Keeping it confidential

As Dubai pulls the plug on its data reporting initiative amid fears of poor patient privacy, Medical Times examines the issues surrounding good clinical data protection.

The debut of an electronic patient data reporting scheme in Dubai this July sent ripples of panic through the medical community. And with good reason; for the system not only asked doctors to submit patients' personal details alongside sensitive clinical data, but also failed to ask patients for their consent to do so.

MT exposed the crisis in its September issue. Within a week, the Department of Health and Medical Services (DoHMS) had binned the two-month-old initiative and handed the data collection reins over to the incoming Dubai Health Authority (DHA).

DHA's newly appointed head of strategy and innovation Dr Peyvand Khaleghian said his first role had been to tackle this political hot potato.

"DoHMS were doing the right thing to collect data for planning services," he said. "But you need confidence in the consequences. Doctors had every right to be concerned and we share those concerns completely."

The problem, he admitted, was that the necessary data protection protocols had not been put in place, leaving the system open to potential abuse. "When DHA took over we realised that it was not the time to collect this clinical data," Dr Khaleghian said.

Sense of security

While the situation has undoubtedly damaged trust in electronic reporting systems, it has also exposed the legal grey area surrounding medical data.

The United Arab Emirates has laws in place that broadly govern data protection, with three referring specifically to electronic data. But none are designed to specifically cover confidential health information and there is no mention of whether these also apply to the government.

Still, it's not just the lack of legal clarity that poses potential problems. The very act of passing clinical information en masse to a central database raises the risk that it can be accessed by a third party, acknowledged Dr Philip Vetter, head of strategy at Health Authority Abu Dhabi (HAAD).

The Authority has imposed an online data gathering system on its hospitals, as part of the emirate's health insurance scheme.

"If we have the information in theory we can do something with it," Dr Vetter said.

The scheme requires both public and private hospitals to report clinical data, including personal patient information, when billing insurers for inpatient stays.

In contrast to Dubai's more haphazard approach, HAAD consulted with stakeholders before introducing the scheme, drawing up a 53-page document to clearly outline the standards of data protection expected from all involved. The report distinguished confidential patient information (CHI) - for example, a patient's contact number displayed alongside their diagnosis - from basic data.

The strictest data protection protocols are used to house CHI, Dr Vetter said. "The data is coded in a data warehouse, to which there is a logon and password.

"But that is one person and no-one else can get in. There's an audit form, so for anyone who's accessing it there's a trail."

The system differentiates its data using international category codes. A woman who is single and pregnant, for example - in breach of UAE laws - cannot be identified by HAAD because pregnancy is not a coded diagnosis. The information submitted to the health authority would show a pregnancy test was carried out (no result needed), by a named doctor on a person in a certain demographic - no name attached.

Dubai Healthcare City (DHCC) has a similar state-of-the-art data warehouse system. The set-up meets global data protection and storage standards and using internationally recognised codes, said Dr Alysha Mutawa vice president of the Centre for Healthcare Planning and Quality (CPQ).

 The free zone's 64 clinics send clinical data to the central database as part of their contractual agreement, and have been doing so for the past three years. Only clinical data is reported: not patients' names.

"We do not require the patient's name - it stops at a clinical level," Dr Mutawa explained. "We want to look at trends of specific diseases and on specific demographic groups, and look to see that our healthcare providers are practising within their scope of license."

The ‘no name' approach gives further assurance a patient's identity won't be linked to their diagnosis - the chief concern voiced by doctors over the DoHMS scheme. Dr Alya Ahmad is a paediatrician at APC Clinic in the free zone, who also runs clinics outside of DHCC. "In the DoHMS sector basically we were documenting patient information as you would document it on a medical chart," she said. "This means [patients'] identification, medications, referrals - everything we would document on a medical record was online information."

Common consent

Patient consent didn't feature in the DoHMS scheme, but is a main component of DHCC's data collection method.

Patients registering for treatment are all required to sign an agreement that their clinical information can be passed on for audit purposes, Dr Mutawa confirmed.

Under the HAAD's scheme, consent it built into the system. A clause in the contract between hospitals and health insurers, which is signed by the patient, releases clinical data. Any information sent to the third arm, the health authority, is used for quality assurance purposes only, Dr Vetter added.

Its understood that Dubai's public sector healthcare facilities will continue to collect patient data under the previous system. A DoHMS spokesperson was unable to clarify whether the personal details of patients would continue to be submitted.

Trust funds

Key to success with any electronic data system is signing all stakeholders up to the same standards of data protection; whether public or private. "You apply the same rules to us as to everyone else," said Dr Vetter. "It's easier for patients to understand."

HAAD has also created an access panel, with seats for all stakeholders including patients, to make decisions about who can access the collective patient data.

Early involvement of all interested parties is key to ensure mutual trust - an essential goal for good ongoing data protection, Dr Vetter warned.

"There must be trust in the system, trust in us and trust in HAAD that it works. One thing you need to start with is that this is not trivial and this data is always OK.

"You want to be clear who has access to the system and what you are allowed to do with that data."

READERS' COMMENTS

MORE FROM ARABIANBUSINESS.COM