Why should we be careful with patient-identifying data?

The access to healthcare data supplied by thousands of individuals has proven essential to healthcare service providers worldwide. However, it is now crucial for healthcare practitioners to take patient privacy and data security into account while using patient data, especially when ignoring patient confidentiality might have long-reaching legal repercussions.

One way of making data anonymous is for the data controller to remove any personally identifying information from the data that the patients have submitted. The use of such de-identified data in conjunction with other information made available to a researcher should prevent the identity of the data subject from being revealed as the second level of security. Thus, data must be anonymized to guarantee the de-identification of personal information. The alternative is to obtain individual patient consent to use their medical information. This route is time-consuming and cumbersome.

Even de-identified information can occasionally be used to identify a person, rendering anonymity useless. Therefore, while processing electronic medical records, healthcare providers must guarantee that a system for patient privacy protection is incorporated.

In India, there is no clear regulation governing the release of medical records. However, every medical practitioner is required to uphold physician-patient confidentiality under the Indian Medical Council Regulations.  While a doctor can be accused of professional misconduct for releasing a patient's personal information, it is unclear whether this duty does apply to other people who process patient data on behalf of a state agency or a corporate institution. Patients' information can only be disclosed by doctors to public health authorities under particular conditions, such as when there is a "serious and identifiable risk to a specific individual and/or community."

Unlike in developed countries, the Indian judiciary has made the right to privacy an exception to the rule that allows public authorities to intrude in an individual's private life. The Supreme Court has often stated that the right to privacy is not absolute. Instead, the Court has opted to interpret the right to privacy on a case-by-case basis. An example of this is the Court has permitted a hospital to tell the patient's future spouse of his HIV-positive status in the interest of infection control.

Privacy is an important component of individual autonomy, and a large body of research has demonstrated both its practical use in healthcare settings and its standing as a fundamental, but not absolute, ethical right. Because the Right to Information Act (2005) allows individuals to get information under government control, it may be interpreted as a danger to the privacy of patients and research subjects, particularly those in government institutions. Clinicians, administrators, information officers, patients, and research subjects should be aware that the RTI Act does not normally compel or enable the disclosure of personal health information to third parties. Only in exceptional instances, when the greater public interest is sufficiently validated to support it, will the information gathered under clinical care or research be disclosed.

Author info:Dr.Sridevi Karuthedath,Speciality doctor ,ENT, Ysbyty Gwynedd,Betsi Cadwaladr University Health Board,Wales, Uk

MBBS(Government Medical college,Thrissur),MS ENT(Maulana Azad medical college,New Delhi),DNB Otorhinolaryngology(NBE,New Delhi),MRCS ENT(Royal College of Surgeons, England),Former Assistant prof. ENT( Amala Institute of Medical Sciences)