Legal protections of electronic health records: issues of consent and security.

Electronic health records (EHRs) – comprehensive compilations of a person’s health care history, accessible by health care providers and others through electronic networks – are a growing issue in Canada. In 2002, the Kirby Report and the Romanow Report made EHRs hot topics for media and policymakers by recommending their national implementation. While both reports recognized the potential of EHRs to improve health care delivery and enhance health system reform, they were also sensitive to growing concerns over the privacy of personal health information. In this paper, we discuss how health information protection laws in Canada seek to provide specific safeguards for personal health data collected, used and disclosed by electronic means. We begin with an overview of EHR initiatives in Canada and other jurisdictions. Next, we discuss some of the purported benefits and risks associated with EHRs. We then identify and comment on specific legal protections that have been enacted to address concerns regarding privacy and security of health information on electronic networks. In particular, we focus on statutory provisions that permit individuals to limit the inclusion and disclosure of their information via EHRs and that oblige those responsible for EHRs to implement specific technical measures to safeguard against unauthorized access and disclosure. We conclude by commenting on the competing interests legislators must balance in enacting legal protections for EHRs. Overview of EHRs Initiatives in Canada and Abroad