An Electronic Medical Records (EMR) system is a paperless charting system in which patient Personal Health Information (PHI) is inputted (“charted”) into a device such as a desktop computer, laptop or tablet PC. The details of the patients’ PHI is stored on a server, so that the physician (or other provider) in the practice can access the records at a future time. After the hurdle of implementation, an EMR system can streamline a practice’s workflow. Office staffs no longer have to search for paper charts that too often end up misfiled or left on a physician’s desk. There are times when privacy rights are violated when charts are left in areas in pubic areas of medical practices (such as the checkout desk.) Since computers take up less space than thousands of paper charts, it is seemingly easier to keep them secure and private. Offices will no longer have to store seven years worth of paper charts, thus saving money spent on off-site storage facilities. Practices will also have the flexibility to use their in-practice office space for other purposes, such as adding more exam rooms. Furthermore, practices will not have to pay shredding companies to destroy their charts anymore; this means fewer eyes will see patient charts.
Implementing EMR technology will also help health care providers treat illnesses, diseases and injuries better. For example, if a patient with a drug allergy becomes unconscious in an automobile accident and is rushed to a hospital emergency room, the staff at the hospital will know not to treat the patient with the particular drug when and if EMR databases are linked and become accessible to other healthcare providers and facilities. Patient medication lists can be accessed by multiple healthcare providers and pharmacies thus reducing the risk of drug interactions. This will lead to a reduction of errors and hopefully improve physicians’ ability to practice medicine. The increased flow of health information should be a benefit to patients, but when information is passed via computer networks there is always the risk of it being intercepted. While EMR system vendors speak of all the benefits of EMR systems, and practices look forward to great efficiency, many critics bring up the risks regarding patient records and privacy.
Implementing an EMR system is no longer a choice for most practices, it is mandatory. The Centers for Medicare and Medicaid (CMS) will begin to decrease health care providers’ reimbursements in the year 2015 by up to 3 percent if they have not adopted a Certification Commission for Health Information Technology (CCHIT) Certified EMR system by the year 2014. Healthcare providers also have an incentive to implement EMR systems early. The federal government has provisioned financial incentives to healthcare providers in the American Recovery and Reinvestment Act of 2009 to adopt EMR systems. A provider can receive $44,000 dispersed over five years starting in 2011 for implementing the “meaningful use” of a CCHIT certified EMR system (Zieger.) Between the three percent penalty and the financial incentive medical practices have good reason to roll out this new technology. But with this requirement to implement EMR systems, medical practices are still also required to protect patients’ PHI, which comes at a financial cost to practices. Practices need to set up hardware and software (VPN’s, firewalls etc.) to ensure that PHI is protected. Smaller practices do not have internal IT support staff, and they will have spend financial resources outsourcing consultants to implement this security, or hire on-staff IT support.
A value largely at play in the center of the implementation of EMR technology is the value of (patient) privacy. The Merriam-Webster Online Dictionary defines privacy as “the quality or state of being apart from company or observation.” When it comes to patients and their PHI, most patients want and are guaranteed the right to privacy by laws and medical standards. A more contextualized definition of privacy as it relates to computer information is “the ability of an individual to control the terms under which their personal information is acquired and used” (Ackerman.) Patients would expect that their PHI is used to treat their diseases and illness, but many may have issues with such information being used to market products to them, such as pharmaceuticals. Furthermore, patients would universally oppose to their information being used to embarrass them or be the cause of discrimination against them in the case that their information was leaked or intercepted.
There are different varieties of privacy, such as physical privacy (being apart from company) and the type of privacy that is relevant in the domain of EMR’s, informational or data privacy. People want and need to protect personal information about themselves, everything from their financial information to information about their family history. In the United States, patients are accustomed to their privacy about medical conditions and lifestyles being protected by the doctor-patient privilege. Patients expect that the information they disclose to their healthcare provider will be kept private for a variety of reasons. It may range from a patient not wanting the community to know their sexual orientation to a patient worrying about an “embarrassing” condition that may damage their reputation or bar them from being hired. Humans desire to control their personal information, including PHI. The guarantee of privacy also plays a large factor in practicing medicine, due to the fact that if a patient’s information is not protected, the patient would be less likely to be honest with their healthcare provider which could lead to the patient being misdiagnosed or mistreated for a disease or condition.
In their chapter in The Human-Computer Interaction Handbook, Batya Friedman and Peter H. Kahn, Jr. state that as computer technology grows and continues to collect data about people and store it in databases our privacy is decreasing (1253.) EMR systems are doing exactly what Friedman and Kahn describe; EMR’s collect data about patients and store them on databases. Guidelines do exist to protect such databases in medical practices, but they are often vague. Too often we hear stories in the media about large cooperation’s databases being compromised by computer hackers. In 2007, TJX, the parent company of TJMaxx had over 45 million credit card numbers stolen from its computer systems (Greenemeier.) If large corporations are vulnerable to attack, then it is clear that medical practices are vulnerable also. Small and rural practices are being mandated to implement the same costly EMR systems that large practices with more resources are. They are mandated to provide the same security that is necessary to protect their patients’ privacy, which is expensive. As some EMR implementations happen on aggressive timelines, it can be expected that some security measures may be overlooked or not implemented correctly.
