Lessons from the central Hampshire electronic health record pilot project: issues of data protection and consent
http://www.100md.com
《英国医生杂志》
1 Hampshire and Isle of Wight Strategic Health Authority, Southampton SO16 4GX, 2 East Surrey Health Informatics Service, Surrey and Sussex Strategic Health Authority, West Park Hospital, Epsom, Surrey K19 8PB, 3 Winchester and Eastleigh Healthcare Trust, Winchester, Hampshire SO22 5DG
Correspondence to: T Adams trina.adams@hiowha.nhs.uk
Introduction
The central Hampshire electronic health record pilot project was supported from September 2000 to March 2003. During that time it evaluated the practicality of linking records from a wide range of organisations to support emergency and out of hours care, as well as providing information that could support data analysis and clinical governance.
The project, originally based at North and Mid-Hampshire Health Authority, linked with several key organisations within the area, which included three general practices (one in Eastleigh and Test Valley South primary care trust and two in Mid-Hampshire primary care trust), Winchester and Eastleigh Healthcare Trust, Hampshire Ambulance NHS Trust, Hampshire and Isle of Wight NHS Direct, and Hampshire social services.
Summary points
A pilot electronic health record project linked patient records from five settings
A solution to issues of patient confidentiality and consent was developed through discussion with several bodies
Feedback to a public information campaign indicated that most people supported linked medical records
Only 10 patients in the pilot population wanted to restrict access to their records
Few resources are needed for a help desk and the mechanism for viewing electronic records
The withdrawal of some records from the electronic health record is unlikely to damage its usefulness for clinical care
The two out of hours cooperatives for Winchester were also part of the original plan but were dissolved part way through the project. The deputising service which took over responsibility for out of hours cover could not participate during the life of the project but would like to be involved in a future extension.
The technical solution
Extracts of patient information from the various feeder systems were designed to update the master patient index on a daily basis (figure). The index had been populated using the main NHS register (the Exeter system—organisational links extract), the Winchester and Eastleigh Trust master patient index, and the social services client index. When clinical data were sent to the electronic health record, the master index checked for an NHS number in the source record. If this was available the document was passed to the repository. If the number did not exist, the record went through a matching algorithm using first name, surname, date of birth, postcode, first line of address, general practice, and doctor's name to see if it could be matched to an individual record in the repository. Any unmatched records were excluded from the live system but retained for potential matching.
Feeder systems making up the central Hampshire electronic health record pilot project
Data streams from the hospital were extracted using an interface engine (www.seebeyond.com). New-church (www.newchurch.co.uk), a consultancy working with healthcare organisations, provided a facility for extraction of general practice records.
The patient records were then incorporated as documents into a virtual case note, which was accessible securely on computers with an NHSNet connection and internet browser. This provided access to all available information on that patient. To enable access to these records, user identities, passwords, and training were provided for 31 clinical staff in the general practices, ambulance command and control, NHS Direct, out of hours social services, and Winchester Hospital accident and emergency department and the emergency medical assessment unit. A separate structured database was constructed for the analysis of records for clinical governance.
Data protection and patient consent
Two leaflets were written for patients; one described the uses of health records and the other described the project (see bmj.com). These were delivered to 80 000 households (225 000 residents) in central Hampshire.
Leaflets were also placed in all the local general practices and Winchester Hospital outpatients and accident and emergency departments, as well as libraries, county council offices, and dental surgeries.
Box 1: Set of actions agreed by groups involved in project
Send out leaflets on use of health information and the project to all households within the pilot area, giving contact points for more information, supported by advertisements in the local press
Provide the same leaflets along with posters for display in, for example, surgeries, hospital outpatients, accident and emergency departments, libraries, county council offices
Enable patients to have their records excluded from the electronic health record
Provide a help desk based at NHS Direct to answer queries on the project, register patient's instructions about whether their records should be included, and provide an opportunity for patients to review their records
Provide a website with information on the project, and enable visitors to record their views about the project and confidentiality (www.chehr.org.uk)
Ensure that, whenever practical, patients are asked for their consent before the record is accessed
Set up a clinical committee with representation from all participating organisations with the remit of determining which types of staff should have access to which types of information
Restrict the extract from the general practice record to coded data only, excluding all free text comments and annotations
Box 2: Range of patients' views
"In view of the concerns over an appropriate level of consent it was essential to get the level of information absolutely right. I am very concerned about the level of transparency and openness and the desire to really communicate with the public"
"This is information sharing by default and therefore a substantial and scary erosion of the confidential doctor-patient relationship"
"In summary, the aims of the project are good... but I believe the implementation is very misleading and may well be illegal under the DPA "
"Press on regardless, and save money by using EHR in all cases. Stop all this pussyfooting about!"
"Some of the objectives are excellent and the website is a much better demo of the virtues of the project—but many people will not be able to access this"
"I think it should be accessed by suitable staff without having to ask the patient each time. I would prefer to give a once only `yes' and then medical staff get on with reading what they like. How about having a small patient `write in' box, so the patient can put in a few relevant words—maybe a tick box to say the patient give permission without having to ask each time?"
