Privacy, information technology, and health care

Reviewer: Marlene L. Campbell

The author presents a clear discussion of the advantages, disadvantages, and hazards of a move to electronic patient records (EPRs). He takes a systems view of privacy and information security in health care, putting “the most urgent threats to patient information privacy” in perspective. He cites a study by Deloitte and Touche as indicating that 24 percent of US hospitals belong to integrated delivery s ystems, with 56 percent of hospitals pursuing EPRs, and he speculates that although “these developments bode well for improved health care they could produce consequences in lost or reduced medical privacy.” A diagram showing the “Flow of Healthcare Information in the U.S. System” clearly illustrates the risk of disclosure of health care information. The author claims that “the great majority of people (patients and physicians alike) have only a vague understanding of where health care data flows, often with little control of its use.” Since threats to the confidentiality of patient information can occur both inside and outside the patient care institution, he includes two precise tables: “Summary of Technologies Applicable to Information Systems Security Management” and “Relation of Disclosure Threats to Security Technologies.” The paper is well written, informative, and provocative. It contains good information and food for thought. It cites the need to address substantial US public policy and legislative issues and concludes with the statement that “For wide deployment of EPR usage, we will need a uniformly interoperable, vendor-supplied set of system components that incorporate highest performance security features.” Twelve references are provided.