The Differing Privacy Concerns Regarding Exchanging Electronic Medical Records of Internet Users in Taiwan
Total Page：16
File Type：pdf, Size：1020Kb
J Med Syst (2012) 36:3783–3793 DOI 10.1007/s10916-012-9851-1 ORIGINAL PAPER The Differing Privacy Concerns Regarding Exchanging Electronic Medical Records of Internet Users in Taiwan Hsin-Ginn Hwang & Hwai-En Han & Kuang-Ming Kuo & Chung-Feng Liu Received: 31 January 2012 /Accepted: 27 March 2012 /Published online: 20 April 2012 # Springer Science+Business Media, LLC 2012 Abstract This study explores whether Internet users have the respondents had substantial privacy concerns regarding different privacy concerns regarding the information EMRs and their educational level and EMR awareness contained in electronic medical records (EMRs) according significantly influenced their privacy concerns regarding to gender, age, occupation, education, and EMR awareness. unauthorized access and secondary use of EMRs. This study Based on the Concern for Information Privacy (CFIP) scale recommends that the Taiwanese government organizes a developed by Smith and colleagues in 1996, we conducted comprehensive EMR awareness campaign, emphasizing un- an online survey using 15 items in four dimensions, namely, authorized access and secondary use of EMRs. Additionally, collection, unauthorized access, secondary use, and errors, to cultivate the public’s understanding of EMRs, the gov- to investigate Internet users’ concerns regarding the privacy ernment should employ various media, especially Internet of EMRs under health information exchanges (HIE). We channels, to promote EMR awareness, thereby enabling the retrieved 213 valid questionnaires. The results indicate that public to accept the concept and use of EMRs. People who are highly educated and have superior EMR awareness should be given a comprehensive explanation of how hos- H.-G. Hwang ’ Institute of Information Management, pitals protect patients EMRs from unauthorized access and National Chiao-Tung University, secondary use to address their concerns. Thus, the public Hsin-Chu City, Taiwan, Republic of China can comprehend, trust, and accept the use of EMRs, reduc- e-mail: [email protected] ing their privacy concerns, which should facilitate the future H.-E. Han implementation of HIE. Institute of Information Management, National Chung-Cheng University, Keywords Concern for information privacy (CFIP) . Min-Hsiung, Chia-Yi, Taiwan, Republic of China Electronic medical records (EMRs) . Health information e-mail: [email protected] exchange (HIE) K.-M. Kuo (*) Department of Healthcare Administration, I-Shou University, Introduction Yanchao District, Kaohsiung City, Taiwan, Republic of China e-mail: [email protected] Most people desire electronic access to their health infor- mation for themselves and their health care providers [1]. K.-M. Kuo This access is believed to not only improve the quality of e-mail: [email protected] care, but also reduce health care costs and improve diagno- C.-F. Liu sis and treatment [2, 3]. Therefore, in addition to digitizing Department of Information Management, the medical records used by health care providers when Chia-Nan University of Pharmacy and Science, caring for patients in hospitals, various stakeholders (e.g., Jen-Te District, Tainan City, Taiwan, Republic of China clinicians, patients, and policy makers) anticipate the elec- e-mail: [email protected] tronic sharing of information among medical facilities [4]. 3784 J Med Syst (2012) 36:3783–3793 Medical records are comparatively more sensitive than other have the greatest interest in consumer characteristics, such types of information [5, 6]. Thus, people typically have as age, gender, and educational level [23]. However, the significant concerns regarding the privacy of electronic results reported in studies regarding the impact of consumer medical records (EMRs) [1, 7]. Although regulations to characteristics on privacy concerns remain contradictory ensure the privacy of medical records (e.g., The Health and inconclusive [e.g., 15, 22–25]. Therefore, the influence Insurance Portability and Accountability Act, HIPAA) have of people’s characteristics on their information privacy con- been proposed and implemented in numerous countries [8, cerns must be examined to enhance our current understand- 9], the computerization of personal health information ing of this issue. presents inevitable risks to privacy [10, 11]. Because nu- The Taiwanese government has recently promoted the merous electronic health records can be accessed through a following six dimensions of EMRs: sharing, standards, in- single breach, addressing privacy risks is crucial to not only frastructure, applications, legislation, and security (Fig. 1) build public trust and avoid embarrassment or discrimina- [26]. Through various strategies, EMRs