Medical privacy

Various methods have been used to protect patient's privacy. This 1822 drawing by Jacques-Pierre Maygnier shows a "compromise" procedure, in which the physician is kneeling before the woman but cannot see her genitalia.

Medical privacy or health privacy is the practice of keeping information about a patient confidential. This involves both conversational discretion on the part of health care providers, and the security of medical records. The terms can also refer to the physical privacy of patients from other patients and providers while in a medical facility. Modern concerns include the degree of disclosure to insurance companies, employers, and other third parties. The advent of electronic medical records has raised new concerns about privacy, balanced with efforts to reduce duplication of services and medical errors.

Privacy for research participants

Main article: Privacy for research participants

In the course of having or being part of a medical practice, doctors may learn information they wish to share with the medical or research community. If this information is shared or published, the privacy of the patients must be respected. Likewise, participants in medical research that are outside the realm of direct patient care have a right to privacy as well.

Privacy situation by country

Australia - eHealth

On 1 July 2012 the Australian Government launched the personally controlled electronic health (eHealth) record (PCEHR) system. The system is being rolled out in stages. Full implementation will incorporate an electronic summary prepared by nominated healthcare providers, and consumer entered notes. The summary will include information on the individual’s allergies, adverse reactions, medications, immunisations, diagnoses and treatments. The consumer notes will operate as a personal medical diary that only the individual can view and edit. The opt-in system, means people choose whether to register for the eHealth record or not.

Privacy - Governance

The Personally Controlled Electronic Health Records Act 2012 and Privacy Act 1988, govern how eHealth record information will be managed and protected. The PCEHR System Operator abides by the Information Privacy Principles in the Privacy Act 1988 (Commonwealth), and any applicable State or Territory privacy laws. A Privacy Statement sets out the application of personal information collection by the System Operator. The Statement includes explanation of the types of personal information collected, what the information is used for, and how the information is stored. The statement covers measures in place to protect personal information from misuse, loss, unauthorised access, modification and disclosure.

United Kingdom

By 1999, 62% of the National Health Service (NHS) trusts used electronic records to some degree.^{citation needed}

In 2003, the NHS made moves to create a centralized electronic registry of medical records. The system is protected by the UK's Government Gateway, which was built by Microsoft. This program is known as Electronic Records Development and Implementation Programme (ERDIP). The NHS National Program for IT has been criticized for its lack of security and lack of patient privacy. It was one of the projects that caused the Information Commissioner, to warn that there was a danger of the country "sleepwalking" into a surveillance society. Pressure groups opposed to ID cards are also campaigning against the centralized registry.

Privacy is based on patients' rights in the UK flowing from the European Convention of Human Rights, through to the Data Protection Act (DPA). The opposing point of view that access should be on a 'need to know basis' is not legal, it is the patient who must grant access.

United States

A nurse shredding papers in order to be compliant with the physical safeguard section of the Health Insurance Portability and Accountability Act (HIPAA).

See: Health Insurance Portability and Accountability Act of 1996

The most recent development in the USA is the Medical Information Privacy and Security Act (MIPSA). It contains important provisions requiring the generation of an audit trail of information being accessed, and allows patients the ability to partition their data so that, for example, genetic information is not revealed when they go for a flu shot. Individuals have a right to access, copy, edit and augment their information.

Privacy advocates in the United States have raised concerns about the switch from paper to electronic medical records. Some commentators fear this will lead to unauthorized access to personal data.^{citation needed}

New Zealand

In New Zealand, the Health Information Privacy Code (1994), sets specific rules for agencies in the health sector to better ensure the protection of individual privacy. The code addresses the health information collected, used, held and disclosed by health agencies. For the health sector, the code takes the place of the information privacy principles.

Netherlands

The introduction of a nationwide system for the exchange of medical information and access to electronic patient records, led to much discussion in the Netherlands.

External links

• European Standards on Confidentiality and Privacy in Healthcare
• Opt out of the NHS Spine, or the NHS Confidentiality campaign