Electronic medical records: addressing privacy & security concerns in the UK and US

The digitisation of patient records has become a high priority for the new Obama Administration. As President-elect, in a radio address on December 6th 2008, Mr Obama proposed to modernise the US health care system by enabling hospitals to be connected to each other via the Internet, and by making sure that every doctor’s office and hospital use cutting edge technology and electronic medical records (Obama, 2008). He indicated that these measures would “cut red tape, prevent medical mistakes, and help save billions of dollars each year” (Obama, 2008). Indeed, it has been shown that use of information technology (IT) in health care reduces costs and medical errors (Mannan et al, 2006). Surprisingly, not many US physicians make use of electronic medical records. A 2008 study found that out of 2758 US physicians surveyed, only 4% had a fully functional electronic records system (DesRoches et al, 2008). In the UK, since 2002, the National Health Service (NHS) produced a strategy for developing IT in the NHS (including use of electronic health records, and 24-hour online access to patient records) resulting in the National Strategy for IT (NPfIT) programme which is currently underway. Use of electronic medical records raises many legal concerns especially related to privacy, confidentiality and security. Further, the linking of different medical databases increases these concerns (see Berčič & George, 2008). In view of the desire to increase IT use in health care, legislators in the US have recently drafted new legislation to address accompanying legal concerns (such as indicated above). This paper compares US and UK legislation (current or pending) that address concerns regarding the use of electronic medical records with a view to analysing the approaches taken by the two legal systems.