genetic information in clinical documentation we strongly believe that the latter option is the preferable one, finally leading to the conclusion that PHR (Personal Health Records) are preferable compared to EHR (Electronic Health Records).