Medical Records Use and Abuse Heidi Tranberg Research Associate Clinical and Biomedical Computing Unit University of Cambridge Jem Rashbass Director of Clinical and Biomedical Computing University of Cambridge Director of the Eastern Cancer Registry and Information Centre Boca Raton London New York CRC Press is an imprint of the Taylor & Francis Group, an informa business First published 2004 by Radcliffe Publishing Published 2018 by CRC Press Taylor & Francis Group 6000 Broken Sound Parkway NW, Suite 300 Boca Raton, FL 33487-2742 © 2004 by Heidi Tranberg and Jem Rashbass CRC Press is an imprint of Taylor & Francis Group, an Informa business No claim to original U.S. Government works ISBN-13: 978-1-85775-604-3 (pbk) This book contains information obtained from authentic and highly regarded sources. While all reasonable efforts have been made to publish reliable data and information, neither the author[s] nor the publisher can accept any legal responsibility or liability for any errors or omissions that may be made. The publishers wish to make clear that any views or opinions expressed in this book by individual editors, authors or contributors are personal to them and do not necessarily reflect the views/ opinions of the publishers. The information or guidance contained in this book is intended for use by medical, scientific or health-care professionals and is provided strictly as a supplement to the medical or other professional's own judgement, their knowledge of the patient's medical history, relevant manufacturer's instructions and the appropriate best practice guidelines. Because of the rapid advances in medical science, any information or advice on dosages, procedures or diagnoses should be independently verified. The reader is strongly urged to consult the relevant national drug formulary and the drug companies' and device or material manufacturers' printed instructions, and their websites, before administering or utilizing any of the drugs, devices or materials mentioned in this book. This book does not indicate whether a particular treatment is appropriate or suitable for a particular individual. Ultimately it is the sole responsibility of the medical professional to make his or her own professional judgements, so as to advise and treat patients appropriately. The authors and publishers have also attempted to trace the copyright holders of all material reproduced in this publication and apologize to copyright holders if permission to publish in this form has not been obtained. If any copyright material has not been acknowledged please write and let us know so we may rectify in any future reprint. Except as permitted under U.S. Copyright Law, no part of this book may be reprinted, reproduced, transmitted, or utilized in any form by any electronic, mechanical, or other means, now known or hereafter invented, including photocopying, microfilming, and recording, or in any information storage or retrieval system, without written permission from the publishers. Trademark Notice: Product or corporate names may be trademarks or registered trademarks, and are used only for identification and explanation without intent to infringe. Visit the Taylor & Francis Web site at http:/ fwww.taylorandfrancis.com and the CRC Press Web site at http:/ fwww.crcpress.com British Library Cataloguing in Publication Data A catalogue record for this book is available from the British Library. Typeset by Advance Typesetting Ltd, Oxford Contents Foreword iv About the authors vi Acknowledgements vii 1 Introduction 1 2 Is there a medical privacy crisis? 17 3 Is consent the answer? 29 4 Technology-saviour or villain? 51 5 Should different medical information be treated differently? 59 6 Accessing your own record 71 7 Research 87 8 Public interest 105 9 Legal proceedings - a threat to medical record privacy? 115 10 Anonymous information 131 11 Freedom of information 149 12 The best way forward 161 Index 169 Foreword It is always a relief when the information you need to address a problem arrives just in time. So it is with the timely publication of this book. The UK government has embarked on one of the world's most challenging IT projects - The National Programme for Information Technology - which will transform the delivery of healthcare across the National Health Service. Through the programme, patients will have a life-long electronic health record accessible from healthcare centres across the country and ultimately their own homes. The days of lost patient notes, repeated laboratory tests and unknown medication should become a thing of the past. With these changes will come significant opportunities and challenges for the way we handle medical records. We must ensure that the safeguards are in place to protect patient confidentiality and that when we need to use medical information for purposes not directly related to an individual's own medical care, such as health service planning, performance monitoring and research, it is undertaken in a transparent and appropriate way. This book provides the background and practical guide for all those of us who face these challenges. Written by a lawyer and a clinical informatician, it provides the fusion between the legal issues and the practical clinical ones. There are clear explanations of the current