Legal, Ethical, and Financial Dilemmas in Electronic Health Record Adoption and Use

Abstract

Electronic health records (EHRs) facilitate several innovations capable of reforming health care. Despite their promise, many currently unanswered legal, ethical, and financial questions threaten the widespread adoption and use of EHRs. Key legal dilemmas that must be addressed in the near-term pertain to the extent of clinicians' responsibilities for reviewing the entire computer-accessible clinical synopsis from multiple clinicians and institutions, the liabilities posed by overriding clinical decision support warnings and alerts, and mechanisms for clinicians to publically report potential EHR safety issues. Ethical dilemmas that need additional discussion relate to opt-out provisions that exclude patients from electronic record storage, sale of deidentified patient data by EHR vendors, adolescent control of access to their data, and use of electronic data repositories to redesign the nation's health care delivery and payment mechanisms on the basis of statistical analyses. Finally, one overwhelming financial question is who should pay for EHR implementation because most users and current owners of these systems will not receive the majority of benefits. The authors recommend that key stakeholders begin discussing these issues in a national forum. These actions can help identify and prioritize solutions to the key legal, ethical, and financial dilemmas discussed, so that widespread, safe, effective, interoperable EHRs can help transform health care.

WHAT'S KNOWN ON THIS SUBJECT:

Electronic health records facilitate several innovations capable of reforming health care. Despite their promise, many currently unanswered legal, ethical, and financial questions threaten the widespread adoption and use of electronic health records.

WHAT THIS STUDY ADDS:

Pivotal legal, ethical, and financial issues need to be addressed if higher quality, lower-cost health care through widespread electronic health record use is to be achieved. A series of conversations, involving patients, lawyers, ethicists, economists, policy-makers, informaticians and clinicians must begin now.

Most stakeholders in the health care reform debate endorse adoption of state-of-the-art electronic health record systems (EHRs) with advanced clinical decision support (CDS). EHRs facilitate the management of individual patient data and the development of large repositories for analysis of system-level data. Both innovations are necessary for successful health care reform. Despite tremendous progress in clinical informatics over the past 50 years,¹ widespread EHR use leads to many new challenges (ie, some affect all clinicians and some are specific to those clinicians caring for children and adolescents²) that need to be addressed. We call for heightened attention and action on certain legal, ethical, and financial dilemmas that have not yet garnered significant attention. These issues, if neglected, can challenge additional EHR adoption and future health care reform.

Legal Dilemmas

The legal system, which relies on precedent and lags behind adoption of new technologies including EHRs, offers little guidance to navigate the transition from paper-based to electronic records.³ For instance, with the renewed push to develop local, state, and national health information exchanges (HIEs),^4–6 providers will finally have rapid computer access to more than a single organization's paper-based chart. Although these initiatives address longstanding issues related to missing clinical information,⁷ there is no statute or precedent to address the extent to which clinicians are responsible for reviewing information in a community-wide integrated EHR that contains data from many sources.⁸ Many providers currently find it impossible to review the complete record within a reasonable timeframe. In addition, the integrated EHR introduces several additional liabilities.⁹ First, in contrast to paper-based records, in which incomplete or illegible information is not unusual,¹⁰ EHRs can store virtually unlimited amounts of perfectly legible and instantly accessible records that include nearly every aspect of care regardless of where or when it took place, all of which is “discoverable.”^11,12 Patients in large, integrated, “early EHR-adopter” institutions (eg, Kaiser Permanente Northwest¹³ and the US Department of Veterans Affairs health system¹⁴) have already amassed individual archives of clinical notes, laboratory results, radiographic images, and provider-to-provider correspondence spanning many years. This virtual “mountain” of data can lead to information overload, a new liability¹⁵ that can lead providers to overlook key findings despite reliable access to documentation.^16,17 For instance, clinicians who miss a critical detail that affects treatment decisions while reviewing the EHR could in fact be liable for negligence because “the fact in question was likely just a few clicks away.”¹⁸ Moreover, even if clinicians named in the lawsuit are not directly affected, the institution they work in could be considered liable under the concept of “respondeat superior.”^*

Second, EHRs may increase clinicians' legal responsibility and accountability.¹⁹ Sophisticated computer-based auditing procedures,²⁰ as opposed to paper-based record sign-out logs, can identify individuals who review, or fail to review, key information in the EHR.²¹ Take the scenario in which an abnormal finding is documented in the EHR and subsequently reviewed by multiple clinicians but never addressed. Although in paper records it is not always easy to tell who accessed that information, an EHR audit log easily reveals evidence of this lapse. Similarly, alerts for abnormal test results might be reviewed but not acted on, on the basis of the assumption that another clinician was responsible.²² Although some of these issues have not yet gained traction in the court system, these issues will become more pressing as the nation's health information network comes online and large volumes of patient data become accessible to increasing numbers of clinicians.²³

