Your medical records were stolen! Quick, blame EMR!
Once I read that the US Department of Health and Human Services had posted a list of confidentiality breaches, I was curious to see the extent of the problem. I had recently read the results of an AAPS survey, which suggested that a clear majority of physicians distrust Electronic Health/Medical Records (EMR/EHR) for privacy reasons. I wanted to understand if their concerns were justified, or not.
Most physicians are concerned that third parties will be able to access EMR. Rightly, they are concerned that doctor-patient confidentiality should be preserved, and without physical possession of a file, they lack control. Some clinicians store information on their personal computers, but are concerned about losing control of the data once it goes into a central repository. Are they right to be concerned?
The extent and nature of medical records breaches
The HHS website web-page only lists incidents where 500+ individuals have been affected by a breach. There have been nearly 40 of these between 09/2009 and 01/2010. That’s a lot! I can only imagine that there are hundreds or thousands of smaller breaches. It’s impossible to say what’s been done with the data. So privacy concerns are justified.
How were medical records breached?
Since this website was mandated by the HITECH act, I fell into the trap of assuming that all the breaches were from central EMR systems. They’re not:
- Theft/loss of paper records: 8 cases
- Theft/loss of personal computer: 20 cases
- Theft associated with EMR (hack, theft of backup-tapes/hard-drives): 5 cases
- Miss-directed email: 2 cases
It does make sense that since laptops and PDA have intrinsic value, they are more likely to be stolen than paper. So clinicians shouldn’t store any medical records on them. If clinicians do have computer files on patients, they should keep the data in the data center, under lock and key.
It’s hard to draw conclusions from such a small sample, and it will be interesting to see if a trend develops. Are people more likely/capable of stealing paper records than EMR?
-IainR
Sr. Marketing Manager – The BI Builders