1 Introduction
1. An important aim of most developed health systems
is the creation, expansion and linkage of electronic patient record
(EPR) systems. The introduction of EPR technology offers numerous
and significant benefits. Storing and transferring patient information
electronically has the potential to significantly reduce clinical
errors and improve patient safety as well as allowing clinicians
to communicate more quickly and accurately and to identify relevant
information more easily. Good EPR systems can increase efficiency,
reduce duplication and waste, and improve the cost-effectiveness
of health services. EPR systems can also make information much
more readily accessible to patients, allowing them to assume more
control over their health records and thereby become more active
in their own care. In addition, electronic databases of health
information can be used for a range of purposes other than direct
care provision, for example clinical audit and research. It is
right to describe EPR as "potentially a transformative technology".[1]
2. However, alongside these new opportunities, EPR
systems also bring new risks, particularly to the privacy and
safety of health information. Electronic systems allow access
to data from many locations, increasing the likelihood of a security
breach; they can also give individuals access to much more data
than was previously possible, increasing the damage caused by
system misuse. Personal health information is often highly sensitive,
and it is therefore difficult to repair the damage caused by a
breach of privacy. All these risks can be mitigated, but there
is little doubt that EPR systems will create, as the European
Data Protection Working Party acknowledged, "a new risk scenario"
for personal health information.[2]
3. In the NHS in England, the development of EPR
systems was given central direction and impetus by the instigation
of the 10-year National Programme for Information Technology (NPfIT),
the largest civilian IT project in the world, in 2002. In developing
EPR systems, England is firmly in line with trends in the developed
world: EPR systems are being created in various forms in the USA,
Canada and Australia, as well as in Scotland, Wales and many countries
in the European Union.
4. The NHS Care Records Service (NCRS), and the infrastructure
upgrades required to support it, are the central plank of the
NPfIT project and account for the majority of planned expenditure.
While most GPs and hospitals have long been using IT systems for
a range of purposes, including patient record storage, NCRS seeks
to expand and link together electronic data about patients, as
well as significantly upgrading hardware, software and network
infrastructure. Upgrading, replacing and linking existing records
systems is intended to lead to the creation of electronic Detailed
Care Records, available across local health economies. NCRS will
also provide a separate Summary Care Record for each NHS patient,
available throughout England.
5. While the benefits of EPR systems are widely acknowledged,
NPfIT's implementation, and particularly the delivery of NCRS,
has recently been subject to widespread questioning and criticism.
Delays of at least two years have affected the Summary Care Record
project and the upgrades to Patient Administration Systems (PAS)
required to support the Detailed Care Record. A report by the
National Audit Office in June 2006 praised NPfIT's initial contracting
arrangements but criticised the lack of information about when
new systems were likely to be implemented. In March 2007, the
Public Accounts Committee concluded that there is still "much
uncertainty" about when and what NPfIT will deliver, highlighting
ongoing delays to NCRS. Meanwhile, the piloting of the new Summary
Care Record system, which began in spring 2007, has sparked public
debate about the privacy and security of the new systems. Academics,
the media and growing numbers of clinicians and patients have
all expressed serious doubts about the organisation and performance
of NPfIT.
6. In light of these wide-ranging and serious concerns,
and of the great benefits to patient care offered by EPR systems,
the Committee decided in February 2007 to hold an inquiry. Rather
than examining the whole of the NPfIT project, we chose to focus
on the NCRS project, the most expensive, most ground-breaking
and most controversial element of the programme. Our terms of
reference were as follows:
- What patient information will
be held on the new local and national electronic record systems,
including whether patients may prevent their personal data being
placed on systems;
- Who will have access to locally and nationally
held information and under what circumstances;
- Whether patient confidentiality can be adequately
protected;
- How data held on the new systems can and should
be used for purposes other than the delivery of care e.g. clinical
research; and
- Current progress on the development of the NHS
Care Records Service and the National Data Spine and why delivery
of the new systems is up to two years behind schedule.
7. The Committee received more than 70 written evidence
submissions from academics, lawyers and IT companies, as well
as a number of staff and patient groups. The Department of Health
provided an initial memorandum in March 2007 and sent additional
submissions on 12 June and 16 July. We held oral evidence sessions
between April and June 2007, hearing from, amongst others, civil
servants, doctors, lawyers, IT suppliers, patient groups, the
Assistant Information Commissioner and the Minister of State for
Quality. The Committee also visited Nashville, Ottawa, Amiens,
Paris and Hackney in order to look at and discuss EPR systems.
8. Our report considers the issues raised by the
inquiry under the following headings:
- Overview of EPR systems;
- The Summary Care Record;
- The Detailed Care Record; and
- The Secondary Uses Service.
9. The Committee would like to thank those who submitted
evidence and those we met during our visits, as well as the staff
of the Foreign and Commonwealth Office who made these visits possible.
We are particularly grateful for the expert advice which we received
from our specialist advisors Professor Ross Anderson, Dr Jem Rashbass
and Professor John Williams.
1 Ev 81 Back
2
See European Data Protection Working Party, Working Document
on the processing of personal data relating to health in electronic
health records (EHR), 00323/07/EN, WP131, p.5 Back
|