Privacy is just not a concern in the area of databases and servers, but it also needs to be protected in the physicians’ offices and exam rooms. PHI should not only be protected from would-be hackers and unsavory individuals attacking EMR databases, but PHI should also be shielded from other parties physically present in medical practices. This could be anyone from a nosy family member to a vendor the medical practice has hired to clean the office carpets. Much like how paper medical records need to be kept in a locked area, a patient’s EMR needs to be protected behind a locked computer. Guidelines exist for this example too; computers must be locked when not in use.
There are a variety of parties who are affected my EMR technology. Both the direct and indirect stakeholders have a lot to gain, and in turn lose (in the area of privacy) from the implementation of EMR systems. The direct stakeholders are the parties that actively use the systems, which are physicians, nurses, technicians and medical practice/hospital office staff including reception, clerical and billing personnel.
Direct Stakeholders:
Physicians (also Physician Assistants and Nurse Practitioners): This group of stakeholders has to be confident that their selected EMR technology can effectively chart their patient’s ailments and progress. A physician has to have a lot of “faith” that a particular system will not only accurately record patient data, but it also needs to be done in a way that insurance payers will accept and give the medical provider reimbursement for services rendered. Doctors swear by the Hippocratic Oath to respect privacy, and a medical record, in whatever form in is in should be protected as well.
Other medical staff (Nurses/Technicians/Scribes): Physicians often rely on the work of nurses and technicians. This can range from the documenting of patient history, to performing diagnostic tests for the physician to interpret. Also, there are physicians who rely on medical scribes to input the data into the EMR system’s interface for them. These staff members are often in and out of exam and testing rooms and need to be aware that any information left appearing on a computer screen on an unattended terminal may be seen my a party who is unauthorized to see it.
Clerical/office/billing staff: This group represents another set of direct users/stakeholders of EMR systems. These parties do not document PHI, but they spend time setting appointments, sending letters to referring physicians and entering/inspecting charges that will be submitted to insurance companies. These parties often control when and who PHI is sent to outside of the confines of the particular medical facility. This is an area where privacy can be violated, since there is still a chance that a medical record or report can be sent to the wrong place, much as it could be faxed to the wrong number in “the old way” of doing things.
Indirect stakeholders:
Patients: According to Friedman et al., many EMR systems have been designed without considering patient privacy (Friedman 361.) Giving this group the label of an “indirect stakeholder” should not take away the fact that this group of people is probably the most important group when it comes to EMR systems and PHI. In the past, patient records were stored in a paper chart inside a secured building. Now and going into the future, records are being stored on servers that could be accessed or violated by someone in a remote location 24 hours a day, 7 days a week. This raises a red flag for many individuals as well as privacy advocates. But according to a study released in the spring of 2009, most patients are willing to make some concessions when it comes to their privacy in order to make their PHI more accessible with the goal of better healthcare due to greater transparency (Merrill.) As computing becomes more ubiquitous, it seems that most patients are accepting of allowing technology into this very private part of their lives. Health and money are two guarded facets of peoples’ lives. For some time people have been managing their bank accounts, investments and often trade on financial markets via computing systems.
Insurance companies: The final indirect stakeholder discussed here is the insurance company. Insurance companies do not have the ability to work in or make changes to a patient’s record in a practice’s EMR, but they will view records from such a system, and receive claims for reimbursement. Medical practices look forward to the possibility of a more efficient work cycle after the adjustment to an EMR system. After all, this is a large marketing point EMR sales teams make. Insurance companies have the same feelings that the workflow will be more efficient. An EMR patient visit does not need to be scanned and faxed or snail mailed to an insurance carrier if they request to see a patient’s record. Insurance companies will have quicker access to patent records, thus being able to pay or decline a claim quicker than ever. EMR charts are also “signed & sealed” by a healthcare provider. This means that a provider or other individual cannot make changes to a particular office visit on a later date and this can help decrease fraudulent health insurance claims.
Works Cited:
Ackerman, M., & Mainwaring, S. (2005). “Privacy Issues in Human-Computer Interaction.” In Security and Usability: Designing Secure Systems That People Can Use. L. Cranor & S. Garfinkel Eds. Sebastopol, CA: O’Reilly, 381-400.
Friedman, B., & Kahn, P. H., Jr. (2007). “Human values, ethics, and design.” In The Human-Computer Interaction Handbook: Fundamentals, Evolving Technologies and Emerging Applications, 2nd Edition. Sears, A. & Jacko, J. Eds. New York, NY: Lawrence Erlbaum, 2007, 1241-1266.
Friedman, B., Kahn, P. H., Jr., & Borning, A. (2006). “Value Sensitive Design and information systems.” In Human-Computer Interaction in Management Information Systems: Foundations. P. Zhang & D. Galletta Eds. Armonk, New York: M.E. Sharpe. 348-372.
Greenemeier, Larry. “T.J. Maxx Parent Company Data Theft Is The Worst Ever.” Internet (2007)
Available: http://www.informationweek.com/news/security/showArticle.jhtml?articleID=198701100. Oct 2009.
Merrill, Molly. “Study Reveals Patients' Attitudes Toward EMR Conversion.” Internet.
Available:
http://www.healthcareitnews.com/news/study-reveals-patients-attitudes-toward-emr-conversion. Oct. 2009
Zieger, Anne. “Health IT stimulus Includes Medicare EMR Incentives.” Internet. (2009)
Available: http://www.fiercehealthit.com/story/health-it-stimulus-includes-medicare-emr-incentives/2009-02-23?utm_medium=rss&utm_source=rss&cmp-id=OTC-RSS-FHI0. Oct. 2009.
Subscribe to:
Post Comments (Atom)
No comments:
Post a Comment