NHS Direct helpline
The project's website received 1306 hits during the six month evaluation period, but of these only 20 questionnaires that provided feedback were completed. This is a low response rate and suggests that most visitors did not have strong enough views. It also renders interpretation of the results difficult.
Of those who did respond, almost half thought there was sufficient information on the site to allow them to make an informed decision, and a further quarter gave an equivocal response, leaving one third unsatisfied. Only one tenth thought that the site had not helped them to see the benefits of an electronic health record.
Four respondents thought that information sharing in the NHS was not a good idea and that the project was not doing a good job. These views were not shared by the remaining 16 respondents.
Only 12 of the respondents chose to comment (box 2). The range of views might be expected from those who had sufficient motivation to access the website and to respond to the questionnaire, but given such a low response rate, it is impossible to extrapolate from these findings.
Excluding records
One of the objectives of the central Hampshire electronic health record project was to test the usability of patient records to support analysis and the provision of statistical data. To address the concerns over data protection and patient consent, the records were anonymised. However, to enable linkage of records for the same patient it was necessary to use unique identifiers. The NHS number was encrypted and the encryption algorithm held securely by the system manager.
These arrangements satisfied the Caldicott guardians of the organisations contributing data. In addition, analyses identifying individual clinical staff or specific organisations were not released without consent.
Confidentiality and patient consent
Information for health. Birmingham: NHS Information Authority, Sept 1998.
Building the information core: implementing the NHS plan. Birmingham: NHS Information Authority, 2002.
Use and disclosure of health data: guidance on the application of the data protection act 1998. Wilmslow, Cheshire: Information Commissioner, May 2002.
Chalmers J, Muir R. Patient privacy and confidentiality. BMJ 2003;326: 725-6.
The South Staffordshire patient consent project: findings from the EHR awareness campaign. Jun 2002. www.nhsia.nhs.uk/erdip/pages/evaluation/docs/polsprotreports/staffspublicawarenesscampaignresults.pdf (accessed 23 Mar 2004).
Share with care. Birmingham: NHS Information Authority. Oct 2002. www.nhsia.nhs.uk/confidentiality/pages/docs/swc.pdf (accessed 23 March 2004).
National programme for information technology, integrated care records service part III: common requirements, output based specification. Version 2.0. Aug 2003. www.dh.gov.uk/PolicyAndGuidance/InformationTechnology/NationalITProgramme/NationalITProgrammeArticle/fs/en?CONTENT_ID=4071618&chk=FzV2Cm (accessed 23 Mar 2004).
www.dh.gov.uk/PolicyAndGuidance/InformationTechnology/PatientConfidentialityAndCaldicottGuardians/Caldicott/ProtectionAndUsePatientInformation/fs/en?CONTENT_ID=4015627&chk=rdaggG (accessed 23 Mar 2004).(Trina Adams, clinical sys)
Correspondence to: T Adams trina.adams@hiowha.nhs.uk
Introduction
The central Hampshire electronic health record pilot project was supported from September 2000 to March 2003. During that time it evaluated the practicality of linking records from a wide range of organisations to support emergency and out of hours care, as well as providing information that could support data analysis and clinical governance.
The project, originally based at North and Mid-Hampshire Health Authority, linked with several key organisations within the area, which included three general practices (one in Eastleigh and Test Valley South primary care trust and two in Mid-Hampshire primary care trust), Winchester and Eastleigh Healthcare Trust, Hampshire Ambulance NHS Trust, Hampshire and Isle of Wight NHS Direct, and Hampshire social services.
Summary points
A pilot electronic health record project linked patient records from five settings
A solution to issues of patient confidentiality and consent was developed through discussion with several bodies
Feedback to a public information campaign indicated that most people supported linked medical records
Only 10 patients in the pilot population wanted to restrict access to their records
Few resources are needed for a help desk and the mechanism for viewing electronic records
The withdrawal of some records from the electronic health record is unlikely to damage its usefulness for clinical care
The two out of hours cooperatives for Winchester were also part of the original plan but were dissolved part way through the project. The deputising service which took over responsibility for out of hours cover could not participate during the life of the project but would like to be involved in a future extension.
The technical solution
Extracts of patient information from the various feeder systems were designed to update the master patient index on a daily basis (figure). The index had been populated using the main NHS register (the Exeter system—organisational links extract), the Winchester and Eastleigh Trust master patient index, and the social services client index. When clinical data were sent to the electronic health record, the master index checked for an NHS number in the source record. If this was available the document was passed to the repository. If the number did not exist, the record went through a matching algorithm using first name, surname, date of birth, postcode, first line of address, general practice, and doctor's name to see if it could be matched to an individual record in the repository. Any unmatched records were excluded from the live system but retained for potential matching.
Feeder systems making up the central Hampshire electronic health record pilot project
Data streams from the hospital were extracted using an interface engine (www.seebeyond.com). New-church (www.newchurch.co.uk), a consultancy working with healthcare organisations, provided a facility for extraction of general practice records.
