Unlocking medical files

There's no information more personal or intimate than your medical records but, as JAN CORBETT reports, more people can read them than you might like.

If you think that doctor/patient confidentiality is as sacrosanct as a confessional box, consider this complaint that went to the Privacy Commissioner last year.

A patient was being treated for depression and had talked about killing himself before. So when his doctor found a message explaining he had missed his last appointment because he was buying a gun, the doctor agonised, consulted colleagues, then told the police.

The patient claimed his privacy had been unlawfully breached, but the Privacy Commissioner disagreed.

Rule 11 of the Health Information Privacy Code allows doctors to raise the alarm to prevent serious harm.

You may see your health as no one's business but your own but for all sorts of reasons - ranging from public safety to containing and analysing the spread of disease, from running an efficient public health system to claiming insurance cover or accident compensation - when you get sick and see a doctor, some other agency will invariably be told.

For instance, if you've had a malignant tumour your name will be on the Cancer Register, having been sent there automatically by the pathology laboratory.

Catch one of the 40 diseases that are notifiable in New Zealand, such as tuberculosis or campylobacter, and a medical officer of health has to be told, with your name, address and test results. If it's a food-borne illness even your local council will be notified.

Your illness may be further investigated and, if you're a cook or work with children and have food poisoning, you will have to stay home from work and your employer will be asked to help you comply with those rules. You can certainly expect to be mailed information on your disease.

If your doctor or optometrist considers you are too sick or too blind to drive, they have to tell the Land Transport Safety Authority.

But even if your ill health is not a threat to others, someone other than your doctor will be collecting information about you.

If you have ever spent more than a day in hospital, the New Zealand Health Information Service (NZHIS), a division of the Ministry of Health, will have something on you.

If you have ever used a healthcare service, you will have been tagged with a National Health Index (NHI) number, revealing your name, address, ethnicity and all the aliases you have chosen to go by.

There won't be any clinical information alongside that number, but it will have a flag showing whether there is significant medical information held about you in another database called the Medical Warning System (MWS).

Information about you in the MWS will have been gleaned from the National Minimum Data Set (NMDS) - the information about your hospital stay of more than one day that is routinely sent to the ministry to provide a national overview. All personal information is removed when the overview is produced.

Confused?

Bogged down in acronyms?

Untangling the details of the medical information that is held on you, where it is kept and who gets to see it, can be as bamboozling as listening to your doctor explain what will happen during your heart bypass operation. And that makes it harder for you to control.

According to a ministry website, everyone from the doctor's receptionist to the clerks involved in record-coding, reporting, billing and contract management, has access to the National Health Index.

Only medical staff have access to the Medical Warning System, which shows such things as whether you have drug allergies. But NZHIS group manager Vicki Sheldon admitted there was no way to restrict access to your doctor only. All medical staff could look up whomever they liked.

But there was a log of who had accessed the records. Typically, about 20,000 requests for information were made on the MWS each month, said Sheldon.

In 1999 the Ministry of Health went live with its health intranet, which means laboratory results and GP and hospital records can be quickly transferred electronically between health professionals - useful for the new thrust towards integrated care.

The Ministry of Health is now working on streamlining and simplifying the medical information it holds.

It has a Health Information Management and Technology Plan, and a multidisciplinary board working on finding out how it can get more information about your ailments into a centralised database and share that information with "partners in health care." It said it placed a high priority on patient privacy.






Already the ministry considers itself a world leader in electronic gathering and disseminating medical information. It claims the NHI and MWS together form the first national health information system running over public electronic highways.

But not everyone concerned about privacy thinks this is something to brag about.

Three years ago Auckland barrister Bob Stevens wrote a report for the Privacy Commissioner on health information privacy. He is deeply suspicious of the health bureacracy's motives and is worried it is collecting information just because it can.

He suspects the ministry might be in the thrall of "visionaries," and he uses the term derisively, who are certain there will be a variety of fabulous uses for this information in the future.

Stevens said confidentiality, was one of the cornerstones of the Hippocratic oath, but one that was in danger of being systematically eroded by electronic information systems.

