Electronic Patient Records - Who should access what?
- Doctors’ view
Catarina Pinho,/ Catarina Sá,
/ Edite Mendes,
/ Emanuel Santos,
Fátima Silva,
/ Filipa Sousa,
/ Filipe Gomes,
/ Fernando Abreu,
Fernando Mota,
/ Francisca Aguiar,
/ Francisco Faria,
/ Francisco Macedo,
Simão Martins,
Adviser: Ana Margarida Ferreira, , Class: 8
Abstract
Introduction: Good communication between health providers is an essential component of high quality health care. The use of Electronic Patient Records (EPR) nowadays requires careful access control, which greatly depends on people’s objective when using it.
Aim: Use of EPR can potentially improve the quality of health care, but little is known about doctors’ attitudes toward access control to EPR. The purpose of this study is to evaluate the opinions of medical doctors towards who can access Electronic Patient Records, depending on the doctor’s role within the healthcare institution.
Methods: This study is an observational, transversal and descriptive one which target population was doctors. Initially, we performed a bibliographic search of publications concerning access control to Electronic Patient Records. Our sample was a simple randomized one, taking part of it 58 doctors working at Hospital São João, Oporto, Portugal. Then we applied a questionnaire previously tested to doctors, so our unity of analysis was the individual. Finally we inserted the results into the SPSS software and analyzed them.
Results: All the responders used, in fact, the EPR. Most of them agree with the existence of different levels of access to information. More than an half confirmed that, in their opinion, doctors shouldn’t have access to total information of their patients. A great rate agreed that sensitive information as HIV tests should only be accessed by doctors who treated those patients. In what concerns nurses, almost all doctors do not agree with their full access to EPR. Most doctors agree with other uses to EPR as investigation, being epidemiological investigation the one that had more rate of agreement. The majority of doctors think that patients shouldn’t have total access to their clinical information. Some relations between variables were also performed, using 0.05 as the significance level (with a=95%).
Discussion: The majority of doctors’ sees the importance of access control to EPR and agrees with the existence of some access’ limitations to health professionals .We concluded that they are mostly concerned with situations regarding sensitive information (e.g. HIV tests), and patients’ access to their health records. Doctors were reluctant in what concerns nurses’ access to the information of all patients. Their attitudes towards the use of information for other purposes were mostly positive.
Key words: Electronic Patient Records, access control, physicians, questionnaire.
Introduction
Good communication between health providers is an essential component of high quality health care. [1] Paper-based medical record is widely used in hospitals, where health professionals gather patient’s clinical and administrative information, but because of the disadvantages they present comparing to a computer-based medical record, they are being extensively replaced. [2]
The evolution of technology now allows health providers to communicate electronically to obtain information which includes patient’s health story, examination findings, diagnosis and treatment over a period of time. [1] [3]
This enabling technology that constitutes the informational basis for communication and cooperation in and between healthcare organizations is called Electronic Patient Records (EPR). [4]
However, this wide use of information systems and technologies shows the need for healthcare organizations to integrate and manage information from various sources, types and formats. This reflects the careful scrutiny that electronic access to medical information requires. [5] Information security is then essential, moreover when people accessing the EPR can have varied objectives, different types of access and several processes to execute. [6]
Therefore, access control is indispensable to provide because it manages the first contact between users of a system and its functionalities and features. [6]
Other characteristic of EPR is the dependence on computer technology. Although it facilitates processing and communication of data, it depends on complex equipment that may fail or become obsolete. [7] According to a recent report, more than 1000 accidental deaths have been attributed to computer system failure. [8]
Such occurrences must be considered when thinking of what objectives different people, with different interests, want to achieve when using the information of EPR.