have been promoted tion, but to also provide accurate and reliable information to extensively in Taiwan. For example, the Electronic health care providers [12]. However, the study on the secu- SignaturesActwaspromulgatedinTaiwantoformally rity of medical information has shown that numerous pri- regulate the use of paperless signatures in 2001. On April mary health care providers cannot ensure effective 28, 2004, Article 69 of the Medical Care Act was amended information security and privacy [13]. Without privacy to stipulate that “medical care institutions that record and assurances, patients face the dilemma of whether they store medical records electronically are exempt from main- should disclose information to health care providers to en- taining a written copy.” This provision is the formal legal hance health care or withhold information to avoid inappro- basis of EMRs. The Department of Health (DOH) in Taiwan priate use [1]. Furthermore, health information exchanges also promulgated the “Regulations Governing the (HIE) have emerged as a tool that enables the flow of clinical Production and Management of Electronic Medical information among medical facilities and the consolidation of Records in Medical Care Institutions” on November 24, diverse clinical information [14]. However, patients’ privacy 2005, stipulating that medical institutions may replace tra- concerns regarding EMRs are reinforced under the HIE con- ditional written signatures with e-signatures when produc- text [1], which further influences their willingness to partici- ing EMRs. Additionally, the DOH relaxed restrictions on pate in HIE. the calibration of the “time stamp” in an amendment on To better cope with these privacy issues, the factors August 11, 2009, to allow medical institutions to establish influencing people’s privacy concerns must be understood. a reliable time-stamp management mechanism themselves. Although numerous studies have examined these factors, Consequently, obtaining a time stamp from the Healthcare they primarily focused on the context of marketing Certification Authority (HCA) of the DOH is no longer [15–18] and online transactions [19–21]. Information priva- required, significantly improving the delivery speed and cy concerns in the health care context have rarely been convenience of e-signatures. Thus, an increasing number explored [7, 22]. Among the influential factors, researchers of EMR systems are being developed and promoted. Fig. 1 Fishbone diagram of Improve the computing concrete measures in promoting Promote electronic Promote medical power and network speed EMRs [26] medical records information standards of medical information websites HL7/DICOM Strengthen the functions Establish mechanisms promotion project of the service center of Establish and for the exchange of medical information promote a drug medical information Integrate the public websites CDA/LOINC interaction database of medical promotion project database information websites Sharing Standards Infrastructure Circulation of Safe EMRs Application Legislation Security Develop Amend Medical telemedicine Care Act Security audit services Promote guidelines Establish for implementing Establish emergency EMRs in medical Promote management nationwide service systems facilities of national information long-term care Establish norms Establish anti-virus security classification networks for health Promote medical and anti-hacker information security systems in medical Establish and operate Promote online information websites and privacy protection information Healthcare Certification health and policies websites Authorization (HCA) medical services J Med Syst (2012) 36:3783–3793 3785 In addition, based on the international Health Level health and medical information online [30]. We hope the Seven (HL7) standard, the DOH in Taiwan has advocated results of this study can increase our current understanding the development of a localized reference model for defining of EMR privacy concerns to enable both the government the format of EMR content. Since the first baseline reference and medical facilities to develop superior privacy policies model, that is, the Taiwan electronic medical record tem- and personal health information collection and usage plate (TMT), was announced in 2008 [27], individual refer- practices. ence templates are continuously created and publicized on the EMR Standard Management System (the official Web site maintained by DOH). By the end of 2011, 108 EMR Literature review reference templates for various types of medical records (e.g., outpatient physician order entry records, admission Privacy, information privacy, and concerns regarding notes, and children’s physical therapy assessment records) information privacy had been proposed on the Web site [28]. According to the reference model, real