Problems on a transborder EHR system in Asia-Pacific region
Takeshi Tanaka, Kiyomu Ishikawa, Hidehiko Tsukuma, Norikazu Iwata*, Minoru Ikeuchi**
Hiroshima University Hospital, Hiroshima, Japan
Information Media Center of Hiroshima University, Higashi Hiroshima, Japan*
Kure University Junior College, Kure, Japan**
Abstract
Using a simple model, the authors show the ethical, technical and administrative problems of trans-border electric health record system in a situation of serious disaster whose victims have various nationalities focused on the problems of languages and identification of dead bodies.
As results, the authors show the importance of least data set with multi-language characters and treatment of death to keep the rights of patients and medical professionals.
1. Introduction
On 6th Dec. 2004, the huge earthquake with tsunami from off west coast of northern Sumatra in Indian sea caused approximately 283 thousands of deaths and several kinds of damages in various nations. In pacific region, such an international disaster of earthquake with tsunami from Chili had also caused approximately 22 hundreds of deaths not only in Chili but also Japan, Hawaii and Philippines, and obtained damages to the above nations and USA in 1960. Farther more, all of the largest earthquakes (over M8.5) in the world in the last hundred years happened in this region. Thus, people in Asia-Pacific region may be thought to have such a risk of disaster basically [1].
In the case of Sumatra, the identification of dead bodies was one of significant problems. Dental records were the most useful data for the identification in Thailand, in which about two thousands of foreign bodies from 33 nations were identified [2]. Not only dead bodies, but also identification and protection of children lost their parents were serious problems so that Indonesia government was donated electronic fingerprint child ID systems [3].
As a recent economical development in Asia-Pacific region, many people in this region, people working, living and sightseeing internationally have been increasing. For example, the number of Japanese people of lengthier stay or permanent residents in Asia-Pacific region (except North and South America) were about 303 thousands people in 2004, whose ratio of increase were larger than these in other regions in the world [4].
It is very helpful to make an international electric health record (EHR) system taking into account of multi-nationalities in Asia-Pacific region in the situation of international disaster to provide appropriate medical other services immediately. There are the international
guidelines of transborder flows of privacy data determined by OECD, in which main principles are shown: Several nations in EU and USA have already passed legislation [5], so that a transborder EHR can be constructed between them.
Nevertheless, countries in Asia-Pacific region have more various languages, cultures, religions and so on, than these of EU countries. Thus, we should take into account of these varieties to make an international EHR system in this region.
In this paper, the authors show problems of international EHR system in a case of international disaster by using a simple model. Categories of data and access privileges to them on the model EHR system and sample cases to simulate are shown in Ch. 2, problems picked up are shown in Ch. 3, and they are discussed in Ch. 4.
2. Materials and Methods
We suppose an international EHR system between several nations ratified the OECD guidelines, in which EHRs of patients of several nationalities flow.
2.1. Players on the model system
We suppose the following players, individual users or officers to use this system as following; a patients, his/her next keen determined by the law, his/her primary doctors in his/her domestic region, medical professionals in charge for him/her, other medical professionals not in charge, the domiciliary registration office of patient, police (both domestic and ICPO) or immigration or consular officers, and system administrators.
2.2. Categories of data
Categories of EHR data are classified into three levels; non-sensitive personal data, highly sensitive data, the most sensitive data. The first level is for personal data for an identification of patient but not so sensitive which can be shown by all professionals using the system, name or date of birth of patient, for examples. The second is restricted sensitive data which can be seen by professionals for the patient in charge for their purpose of professions; biometrical or medical data like dental data or fingerprints for examples. The third is restricted highly sensitive data which can be seen by a patient and his/her primary doctor, for an example, DNA information [6].
A00691
To control the system safely, access log data must be recorded. And access privileges of all users should be controlled by the administrators of the system perfectly.
2.3. Access privileges to EHR data on the model system
The accessibility to EHR data on the model system are defined according to the principle of the guidelines of [5] in the table 1.
Although a patient basically holds a right to control his/her personal information, it does not mean that a patient can write all EHR data at his/her own will, since EHR is an official record of medical practice on him/her. Medical professionals have right to use EHR data of the patient in charge according to their profession, and hold rights to control EHR data of their medical practice with the patient. The primary doctor knows all EHR of the patient.
A role of next keen of the patient in this paper is to help an identification of dead body with police or immigrant or consular officers, who have rights to see EHR data by the domestic law of them. The domiciliary registration office of patient gives only the information whether the patient is dead of alive on his/her domiciliary registration to this EHR system.