Third, documentation-related issues introduce new liabilities. Many EHRs contain progress note documentation templates, which allow recent test results to be automatically imported. The liabilities providers incur when they inadvertently import clinical findings not within their clinical purview and sign the note electronically²⁴ are not clear. Similarly, sequentially written notes that are copied and pasted may contain an extraordinary volume of information and look strikingly similar, displaying repeated information that is no longer correct.²⁵ Documentation created using templates, copy-paste or “macros” that allow clinicians to type a short phrase preceded by a standard nonalphanumeric character (eg, a period [.], which expands into a much longer, predefined text string)²⁶ might raise issues related to what is considered “billable” by insurance companies. Although some EHR systems highlight copy-and-pasted sections and text created using macros, and some disallow them altogether, tackling these issues will bring forth challenges.

Fourth, what liabilities do providers face if they do not follow CDS recommendations?¹⁸ This issue is especially pertinent to clinicians who face overwhelming numbers of CDS medication-interaction alerts, which may appear even when risks are negligible (eg, when prescribing oral statins with topical ketoconazole shampoo²⁷). Recent concerns about alert fatigue and high override rates are justified and need to be addressed.²⁸ In the current environment, however, the legal pressure to maximize Food and Drug Administration-required CDS recommendations outweighs concerns about “alert fatigue” and information overload that arise from suboptimal CDS design. Thus, clinicians who want “nuisance” medication interactions removed from their CDS system face an uphill battle. Currently, legal implications of removing CDS alerts (eg, by CDS content vendors, EHR vendors, or health care organizations) are ambiguous, as are the implications of provider nonadherence to these alerts.²⁹

Finally, problems regarding usability, quality, and reliability of currently available EHRs^30–32 bring about complex legal ramifications. For instance, the “hold harmless” clause in many EHR contracts restricts the ability of clinicians to report EHR-related problems.³³ To improve current EHR's capabilities and reliability, clinicians must be able, at a minimum, to report safety issues without fear of recrimination. Recently, the Food and Drug Administration, as part of its National Strategy for Monitoring Medical Product Safety,³⁴ has called on 350 organizations to begin reporting all EHR-related safety hazards (www.medsun.net).³⁵ Potential solutions proposed include more stringent oversight of several aspects of EHRs, including features and functions, usability, clinical decision support, and serious large-scale system outages, to name just a few.^36,37

Ethical Dilemmas

Enhanced portability and accessibility of EHR data raises ethical questions regarding ownership of protected health information (PHI)^38,39 and clinicians' responsibility to prevent and inform patients of the potential for privacy breaches. A small but vocal minority of patients are concerned with the increased risk of unauthorized PHI disclosures via EHRs. These concerns may be valid. For instance, several EHR vendors (eg, Cerner,⁴⁰ GE,⁴¹ and Allscripts [formerly Eclipsys⁴²]) have sold deidentified copies of their patient databases to pharmaceutical companies, medical devicemakers, and health services researchers. Deidentified data sets can often be reidentified using publically available external data sources.⁴³ In reaction to these and related concerns, several patient privacy advocacy groups have called for a right to “opt-out” of having one's PHI stored in EHRs,⁴⁴ which will cause new ethical and financial dilemmas. Compliance with opt-out provisions will likely require additional clinic time and resources to maintain separate paper-based records, and clinicians may be less inclined to care for these patients. Clinicians might not be able to collect “meaningful use” Medicare payments⁴⁵ on these patients. Perhaps the central ethical question is whether for-profit secondary uses of data are appropriate and justifiable, and if so, what privacy safeguards should be employed.⁴⁶

Computer-based personal health information breaches also raise complex ethical and legal issues regarding the appropriateness of current methods to address them. For instance, currently institutions use audit logs as evidence to justify firing personnel who deliberately access EHRs without authorization.⁴⁷ Although privacy breaches certainly occurred with paper-based records, they were limited in scope and almost impossible to detect.⁴⁸ What recourse is appropriate for clear, albeit often unavoidable, violations of EHR use guidelines, for instance, an employee is pulled away from their workstation for an emergency while logged in, and a bystander surreptitiously accesses multiple patient records?