The Biostatistics and Medical Informatics Department of Porto’s Faculty of Medicine implemented a centralized EPR system (VEPR – Virtual EPR) between May 2003 and May 2004 in Hospital S. João, Oporto, Portugal. This hospital has more than 1300 beds and 5000 workers from 56 departments, where about 1000 are medical doctors, so any access to information needs to be properly defined, controlled and monitored. A generic but strong access control policy that reflects people’s processes and interactions with the system, without incapacitating its use, is the basis for the VEPR success and, more importantly, acceptance, trust and use. [6]
More than 300 doctors access this system daily, and this number is increasing, as well the fact that many other healthcare professionals can also benefit from its use. [6] Even patient’s access to their health records is now fairly common in many places. [9] [10] In this article we don’t pretend to define or describe any access control policy developed but we purpose to summarise the opinions of doctor’s working in HSJ towards who should access Electronic Patient Records, and the for whom this information should be (or not) limited.
Participants and Methods
Type of study
This is an observational, descriptive, transversal study, in which the analysis unit is the individual.
Participants’ selection
Initially, we performed a bibliographic search of publications concerning access control to Electronic Patient Records.
The next step was the selection of participants. Our target population was doctors. The available representative population was the medical doctors of the Hospital São João (HSJ), Oporto, Portugal. From a list of the staff of the HSJ, facilitated to us by the department of human resources at HSJ, we filtered only the medical doctors, department directors and pre-career doctors. As a sampling method, from the filtered list above, we selected a simple randomized sample of 92 elements.
Data collection
The instrument used for data collection was a questionnaire elaborated by us. We used a personal interview as the type of questionnaire, which was absolutely anonymous. The first steps in the questionnaire design were the preparation of the questionnaire, the research of questionnaires previously tested and the elaboration of a variable list. The questionnaire was then pre-tested, in order to evaluate its validity and reproducibility. The pre-test’s participant selection was made by a non-random accidental sampling process. The interviewer asked 10 HSJ doctors, who were at the hospital at that moment, to fill it in. Then we elaborated the final version of the questionnaire and the pre- codificated the variables.
The questionnaire is composed by 8 questions, some of them subdivided. The first 2 questions are global questions where doctors indicate the frequency they use the EPRs and if there should be several access levels to records depending on the health professional’s category (a Yes or No response). Questions 3 refers to doctors’ access control and question 4 refers to the access to sensitive information about patients (like HIV tests) while question 5 is about nurses’ access to EPR. Questions 6, 7 and 8 are about other situations, as emergency situations, other uses of EPRs and patient’s access to their EPRs.
The independent variables potentially relevant for the statistical analysis are: age, gender, professional category and department. This information was used to compare answers to the different questions (dependent variables) between these distinct groups in the statistical analysis.
The following step was the recruitment. We went to the different departments and tried to find the doctors that made part of our sample. Those who didn’t work in HSJ anymore (29 people) or were already retired (5 doctors) were excluded, because they didn’t belong to our sample, which was therefore reduced to 58 people. Then, we applied the questionnaire. If doctors were not available in the department after three attempts, they were eliminated. If they were in the department but refused to answer, or if their questionnaire was not concluded, they were also eliminated.
Statistical analysis
In what concerns statistical analysis, we used SPSS for Windows, version 13.0. We inserted the collected data in a preformatted SPSS table. We started to analyse our sample using absolute and relative frequency tables and pie graphs. Then, we analysed each question, elaborating the respective frequency tables and pie graphs. The Excel software was also used in the elaboration of some graphs. Chi-Square tests were also performed in order to evaluate the significance of the differences found between ages, genders, professional categories and departments, regarding the most relevant questions. As there are cases that do not respect the qui-square test’s assumption (that require all expected values to be equal or superior to 5), some values are calculated using Fisher’s exact test.
All the independent variables used in this study are categorical variables, except the age. In order to facilitate the data analysis, we transformed this numerical variable in a categorical one. Furthermore, some independent variables were attached in categories so that we could perform a chi-square test. The variable age was separated in two categories: under 35 and over 35. We chose 35 as the dividing age because most doctors become specialized ones at that age. Professional categories were also divided in two categories: pre-career doctors and medical doctors. Departments were categorized in medical departments and medical – surgical ones. The significance level used in this study was 0.05.