System administrators can correct EHR data and access privileges of users by the order of right holders of data, or disclose proper EHR data to appropriate persons by the international guideline or the domestic law. They can also audit log files of EHR data to protect the privacy of patient as professionals to control the system.
Any other intruders to the system are rejected perfectly.
2.4. Cases to simulate
Simulating the problems of EHR system between several nations in Asia-Pacific region with multi-nationalities in a serious international disaster, it is very difficult for us to seek keys in solving problems by such a multiplicity. Thus, we will focus on two problems. The first case is due to verbal difference; it is difficult to make sufficient communication between medical professionals and patients. The other is identification of unknown bodies on postmortem investigations.
As a sample of the former is that a person who met a disaster in a foreign country is carried to a hospital: Immediate and continuous medical treatments (ischemic heart disease, diabetes, and so on) should be done: The medical professionals have to obtain his/her minimum health information as following; the diagnosis and drug history at the first step, examination data and operation history at the second, and at the third step, the characteristic of body (length, tooth form, deficit of body, etc…) for identification of unconscious patients and bodies are needed. These steps are determined by the degree of demand on emergency state.
The latter is an identification of an unidentified patient who is dead in a foreign hospital by a disaster: The
police or immigrant or consular officers have the list of missing persons who would be met the disaster.
The identification of victims is an important task in an early phase of countermeasure of disaster. It could be helpful for police or immigration or consular officers to search a victim on EHR with the ID of patient.
On these two cases, we will consider ethical, technical and administrative problems.
3. Results
Using the model and sample cases defined in the above section, we will point out problems which are not well discussed up to now.
3.1. Problems on a patient using a different language than that used in a hospital
3.1.1. Ethical problem
Generally speaking, there are many problems on informed consents in emergency situations; especially in a case that patient cannot explain his/her will.
In this paper, nevertheless, the authors define the principle of using EHR system is to save a life of patients in any situation, and do not discuss the ethical problems on this case.
3.1.2. Technical problem
Multi-byte characters on the computer are used in Asian countries, for example, China, Japan, Korea and Taiwan; where medical records are written in these characters. If the patient comes from these countries to the country where these characters are not used, medical professionals cannot read the EHR data. Although medical professionals could know his/her disease from EHR by ICD-10 codes, they could not know the drug history since there are no international codes for drugs or medicinal properties. The same thing can also be said on the second step.
3.1.3. Administrative problem
System administrators in every nation should prepare a proper rule and procedure of data disclosure (including access logs) not only for police or immigration or consular officers but also for the patient in a way he/she could understand it to keep transparency.
3.2. Problems on the identification of dead
In the second case, the problems are more difficult than the first case since the guidelines are not clearly defined: Many guidelines recommend applying the guidelines for living persons correspondingly to dead [7]. However we don’t discuss that problem deeply for a convenient.
In this case, any patient doesn’t play a main role: Police or immigration or consular officers play important
A00692
roles by the law. According to the list of missing persons, the officers collect the information to identify the dead bodies from medical professionals, the next keens and EHR data of prospects. In the future, they could obtain DNA information from an EHR system.
3.2.1. Ethical problem
After the identification, the reason to present his/her
EHR data is lost.
For an example in Japan, the legal death of patient determined by a procedure in his/her domiciliary registration office. Thus, the EHR system doesn’t have legal correct data of dead or alive after the system could obtain the “correct” information from the domiciliary registration office. After that the patient loses the right as a living human.
We must have international guidelines of the treatments of dead patient’s data.
3.2.2. Technical problem
Tooth profiles and surgery reports are useful for identification. Thus, these records should have a data structure to search by a tooth or a part of body.
After the identification, statistic data of dead people are used for public health or preventive medicine or basic data of medical science in many nations. Such a secondary use of medical data for public can be made by anonymization of health records.
In a case of huge disaster, a probability of miss-identifications of dead is not negligible. Thus, we have to anonymize EHR data of dead in a linkable fashion [8] in during some period of time for a “rebirth” of dead on the system, if we take these data from EHR system for a secondary use. To protect the privacy of dead people, we had better to anonymize EHR data of dead in an unlinkable fashion after that period.
Thus, the authors think that we had better two steps of anonymization to use EHR data of dead for secondary use.
