Paving the Way for Online Healthcare

2004-10-14

At one time, the sight of a doctor traveling for miles in a horse driven carriage to see an ailing patient was a common occurrence. These days, house calls are familiar only to those who watch black and white movies.  Driven by technology, health care has undergone a dramatic transformation over the last century. Yet, despite these many advances, the management of health records and patient information in Canada has remained largely unchanged.

Until now.

Doctors' offices overflowing with paper files may soon become a thing of the past. In their place, health reformers are advocating the nationwide implementation of Electronic Health Records (EHR). An EHR is an electronic patient file, available only to health care professionals through a secure network, which brings together key medical history and records of care within the health system.

The transition to online records is expected to save lives and money by ensuring that medical professionals have access to complete health records and patient information when and where it is needed. Systems of this type are already in use in many other countries and consultations about their use are taking place across Canada.

Alberta First to Log-on

In October of 2003, the Government of Alberta implemented Canada's first province-wide EHR. Since then, more than 7,000 health care professionals have logged on to the online system of patient records. To date, $65 million in provincial and national funding has been dedicated to the project, including individual grants to physicians to help them make the transition.

Dr. Harvey Sternberg, a family physician in Edmonton, took the necessary steps to link into the EHR when he moved his family practice to new facilities at the University of Alberta in December 2003.

"The Alberta EHR has given us a chance to do things we were not able to do before," says Sternberg.

"For example, I am now able to immediately view my patient's lab work. I can turn my monitor around in the examination room to review the results with my patient. I can look up any lab result over the last two years and immediately spot trends or values that have improved or deteriorated. This kind of evaluation would have to have been done manually in the past, digging through all the paper lab test records. It has enabled me and my colleagues to make better decisions and provide better care."

Doctors and nurses working in hospitals have also noted the lifesaving potential of the system in cases where patients arrive in the emergency room either unconscious or unable to respond to questions. With EHR in place, the patient's file can be consulted immediately to check for any serious medical conditions or drug allergies before a treatment is determined. Pharmacists note that the system has also helped minimize potentially dangerous drug interactions as well as alleviating the age old problem of doctors' illegible handwriting.

EHR definitely has many supporters in Alberta, but like many new technologies it also comes with its own set of complications. In this case, the ultra-personal nature of health records has made concerns about maintaining security in the system paramount.

Navigating Privacy Potholes

"How safe is my personal information, who has access to the data, and how is it being protected from misuse?"

These are a couple of the most common questions raised by both patients and health care professionals according to Brian Hamilton, Manager of Privacy and Security, Alberta Health and Wellness. He says these issues were front and centre throughout the design of the system.

To maintain patient confidentiality, access to the EHR network is restricted to registered health care providers. Each user in the system is assigned a unique identification number and an electronic tag – which allows them to access only information relevant to their jobs. For example, a pharmacist accessing the system sees only a patient's pharmaceutical information. Although Albertans cannot opt out of having their files included in the system, in some cases extremely sensitive information can be masked from users.

Despite the high level of security built into the system, Hamilton acknowledges that computer technologies are not foolproof. At the same time, he says that EHR actually offers some security benefits over the current records system.

"In the paper world, a doctor, maybe the receptionist and the nurse would be looking at a record in a physician's office. In the electronic world, portions of the record are now available to potentially thousands of people so you do have an increased risk there. On the other hand, in the electronic world we have logs for everybody's use of the record so we can tell if someone has looked at a record inappropriately. We can tell if it has been modified. This is much more difficult to do with paper files," says Hamilton.

A Standard Solution for Steering Information Security

Among the tools being used to address system security and meet the strict patient privacy provisions in Alberta's Health Information Act is a leading international standard for information security - ISO/IEC 17799:2001 Information technology, Code of practice for information security and policy.

The standard sets out guidelines for developing organizational security requirements and effective security management practices for any type of information that is collected and stored online. Published as an international standard in December 2000, ISO/IEC 17799 was adapted from a British national standard. [1]

In the case of the Alberta EHR program, the IT security standard has not been implemented in its entirety, but Hamilton says they are aiming for full compliance by 2006. In the meantime, the Alberta government and its partners have used the standard as an important starting point for assessing the risks and threats within the system. Based on this analysis, some minimum security requirements have been identified for regional health authorities (which include: hospitals, continuing care facilities, community health services and public health programs) as well as individual doctors offices, and pharmacies prior to being given access to the EHR. 

Hamilton says Alberta is also interested in the outcome of a Canadian-led initiative to develop an adaptation of the IT standard specifically for health care. The new standard would address the unique ethical issues involved with medical record keeping and use terminology that could be more easily understood by health care professionals. This work is being undertaken by a working group of the International Organization for Standardization's (ISO) Technical Committee on Health Informatics (TC 215).

Standards for Health Records Security and Beyond

While standards have an important role to play in protecting the security of information and patient privacy, they will be equally important in other aspects of EHR as Canada continues to move in the direction of electronic record management. The Canada Health Infoway [2] is leading standards development work in this area. Together with stakeholders, it has identified a number of areas for future standards development. To address these requirements, CHI has created an EHR Standards Steering Committee that includes stakeholders from all provinces and territories. The Standards Council of Canada has also accepted an invitation to participate.

The opportunities for standards in the changing health care environment are endless, agrees Marc-Andre Léger, an expert in the area of health informatics and an active participant in Canadian and international standards development work on IT security and privacy and, health informatics.

He says that as new information technologies are integrated into the health care system there will undoubtedly be increased needs for corresponding standards, but he notes that in many cases, instead of starting from scratch, Canadians will be able to use international standards or adapt standards that were developed for these purposes by other countries.

The role of information technology in all aspects of health care will only continue to grow predicts Léger. As evidence, he points to the increasing number of doctors and nurses who are enrolling in graduate studies in the field of health informatics at Canadian universities. He adds that this mentality will be even more evident with the next generation of health professionals.

"Look at kids today," says Léger. "Twelve and 13-year-olds already have so much IT expertise. Yet, they are not all going to go into IT. They will go into other fields, and some of them are going to become doctors and nurses."

---

[1] ISO/IEC 17799:2000 was developed by the subcommittee on IT security (SC 27) of JTC1, a joint committee of the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) that develops international IT standards.

[2] Canada Health Infoway (CHI) is corporation that was created in response to a federal/provincial/territorial agreement in September 2000 on the need to accelerate the development of electronic health information systems . It invests  in public  and private sector initiatives in the area of health informatics. Website: http://www.infoway-inforoute.ca/.

-30-

This article first appeared in Volume 31 of CONSENSUS Magazine, 2004.  The information it contains was accurate at the time of publication but has not been updated or revised since, and may not reflect the latest updates on the topic.  If you have specific questions or concerns about the content, please contact the Standards Council of Canada.

Back