There is a large body of literature on the security concerns of electronic health record (EHR) systems. These articles range from theoretical models for cryptographic or access control mechanisms [1] to descriptions of different implemented systems [2], descriptions of different national experiences [3,4], practical comparisons between different standards, and guidelines for implementing a particular security standard [5]. But most of these articles are concerned mainly with the confidentiality aspect of the records: that no unauthorized party should have read access to them. As we discuss in this article, there is a more complex set of requirements regarding integrity, control, legal aspects, and other aspects of an integrated health record system.

In this article we assume a single computer-accessible record of all a person’s health events. We use the term electronic health record (EHR) for such a system. The EHR should be contrasted with a computer record of the patient’s health events that is kept, controlled, and maintained by a single health organization (HO). We call this second form the electronic patient record (EPR). EPRs are maintained by a particular HO and contain the patient health data while in the care of that organization; therefore, there will be different EPRs for a particular patient at a local hospital where he or she underwent minor surgery, at a distant hospital where he or she was treated for injuries sustained in a car accident, at his or her current and past family physicians’ offices, at his or her current and past dentists’ offices, and so on, which reflects the current situation in most parts of the world.

The idea of a single, unique, Internet-accessible EHR has been mentioned many times in the literature, sometimes under the name of Lifetime Health Record or Personal Health Records but none of the articles discuss the requirement of such systems beyond confidentiality [3,4,6-8]. In this article we will discuss the requirements of such an EHR system on a conceptual level, with no regard for technologies, policies, or laws for implementing these requirements.

In this article, besides EHR and EPR we will use the term health professional (HP), which includes all sorts of professionals who can have access to the patient’s EHR, including physicians, nurses, dentists, psychologists, and alternative medicine practitioners. We will also use the term health organization (HO), which includes organizations ranging from a single professional clinic to hospitals.

We believe that the central point of an EHR is to gain quality and efficiency in caring for the patient. The patient’s health conditions and whole health history are available to the HP to aid in diagnosis, therapy planning, and patient care. This aid can take three main forms: provision of essential patient health information, efficiency through reuse of previous laboratory exams, and opportunistic improvements in quality. We will discuss these three forms of aid shortly.

Furthermore, the EHR serves as the record of an HP’s actions on behalf of that patient and should be the unique and definitive source of information about those actions for legal and professional purposes. Thus, if some professional or legal body is evaluating the HP’s competence, the actions and notes the HP recorded in the EHRs of his or her patients should be the definitive source of information.

The article is organized as follows: In “General Principles” we discuss confidentiality, control, integrity, and legal value and the goals of an EHR. It is important to point out that the general principles of confidentiality and integrity are well known and well discussed in the literature, but we think it is important to list them with other, less well-known and less discussed principles for the sake of completeness. In the next three sections we discuss the subprinciples related to integrity, confidentiality and control, and the legal value of the EHR. In “Other Practical Considerations” we discuss other principles of a more practical nature, which we believe are also very important. In “Related Research” we discuss some of the literature on these issues, and in the final section we discuss some open issues. This article does not propose any technical or legal solutions to the principles proposed. If these principles are accepted, it will be as a result of the efforts of many researchers and research programs.

We assume the following general principles for the EHR:

• Confidentiality: The patient’s records are private and confidential; no unauthorized person may inspect the contents of the patient’s records.
• Control: The patient controls the access to his or her records. A patient may grant access to an HP and revoke such access rights when the treatment is over.
• Integrity: The patient’s life may depend on the data contained in the records, and therefore only authorized people can enter or change the data.
• Legal Value: The patient’s records are the unadulterated, complete record of all actions taken by the HPs on behalf of that patient and should be the definitive source of information about said actions.

These general principles of confidentiality, control, integrity, and legal value are further elaborated and discussed in the sections that follow. The certainties expressed here will be relativized as we elaborate the ethical and practical principles.

In general terms, confidentiality and control are patient-related principles. Confidentiality allows the patient to be sure that no one but authorized people can read his or her records, and control allows the patient to grant an HP read and write access to his or her medical records and then revoke the access when he or she decides the HP should have no longer access to it.

Integrity is an HP-related property, and therefore, we believe, it is very relevant for the appropriate use of the EHR. The whole point of an EHR is to improve the quality and efficiency of the HP’s work, and for that integrity is absolutely necessary.

Finally, legal value is a very important aspect of the EHR, not a secondary aspect, as is sometimes assumed. The EHR should be the definitive source of information about the HP’s actions on behalf of the patient.

Medical records, especially paper-based records, have a dual purpose: They serve as a legal document that records the HP’s and the HO’s actions and as a written collaboration medium between HPs (in case the patient is being treated by multiple HPs) or as a reminder tool for a single HP over time.

A central, lifelong EHR has another use: to improve the quality of the HP’s actions and decisions by providing relevant patient health data and by potentially providing economy in patient treatment through the reuse of exam results.

The most important aspect of the EHR is that it records the current, relevant aspects of the patient’s health, including: current diseases, current complaints, allergies and other health conditions, and medications being taken. The current health aspects of the EHR improve the quality of the patient care by helping the HP to avoid drug interaction problems, recognize iatrogenic symptoms, avoid allergic reactions to drugs, and so on.

Furthermore, the EHR contains all recent laboratory exams of the patient. If the patient had a recent blood sugar test that showed normal sugar levels, as long as those results are recent enough that they are still valid, and the HP trusts the laboratory that performed the exam, and trusts the record, then there is no need to ask for a new exam.