3.2.3. Administrative problems
Considering on human rights and dignities of dead as discussed above subsections, system administrators should have procedures or data connections to obtain the information of dead or alive from every domiciliary registration office in nations supporting the EHR system timely to protect the rights of living people and dignities of dead people.
They should also take care of disclosing of highly sensitive data as DNA information which may violates not only the dignity of dead patient, but also the rights of his/her living families. Administrators must make strict procedures to disclose highly sensitive data.
4. Discussion and Conclusion
4.1. Discussion on a patient using a different language than that used in a hospital
For proper first-aid treatments of foreign patients on EHR, it must be necessary the international standard codes of diseases, medicinal properties, operations, treatment, so on. Except ICD-10 for diseases, there are no standard codes enough useful. The standard code for medicinal properties especially should be prepared immediately.
After the first-aid, medical professionals might need informed consent from the patient to obtain the information from EHR or his/her primary doctor. It is helpful and comfortable for the patient that the system shows or prints the information enough to obtain informed consent. In addition, many “Kanji” or Chinese characters have the same or similar sound between them. Thus, use of roman character might bring a risk to mix-up the patient. To solve these problems, it is not enough to use multi-language character code such as UTF-8 in the EHR system. It needs to prepare the informed consent form in both domestic language and common language on the system. POC to his/her primary doctor must be on the system to obtain a letter or summary in a common language. Good software of translation would help not only medical professionals and patients but also administrators. The above factors need to keep the right of users of the EHR system.
4.2. Discussion on the identification of dead
For convenience to identify dead bodies, it is necessary to define the structure of second level data in EHR, especially for tooth profiles and surgical reports for searching prospect of bodies. However the treatment of DNA information must be more careful. It also should be defined the procedure to obtain the consents from the next keen and primary doctor of victim to obtain the DNA information.
The first task of the problem of right of dead person is to determine the guidelines to treat the EHR data of dead which could be obtained consensuses in nations supporting the EHR systems. In Asia-Pacific region, it may be more difficult than that in EU. Thus, this should be considered more actively as a proper problem of this region having various cultures and religion, and connected with seas and disasters.
References
[1] U.S. Department of the Interior | U.S. Geological Survey, http://earthquake.usgs.gov/regional/world/byyear.php http://earthquake.usgs.gov/regional/world/events/1960_0 5_22.php http://earthquake.usgs.gov/regional/world/10_largest_wo rld.php
[2] P. Sribanditmongkol et al, “Forensic aspect of disaster causality management: Tsunami Victims
Identification in Thailand”,
A00693
http://www.who.int/hac/events/tsunamiconf/presentation s/2_16_forensic_pongruk_doc.pdf
[3] Cross Match Technologies, Inc., “Cross Match Technologies and ITOCHU Make Joint Biometric Technology Donation to Indonesian Government to Track Tsunami Children”,
http://www.crossmatch.com/pr/Indonesia_7_12_05.html
[4] The Ministry of Foreign Affairs of Japan, “The statistics on numbers of Japanese foreign residents in the
Heisei 16th year.” http://www.mofa.go.jp/mofaj/toko/tokei/hojin/05/pdfs/2.
pdf (in Japanese).
[5] “OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data”
http://www.oecd.org/document/18/0,2340,en_2649_342 55_1815186_1_1_1_1,00.html
[6] K. Ishikawa, “Health Data Use and Protection Policy; Based on Differences by Cultural and Social
Environment”, Int J Med Inform. 2000 Nov; 60(2):119-25.
[7] For example, Ministry of Health, Labour and Welfare, Japan, “Ethical guidelines on clinical researches”, http://www.mhlw.go.jp/general/seido/kousei/i-kenkyu/ri nri/0504sisin.html (in Japanese).
[8] Ministry of Health, Labour and Welfare, Japan, “Ethical guidelines on research of human genom and
DNA analysis”, http://www.mhlw.go.jp/general/seido/kousei/i-kenkyu/in
dex.html#1 (in Japanese).
Table 1: Access Privileges on the model EHR system
Patient Medical Professionals Organization.
Data
Patient Next keen Primary doctor. Professionals in charge Professionals not in charge Domiciliary registration office Police / Immigrant / consular office System Administrator 1st level R r P P P wr r wr 2nd level R r R R No No r wr 3rd level R No R No No No r wr System Log No No No No No No No P Access privileges No No No No No No No wr
Caption R : Right holder.
P : Holder of right of proper use by one's professional. wr : Writable by the permission of right holder or law.
r : Readable by the permission of right holder or law. No : No privileges
A00694
