Doctors Want Patients to Update Their EHRs

Мost US doctors believe that patients should have at least some access to their own electronic medical records, according to a new survey by Accenture. (31 percent voted for "full access" and 65 percent for "limited access.") Further, the vast majority of the doctors said that patients should be able to update certain portions of their EHRs.

So let's assume that you, as the healthcare CIO, want to give your physicians what they want: If you're going to let patients access and update their own medical records, how do you do it?

First consider how a patient might use access to an EHR. Being able to access a medical record, like for example the read-out of one of my electroencephalograms (EEGs), is great if: a) I know how to read an EEG; or b) I'm sending the document to someone who knows how to read an EEG. Otherwise, it's just something for me to ooh and aah over and pretend I know what it means, like a three-year-old's macaroni drawing, an ancient Egyptian papyrus, or half the cartoons in The New Yorker.

Chances are, your patients will not understand the details of every record either, whether it be an EEG, a blood test, or even a doctor's notes. So ideally, your patient-facing EHR system would first make it easy to share those records with another doctor or to request that records be shared with another doctor. Patients should also be able to electronically sign all those silly HIPAA forms.

Next, the EHR system should provide a patient-friendly report that translates the important stuff from medical jargon into plain English and directs the patient to sources of further information. For example, a drug prescription could link to a resource with a picture of the pill, a description of the drug's side effects, and warnings about dangerous drug interactions.

Let's first be clear about what "update" might mean -- it isn't as broad a term as "edit" or "change." Although "updating" demographic information like marital status or home address is straightforward and innocuous enough (even though 5 percent of the doctors in Accenture's survey said that patients should not be allowed to update their demo info), updating personal medical history could get trickier.

The system gets more complicated once you allow patients to not just access their medical records, but actually update them.

As the CIO, it's your job to design the kind of robust identity and access management system that can bestow the very granular read/write permissions this would require. Also, as I've argued before, when it comes to medical records, it's the integrity of the data -- not the availability or the confidentiality -- that is most important. Inaccurate medical information can kill people, so ensuring that your mortal enemy cannot tamper with your medical records and remove that part about your deadly allergy is rather important. Designing an I&AM system like this will not be an easy task, but it's essential if you want to enable patients to access and update their medical records.

You can give a patient the ability to add new information to his history, but what you don't want him to have is the ability to rewrite history. Maybe a person would rather delete the bit about the embarrassing rash he had 10 years ago, or delete that note the ER nurse wrote: "Patient was aggressive and appeared to be intoxicated." For both clinical and compliance reasons you don't want a patient to wield that sort of power.

And maybe you don't want to, now that you're thinking about how hard it is. Consider the positive possibilities, though. If a patient can update the list of prescriptions on her electronic medical record, then maybe an automated system can alert doctors that she is at risk of a dangerous drug interaction or unintentional fatal overdose. If a patient can add to one medical center's EHR the results of a lab test ordered by a different medical center, then we could eliminate costly redundant testing. So whether it's difficult or not, you should do it anyway, because the potential benefits are inspiring.