Finally, the EHR should contain the long-term patient medical history. For example, if all blood sugar measures of the patient are in a single place, an HP may notice a blood sugar pattern that may indicate a potential problem, or the HP may better interpret the results of a recent blood sugar test in the light of all the previous tests. Or the HP may determine that a current complaint might be attributed to the long-term consequences of a disease the patient believes was cured long ago. Thus, the HP’s decision-making ability can be improved through the opportunistic use of information stored in a patient’s medical history.

An article by Buckovich et al. [11], which expresses concerns similar to ours, lists 28 principles regarding electronic medical records, compiled from 10 policy documents and from U.S. organizations (such as the National Research Council), and makes a comparative review between the different sets of principles. Principle 12 in the article states,

Health care providers have the right to maintain private recordings of observations, opinions, and impressions whose release they consider could be potentially harmful to the well-being of the patient. They shall not disclose this information without due reflection on the impact of such release [11].

This principle is particularly relevant to our work because it is part of our justification for denying access rights to patients, which in turn contradicts Principles 2, 3, and 4 (the right to access, right to a copy, and right to correct or amend one’s own record) of the same article. Principle 12 is also our justification for the HO’s and HP’s right to a copy of the record of their own work.

An article by Ross and Lin [12] reviews the literature on the benefits of patients’ read access to their own records and concludes that although the studies were of limited quality, they show “modest improvements in doctor–patient communication, adherence, patient empowerment, and patient education.” The study also points out problems of increased anxiety when psychiatric records are made available to the patients. An article by Staroselsky et al. [13] reports on the benefits of providing read and limited write access to the patient’s EHR in terms of accuracy of the data and compliance with treatments. An article by Powell et al. [14] presents a survey of 31 patients regarding which medical information they did not want to be placed in an EHR, which included matters of pregnancy, contraception, sexual health, and mental health. Also relevant is their finding that some patients pointed out information that they believe was incorrect about them in their medical records, but some of this information was found to be correct (i.e., it corresponded to what the physician intended to record). This finding supports our argument that the patient must not have write access to his or her own records.

To our surprise, we found that our view on not granting read access to his own health records is not contradictory to national legislations such as the USA HIPAA and UK Access to Health Records Act of 1990. For example, the HIPAA, regarding the rights of the patient to access their medical records, allows for the health care provider not to agree in releasing the information to the patient, if "a licensed health care professional, in the exercise of professional judgment, determined that it is reasonably likely that access to the required information would endanger the life or physical safety of the consumer or another person" [15]. Furthermore, HIPAA does not include psychotherapy notes as a medical document to which the patient has access. The UK Access to Health Records [16] is closer to our view: "Cases where right of access may be partially excluded (1) Access shall not be given under section 3(2) above to any part of a health record— (a) which, in the opinion of the holder of the record, would disclose– (i) information likely to cause serious harm to the physical or mental health of the patient or of any other individual".

Verity and Nicoll [17] describe the tension between confidentiality of the EPR and the interest of public health surveillance and point out that if there are multiple EPRs for each patient, anonymization in itself would be problematic because of the duplication of data. In our proposal of a single EHR, those concerns would be less problematic.

A different approach to a single, central EHR is to have local EPRs that allow some degree of interchangeability. A number of articles discuss the need for standards for interchanging and sharing EPRs across different organizations or countries [4,18].

Other research articles discuss different technical aspects relevant to the issues in this article. Pharow and Blobel [19] discuss the issue of long-term storage and its impact on the digital signatures in the EHR. Behlen and Johnson [20] and Quantin et al. [21] discuss issues and techniques for the anonymization of medical records. Finally, to our knowledge Bakker [22] was the first to point out the requirement of recoverability of specific moments, but the article discusses the difficulty in implementing this requirement when the EHR is just a set of pointers (or links) to an HO’s specific data and processes.

A large set of issues are not discussed in this article. First, we do not propose any implementation or technical solution to the security requirements herein. Such solutions certainly will involve complex cryptographic techniques, trusted central servers, operational procedures in HOs, and national-level legislation. We also do not discuss the content of the EHR nor how long the data should remain available in the EHR.

But we think that some of the ethical issues raised here warrant further discussion. One is whether the patient can ask for certain information to be private and not made available to other HPs. The patient may tell a particular HP some information because he or she trusts the HP and believes that the HP can make the appropriate use of that information on his or her behalf. But the patient may not trust the entire health system and therefore may want that information to be unavailable to other authorized HPs.

Another complex ethical issue, for which we have no solution, is the linking of different patients’ records. Clearly there are many situations in which knowing the health conditions of a patient’s parents or spouse will improve the patient’s care. However, the spouse or parents might not grant this HP the right to access their records.

In this paper, we presented a set of principles for an EHR, a unique, centralized, electronic health record system that goes beyond the usual requirement of privacy. We do not believe this is a complete set of requirements for such systems. But the requirements set forth in this paper already pose a considerable task to satisfy them. We do not know of any technological, legal or economic solution that satisfy these requirements.

Current attempts to implement some for of centralized record system usually fall short in some if not all of these requirements. For example, recent developments on Personal Health Record by Microsoft and Google do not satisfy integrity, and thus neither legal value. At current technology and legal infrastructure, it seems that the most one can do is to prioritize a subset of our principles that the system will follow, and accept that the other principles will not be satisfied.

If this paper does not put forth any solutions, we hope it make it clear that there many more requirements for an EHR than privacy, and that further research into the technological and legal aspects of an unique health record is needed.