.
Results
Response
Of the 58 questionnaires, 45 were fully answered, so the response rate was 78%. 10 doctors weren’t available in the department for three consecutive times and 3 refused to answer.
Responders’ characteristics
Age / N=45<35 / 22%
>35 / 78%
Gender
Female / 58%
Male / 42%
Department
Cirurgic-Medical Cirurgic / 38%
Medical / 62%
Professional category
Geral internal / 7%
Speciality internal / 9%
Specialist / 38%
Graduated Specialist / 36%
Department's Director / 11%
Participants’ characteristics are listed in table 1. Most doctors were over 35 years old. There were more female doctors than male doctors.
Medical departments are the most represented ones.
Specialists and graduated specialists were the professional categories more represented.
Table 1: responders’ characteristics
Global view
All doctors confirmed that they have already used the electronic patient records. The most of them told that they use this kind of records daily.
The most of doctors agreed with the existence of different access levels of information depending on the professional category of the health’s worker (graph 1).
Doctors’ access
In what concerns doctors’ access to information, the answers are summarized in scheme 1. More than an half of the responders thought that doctors shouldn’t have full access to patient’s information. From those, while some thought that doctors should only have access to the information of the patients they treat, others considered that they should have access to the information of their department.
69% of the responders thought that sensitive information as HIV tests, venereal or cancer diseases should only be accessed by doctors who treat these patients.
Scheme 1: Doctors’ access
Nurses’ access
In what concerns nurses (scheme 2), almost all doctors thought that they shouldn’t have full access to patients’ information. The majority believe that nurses should only have access to the information of the patients they treat.
Scheme 2: nurses’ access
Other situations
Most doctors agreed that, in an emergency case, non authorized doctors and nurses must have access to patients’ information, but that access must be registered.
The majority of responders found pertinent to use the patients’ records to other purposes, as clinical or epidemiologic investigation. Although most doctors agreed with the different purposes, epidemiological investigation was the one that had the biggest rate of agreement, while economic investigation was the one who had less rate. These opinions are summarized in scheme 3.
Scheme 3: using records to other purposes
The majority of doctors thought that patients shouldn’t have access to their clinical information, as it is demonstrated in graph 2.
Possible relations
In table 1 are characterized the individuals that had answered affirmatively to the most pertinent questions of the questionnaire, according to gender and professional category. Only 10 doctors were under 35 years old. This was considered not to be representative of doctors in pre-career's view and their data was excluded from detailed analyses and possible relations with the dependent variables. In what concerns departments, we also decided to exclude them from this analysis because the number of doctors in medical- surgical departments was very inferior and could not give us trustful values.
For each of these three variables we present the correspondent p value, and those that do not respect the qui-square test’s assumption (that require all expected values to be equal or superior to 5) are signalled by *. Consequently, these values are calculated using Fisher’s exact test.
Our null hypothesis (H0) was that there was no difference between the variables concerning the affirmative answer.
GENDER / p / PRO. CAT. / PWithin affirmative questions to: / F / M / Pre-career / Specialists
Concerning the access by the doctors, should all of them have access to the information of all the patients? / 63% / 37% / 0,532 / 16% / 84% / 1,000*
Do you agree with the existence of several levels of access to the information concerning the health professional’s category? / 60% / 40% / 0,565* / 17% / 83% / 1,000*
Do you think that the most sensible information (like HIV tests, and other) should be access only by the doctors who are attending these patients? / 58% / 42% / 0.954 / 23% / 77% / 0,081*
Concerning nurses, should they be able to access the patients’ whole clinical information? / 25% / 75% / 0,295* / 25% / 75% / 0,505*
Should the patients be able to access whole their clinical history? / 57% / 43% / 0,954 / 14% / 86% / 1,000*
Does it seem pertinent to you the use of these records to other purposes (clinical or epidemiological investigation, learning, etc.), keeping the anonymity of the patients? / 61% / 39% / 1,000* / 18% / 82% / 1,000*