The idea that all doctors can access the medical warning system about whomever they choose troubles him deeply. And he suggested it also troubled the doctors he has spoken to informally, who admit they use false names when they seek medical treatment.

"Are you happy that everyone in the health system has access to health information about you?" Stevens asked.

He said there were times when embarrassment over things such as a sexually transmitted disease, an unwanted pregnancy, or substance abuse meant people might bypass their regular doctor or pharmacist - particularly one who had become a family friend - and seek treatment anonymously elsewhere. The idea any doctor could read the information on a centrally held electronic file, robbed them of the right to keep those things secret.

In its paraphernalia about its health information strategy, the ministry has assured us information-sharing about patients is essential for better health care. Certainly there is an attraction in the idea that when we are rushed unconscious into A&E the doctor can quickly find out which drugs were are allergic to. And surely it will lead to better health policy if the bureaucracy can see, at the click of a mouse, what our community's medical needs are.

But suggest this to Stevens and he will look back pityingly at one so gullible.

His research has told him the need for a doctor treating you in an emergency to see all your medical records is overstated. And there are other ways to monitor a population's health care needs and sickness patterns. Not that Stevens entirely opposes central medical databanks. The issue, he said, was personal autonomy.

Take for instance the National Minimum Dataset - the information sent to the ministry when you leave hospital if you have been there more than one day.

As Vicki Sheldon explained, patients "are not required to give their consent" before their information is sent on.

"However where particularly sensitive information is involved, such as mental health, there are additional mechanisms available to protect the anonymity of the individual concerned." She said the patient could decide if the information would go to the Medical Warning System.

Indeed, who gets told about someone else's mental illness has been one of the most misquoted areas of the Privacy Act since it was introduced. Commissioner Bruce Slane is clear relatives and caregivers can be told, providing the hospital has a clearly stated policy to that effect. The question remains whether people will seek help from an agency that advertises that policy.

The NZHIS also runs a Mental Health Information National Collection project (MHINC). In the interests of providing better mental health care, said the NZHIS, all publicly funded mental health services, including drug and alcohol abuse agencies, must send to Wellington details of the mental health services you receive as well as your gender, date of birth, ethnicity, diagnosis, legal status, referral and discharge information.

According to an NZHIS website, summaries of that information, in a coded form that does not identify anyone, "will be used by the Ministry of Health, the Mental Health Commission, researchers, health care providers, consumers and tangata whai ora.

"The only way that information identifying you could be made available to other parties, such as researchers, is with ethics committee approval."

And ethics committees do approve this type of research when they consider it is impractical to get consent from a large numbers of patients but the public good from the research outweighs privacy issues.

Auckland Medical School's Dr Robin Briant has been involved in research like this, looking at the rate of adverse events in our hospitals. She said only one or two researchers saw the files and once the information was extracted there was no way to match it with identifiable people. Everyone involved signed confidentiality agreements.

According to Stevens we should not only know where our health information is sent to, but also have greater control over what is recorded. Not everything will be clinically significant in the future and he suggested our GPs could be the gatekeepers of the information sent to any central register, in the same way doctors were the filter for information required by health insurers and ACC.

As with all insurance, you must give your health insurer or your accident compensation agency authority to investigate your medical records. If you don't, they can refuse a claim.

The ACC and the Health Funds Association, which represents health insurers, said they would request the relevant information from the claimant's doctor, rather than trawl through your records.

The new frontier in health information privacy is genetic testing, with as many as eight tests available that can show a genetic disposition to diseases such as hereditary breast cancer, Huntington's or Alzheimer's disease. Should you have to share this information? What if you don't want to know it yourself?

So far, neither health nor life insurers are demanding people undergo genetic testing before they take out a policy, but they do expect you to reveal the results of such a test if you have had one. It is all about the insurance company knowing as much as you do about your health risks, even though a genetic disposition to a disease does not mean you will invariably develop it. Health Funds Association executive director Andrea Pettett, sees genetic testing as "a huge issue on our horizon."