legal framework of the Data Protection and Freedom of Information Acts and the effects of Section 60 of the Health and Social Care Bill. These are set in the context of real-world applications; for example, there is guidance for those who need to develop consent forms for research or respond to requests from the public for healthcare information and there is extensive coverage of the rights of the patient who wishes to access their own records. Several of the more complex issues that have a significant impact on policy are also dealt with in depth. A chapter is devoted to the complexities of anonymising data, how this might be implemented, the benefits that can be achieved and challenges arising from pseudonymisation. There is informa­ tion for those involved in medical research and what they must do to guarantee that patients' rights are protected when they request or use clinical information. The background to 'consent' and the impact that implied and explicit consent can have on the way records are collected and used is particularly well covered. This book has many audiences, all of whom will gain from the easily accessible information within it. Caldicott guardians, research ethics committee Foreword V members, and all those researchers and clinicians who need to analyse patient information will have a particular need for this handbook. Patients and the public should use it to understand how their healthcare information is protected and used. Its arrival could not have come at a better time. Sir John Pattison Former Director of Research, Analysis and Information Department of Health March 2004 About the authors Heidi Tranberg trained in both law and psychology, and worked for a number of years as a solicitor in a leading Australian law firm, specialising in intellectual property, information technology, biotechnology and privacy. During this time she played a key role in developing the firm's health privacy website. Since joining the Clinical and Biomedical Computer Unit at Cambridge University, Heidi has been involved in a variety of projects, including research of health privacy issues, strategic planning and market­ ing activities, and the development of an electronic dyslexia-screening test. She has published several papers and articles on legal and ethical issues. Dr Jem Rashbass has a background in medicine, molecular biology and pathology. Since 1997 he has been Director of the Clinical and Biomedical Computing Unit at Cambridge University, a group responsible for de­ veloping novel computer applications in clinical teaching, practice and medical research. He is also the Director of the Eastern Cancer Intelligence Centre - providing cancer registration and analysis across the east of England, he holds an honorary consultant contract in histopathology at Addenbrooke's NHS Trust and is a Non-executive Director of the NHS Information Authority. Acknowledgements The authors greatly appreciate the assistance of a number of experts who generously shared their views and experiences on various issues discussed in the book. In particular, they would like to thank Professor Don Detmer and Baroness Onora O'Neill, both of the University of Cambridge; Marlene Winfield, Head of Patient and Citizen Relations at the NHS Information Authority; and Janine Brooks, a Caldicott Guardian at the NHS Information Authority. Chapter 1 Introduction Protecting the privacy of patient information is a major challenge facing the health sector. Today's patients expect, and are entitled by law to receive, a high standard of medical privacy. Given the complexity and function of the health system, however, it can be difficult to meet this expectation. Healthcare is an information-rich activity, in that it involves the collection, use and disclosure of large quantities of sensitive personal data. Such information is not only required by health professionals directly involved in patient treatment, but also the many groups who indirectly contribute to the delivery of quality healthcare. Administrators, policy makers, researchers, educators, public health bodies and auditors are just some of the groups that require access to patient data to ensure that high quality, cost-effective medical treatment is delivered in a timely and appropriate manner. Making this information available, without compromising patients' rights, is a com­ plex task. How have health privacy rights evolved? The right to personal privacy is not a new concept. It has been recognised for many years, and was even included in the 1948 United Nations Universal Declaration of Human Rights.1 Initially, however, the right to privacy was more concerned with protecting people from unwanted intrusions into their personal lives, rather than inappropriate disclosures of their personal data. As information came to play a larger role in society, this focus began to shift. The increased use of computers in the 1970s and 1980s brought new opportunities to store and analyse large volumes of data, and prompted interest in individuals' right to control the use and dissemination of their personal information, a right often referred to as 'informational privacy'.2 In light of the circumstances that caused this type of privacy to be recognised, in the UK protection was originally limited to data that