The implementation of EHRs⁴⁹ and state HIEs⁵⁰ will inevitably generate data to redesign and rationalize the nation's health care delivery and payment mechanisms,⁵¹ leading to additional ethical dilemmas. This data-driven approach is likely years away, but many related issues need to be addressed, such as who will oversee the data aggregation, verification and validation, and analysis; who will have data access; who will make the final data interpretations; and assuming that everyone agrees they are correct, who will adjudicate the ethical disagreements that inevitably surface when data are used to inform new health care policies. Nonpartisan, multi-disciplinary, expert review-panels composed of clinicians, statisticians, informaticians, ethicists, and patient advocates, for example, could be convened and charged with providing such oversight.

Finally, many ethical dilemmas surrounding privacy and control of electronic information are unresolved.⁵² For example, with increased availability of personal health records, clinicians must be careful to maintain the rights of adolescents in light of their parents' proxy access to their data.^53,54 Although adolescents are allowed to protect information from their parents and consent to treatments for certain sensitive conditions in which a need for parental involvement may inhibit care, consent to other therapies still requires parental involvement.⁵² Other than having a separate confidential EHR, it is not clear how personal health records will restrict parental access to this sensitive information.⁵⁴ As adolescents reach adulthood or are emancipated, other issues to consider are who will decide whether and when organizations should transfer control of the electronic records created when the patient was a child.

As the number of organizations participating in HIEs increase, problems associated with reliably and uniquely identifying individual patients, a requirement to maintain patient privacy and data integrity, will increase. This issue poses a substantial barrier to EHR and HIE adoption and use because current deterministic, probabilistic, and biometric patient matching algorithms fail to correctly match patient records 5% to 10% of the time.⁵⁵ To improve the accuracy of matching patient data from disparate sources, the development of a nationwide, health care-related, unique patient identifier (UPI) was proposed. However, in 1998, Federal regulations and public outcry about infringement on right to privacy thwarted development of the UPI mandated in the 1996 Health Insurance Portability and Accountability Act known as HIPAA.^56–58 A renewed, healthy, national debate that involves key stakeholders needs to address the legal, ethical, and scientific advantages and disadvantages of an UPI and explore alternative solutions.

Financial Dilemmas

A key unresolved financial issue is who should pay for the implementation and use of EHRs and HIEs. Under most current provider reimbursement models, an estimated 89% of the monetary benefits from EHR use goes to health care payers rather than to those who currently finance EHR implementations.⁵⁹ In addition, EHR use can potentially decrease individual provider productivity by 10%.⁶⁰ Physicians are understandably concerned about the cost and resources required for implementing and maintaining EHRs, estimated at approximately $40 000 to $50 000.⁶¹ Although the recent federal stimulus package helps reimburse clinicians for some of these costs, questions about private health insurers' role in funding EHR and HIE implementation remain because private insurers are among their major beneficiaries.⁶² Conversely, the recent passage of the Patient Protection and Affordable Care Act with its Accountable Care Organizations⁶³ and the emphasis on the patient-centered medical home model⁶⁴ offers promise for the increased financial support of EHR and HIE implementation.

Another dilemma of particular importance to pediatricians arises from longer record retention requirements (ie, records for minors and obstetrics patients must be maintained through age 21 of the child or 7 years from the last date of service, whichever is longer⁶⁵). Although paper-based charts can simply be kept in a dry, locked room, in a rapidly evolving digital era, safe, secure, and verifiable access to records created from technologies (ie, hardware/software) more than a decade old, is a much more difficult and expensive proposition.⁶⁶ It is unclear how pediatricians will maintain these electronic records long-term, and who will pay for storage and maintenance after they retire.

Lastly, reducing costs in health care is overdue, but many are concerned about the downstream effects of reducing health care expenditures through EHRs and HIEs. For example, previous test-result availability in local HIEs was estimated to result in an annual $10 million loss for all hospitals in the Portland, Oregon, metropolitan area.⁶⁷ Although there is no current evidence to determine if or how cost shifting will occur, these issues are also likely to cause dilemmas that would need to be addressed.

In summary, pivotal legal, ethical, and financial issues need to be addressed if higher quality, lower-cost health care through widespread EHR use is to be achieved. A series of conversations, that culminate in a national forum involving patients, lawyers, ethicists, economists, policymakers, informaticians and clinicians, all of whom have high-stakes in these issues, must begin now. The goal of these conversations should be to identify and prioritize solutions to the key legal, ethical, and financial issues addressed in this commentary.