India’s Electronic Health Record (EHR) Standards are looking to create rules and guidelines around data ownership and privacy standards for storing health data collected digitally from customers, and appears to cover applications and devices that collect health data too. The Ministry of Health and Family Welfare which notified the standards in February 2016, has published them online for comments by the 20th of May.
An Electronic Health Record refers to various medical records and data that gets generated during any clinical or hospital visits. Importantly, it also includes data generated from self-care and homecare devices and systems, “which is generated 24×7 and also has long-term clinical relevance”. The Ministry points towards the need for standardization, saying that lifelong medical records help in better understanding of issues, and
“Without standards, a lifelong medical record is simply not possible, as different records from different sources spread across ~80+ years potentially needs to be brought meaningfully together. To achieve this, a set of pre-defined standards for information capture, storage, retrieval, exchange, and analytics that includes images, clinical codes and data is imperative.”
Download the pdf here.
The lowdown on the standards:
1. Ownership of data: Data generated by healthcare providers can be maintained by the providers, although the data will be owned by customers. The medium of storage or transmission will be owned by the healthcare provider. Patients have to be provided with enough privileges to inspect and view their medical records without time limit.
2. Access to data: Patients will also have the ultimate authority on who can access the data, and will need to provide explicit consent to allow disclosures. Users can have their medical records changed for correction of errors. The request has to be made within 30 days from the date of therapy, and an audit of all changes have to be maintained. Patients will also have the option to restrict access to and disclosure of any individually identifiable health information.
3. Changes to data: The data once entered into a health record system must become immutable. The healthcare provider can re-insert/append any record in relation to the medical care of the patient as necessary with a complete audit trail of such change maintained by system. Changes to the previously saved data should not be permitted. Any record requiring revision should create a new medical record containing the changed/appended/modified data of earlier record. This record shall then be stored and marked as ACTIVE while rendering the previous version as INACTIVE.
4. Disclosure of health information: For fair use for non-routine and most non-health care purposes: a specific consent must be taken from the patient in format as defined by the Medical Council of India. The data can also be disclosed freely without permission, once it is stripped of all identification information.
5. Legal access to records: The records have to be produced with all identifiers in an ‘as-is’ state in the presence of a court order. For certain specified national issues, including notifiable/communicable diseases, the health information can be disclosed to appropriate authorities as mandated by law without the patient’s permission.
6. Responsibility of healthcare providers: The healthcare provider will be responsible for securing and storing the health information as well as removing patient identifying information when providing patient information. Healthcare providers will also have to inform patients of policies about their rights to health records, in addition to developing internal privacy policies, designating a privacy officer and providing privacy training to all its staff.
7. Denial of information: Healthcare providers can deny information to patients or their elected representatives or third parties if in the opinion of a licensed doctor the release of such information can endanger the life and safety of the patients and others. This includes information like psychotherapy notes, info compiled for civil, criminal or administrative action, or info obtained from an anonymous source under promise of confidentiality.
8. Preservation of records: Electronic medical records must be compulsorily be preserved and not destroyed during the lifetime of the person, ever. Upon the death of the person, if there are no court cases pending, the records can be moved from an active to an inactive status. The paper suggests a 3 year wait before turning inactive the records of a deceased person. It also suggests that the records never be deleted even after death, as it can be useful to assess the health of blood relatives or natural descendants.
9. Encryption & logging: All electronic health information must be encrypted and decrypted as necessary with a minimum strength of 256-bit encryption keys. All actions related to the electronic health information must be recorded with the date, time, patient identification and user identification and an indication of which action took place (eg, printing of the document).
Secure transmission standards have to be used to transmit data from one application or site to another. For example, the paper suggests the use of HTTPS, SSL v3.0 and TLS v1.2.
10. Aadhaar and identification: Implementers of a health record system must also ensure that the Aadhaar number, when available is used as the unique health identifier. In case of the unavailability of Aadhaar, patients can be registered with two government assigned identification cards.
11. Physical safeguards for data storage facilities: The paper asks 4 physical standards for data storage facilities to follow. These include
– The facility access control standard, to limit actual physical access to electronic information systems and the facilities where they’re located;
– The workstation use standard, to control the physical attributes of a specific workstation or group of workstations, to maximize security;
– The workstation security standard, to implement physical safeguards to deter the unauthorized access of a workstation; and
– The device and media controls standard, to control the movement of any electronic media containing medical records from, to or within the facility.
12. On homecare devices & systems:
The paper states that patients will increasingly expect the healthcare record system to provide health information over mobile devices, which will give their treating clinician basic information like, medical condition, drug/allergy information etc. Demographics, insurance info, medications, allergy and alerts, and vital signs are some of the records that are recommended to be provided in at least read-only manner and to the extent relevant for emergency care and quick reference.
It is also possible that certain clinical (BP, temperature) and lifestyle (steps walked, distance run, sleep duration) related information will additionally be provided by the patient thereby providing information on the overall well being of patient. Other than this, the paper suggests various ISO standards, and other national standards to be used for electronics health records.