The patient records were then incorporated as documents into a virtual case note, which was accessible securely on computers with an NHSNet connection and internet browser. This provided access to all available information on that patient. To enable access to these records, user identities, passwords, and training were provided for 31 clinical staff in the general practices, ambulance command and control, NHS Direct, out of hours social services, and Winchester Hospital accident and emergency department and the emergency medical assessment unit. A separate structured database was constructed for the analysis of records for clinical governance.
Data protection and patient consent
Two leaflets were written for patients; one described the uses of health records and the other described the project (see bmj.com). These were delivered to 80 000 households (225 000 residents) in central Hampshire.
Leaflets were also placed in all the local general practices and Winchester Hospital outpatients and accident and emergency departments, as well as libraries, county council offices, and dental surgeries.
Box 1: Set of actions agreed by groups involved in project
Send out leaflets on use of health information and the project to all households within the pilot area, giving contact points for more information, supported by advertisements in the local press
Provide the same leaflets along with posters for display in, for example, surgeries, hospital outpatients, accident and emergency departments, libraries, county council offices
Enable patients to have their records excluded from the electronic health record
Provide a help desk based at NHS Direct to answer queries on the project, register patient's instructions about whether their records should be included, and provide an opportunity for patients to review their records
Provide a website with information on the project, and enable visitors to record their views about the project and confidentiality (www.chehr.org.uk)
Ensure that, whenever practical, patients are asked for their consent before the record is accessed
Set up a clinical committee with representation from all participating organisations with the remit of determining which types of staff should have access to which types of information
Restrict the extract from the general practice record to coded data only, excluding all free text comments and annotations
Box 2: Range of patients' views
"In view of the concerns over an appropriate level of consent it was essential to get the level of information absolutely right. I am very concerned about the level of transparency and openness and the desire to really communicate with the public"
"This is information sharing by default and therefore a substantial and scary erosion of the confidential doctor-patient relationship"
"In summary, the aims of the project are good... but I believe the implementation is very misleading and may well be illegal under the DPA "
"Press on regardless, and save money by using EHR in all cases. Stop all this pussyfooting about!"
"Some of the objectives are excellent and the website is a much better demo of the virtues of the project—but many people will not be able to access this"
"I think it should be accessed by suitable staff without having to ask the patient each time. I would prefer to give a once only `yes' and then medical staff get on with reading what they like. How about having a small patient `write in' box, so the patient can put in a few relevant words—maybe a tick box to say the patient give permission without having to ask each time?"
NHS Direct helpline
The project's website received 1306 hits during the six month evaluation period, but of these only 20 questionnaires that provided feedback were completed. This is a low response rate and suggests that most visitors did not have strong enough views. It also renders interpretation of the results difficult.
Of those who did respond, almost half thought there was sufficient information on the site to allow them to make an informed decision, and a further quarter gave an equivocal response, leaving one third unsatisfied. Only one tenth thought that the site had not helped them to see the benefits of an electronic health record.
Four respondents thought that information sharing in the NHS was not a good idea and that the project was not doing a good job. These views were not shared by the remaining 16 respondents.
Only 12 of the respondents chose to comment (box 2). The range of views might be expected from those who had sufficient motivation to access the website and to respond to the questionnaire, but given such a low response rate, it is impossible to extrapolate from these findings.
Excluding records
One of the objectives of the central Hampshire electronic health record project was to test the usability of patient records to support analysis and the provision of statistical data. To address the concerns over data protection and patient consent, the records were anonymised. However, to enable linkage of records for the same patient it was necessary to use unique identifiers. The NHS number was encrypted and the encryption algorithm held securely by the system manager.
These arrangements satisfied the Caldicott guardians of the organisations contributing data. In addition, analyses identifying individual clinical staff or specific organisations were not released without consent.
Confidentiality and patient consent
Information for health. Birmingham: NHS Information Authority, Sept 1998.
Building the information core: implementing the NHS plan. Birmingham: NHS Information Authority, 2002.
Use and disclosure of health data: guidance on the application of the data protection act 1998. Wilmslow, Cheshire: Information Commissioner, May 2002.
Chalmers J, Muir R. Patient privacy and confidentiality. BMJ 2003;326: 725-6.
The South Staffordshire patient consent project: findings from the EHR awareness campaign. Jun 2002. www.nhsia.nhs.uk/erdip/pages/evaluation/docs/polsprotreports/staffspublicawarenesscampaignresults.pdf (accessed 23 Mar 2004).
Share with care. Birmingham: NHS Information Authority. Oct 2002. www.nhsia.nhs.uk/confidentiality/pages/docs/swc.pdf (accessed 23 March 2004).
National programme for information technology, integrated care records service part III: common requirements, output based specification. Version 2.0. Aug 2003. www.dh.gov.uk/PolicyAndGuidance/InformationTechnology/NationalITProgramme/NationalITProgrammeArticle/fs/en?CONTENT_ID=4071618&chk=FzV2Cm (accessed 23 Mar 2004).
www.dh.gov.uk/PolicyAndGuidance/InformationTechnology/PatientConfidentialityAndCaldicottGuardians/Caldicott/ProtectionAndUsePatientInformation/fs/en?CONTENT_ID=4015627&chk=rdaggG (accessed 23 Mar 2004).(Trina Adams, clinical sys)