A personally controlled electronic health record for Australia

Abstract

Objective

On July 1, 2012 Australia launched a personally controlled electronic health record (PCEHR) designed around the needs of consumers. Using a distributed model and leveraging key component national eHealth infrastructure, the PCEHR is designed to enable sharing of any health information about a patient with them and any other health practitioner involved in their care to whom the patient allows access. This paper discusses the consumer-facing part of the program.

Method

Design of the system was through stakeholder consultation and the development of detailed requirements, followed by clinical design assurance.

Results

Patients are able to access any posted information through a web-accessible ‘consumer portal.’ Within the portal they are able to assert access controls on all or part of their record. The portal includes areas for consumers to record their own personal information.

Discussion

The PCEHR has the potential to transform the ability of patients to actively engage in their own healthcare, and to enable the emerging partnership model of health and healthcare in medicine. The ability to access health information traditionally kept within the closed walls of institutions also raises challenges for the profession, both in the language clinicians choose and the ethical issues raised by the changed roles and responsibilities.

Conclusions

The PCEHR is aimed at connecting all participants and their interventions, and is intended to become a system-wide activity.

Background and objective

Across the world, health is being increasingly computerized¹ with significant uptake across most of the developed world including Australia.² This creation of an eHealth environment has led to increasing attempts to enable sharing of information beyond the traditional institutional boundaries using interchangeable data.³ Such computerization of healthcare is changing clinical encounters⁴ and altering the balance of power in consultations in favor of the patient.⁵ The traditionally dyadic relationship is now being described as triadic.⁶ The resulting paradigm is increasingly one of a patient with knowledge of their medical conditions and care, in a partnership with the healthcare providers they choose to involve in their care. All participants as a result understand the medical conditions better with visibility of the component care pathways instituted by all practitioners.⁷

A technically simple, but socially challenging concept is to also allow patients to access the health information created about them.⁸ These ‘personal health records’ have ranged from patient input systems to web interfaces to existing institutional systems.³ Each implementation raises challenges around privacy, access, and the nature of the information to be shared. Local policies usually specify that record access is controlled by the institution rather than the consumer.^{9 10} Although the early emphasis has been on protection, the importance of sharing is now being recognized in privacy frameworks.¹¹

Microsoft's ‘HealthVault’ and the now defunct ‘Google Health’ are (or were) prominent examples of personal health records. Personal health banks or records^{12 13} are similar attempts to allow consumers to access their health information, but are provided by third parties, in some cases independent of direct relationships with health providers. At present these systems are limited to small implementations. Large national-scale systems are a potential solution to limited uptake, but in the UK and France have had difficulties, with the UK ‘HealthSpace’ being decommissioned and the French system developing slowly with only 0.31% of the population with a record.¹⁴ Increasingly, other large scale implementations are being attempted,¹⁵ often as online portals to pre-existing provider-to-provider shared records.

In the May 2010 budget, the Australian government announced plans and funding to develop and implement a national-scale personally controlled electronic health record (PCEHR). The decision was based on the 2008 National Health and Hospitals Reform Commission's recommendation to establish a PCEHR as one of the ways to create ‘an important systemic opportunity to enable person-centered care, support informed consumer decision making, improve quality and safety of care, reduce waste and inefficiency, and improve continuity and health outcomes for patients.’¹⁶ Funding of A$467 million was provided to design and build the first release of the PCEHR.

Design was an iterative and detailed process. A concept of operations (available at http://tinyurl.com/kw8sho7) was developed after extensive consultation with consumers, providers, software developers, and policymakers among the various stakeholder groups that informed the build. Over 100 meetings were held across the country. Design and specification development was carried out by the National E-Health Transition Authority (NEHTA) under contract from the Commonwealth government. The business requirements were developed from the concept of operations, and then detailed clinical scenarios were created that informed a clinical design and testing process.¹⁷

The first release of the PCEHR system was on July 1, 2012. The key objectives were to design a useful, accessible, safe, and clinically relevant source of cogent, contemporaneous, and comprehensive information, the provenance of which could be assured while the privacy and confidentiality requirements of clinical practice were safeguarded. This article outlines the consumer-facing aspects of the PCEHR, with a discussion on how it implements ‘personal control.’

Health system

Healthcare in Australia is governed by multiple agencies and funding streams. The States and Territories (jurisdictions) are largely responsible for running an extensive public hospital network, in which care is usually provided free of charge. General practice, out-of-hospital specialist services, and some allied health services are usually delivered through fee-for-service private practice, underwritten by the single Commonwealth (central) government insurer. The government insurer, Medicare, in effect provides a funding stream direct to general practitioners (GPs); 73% of GP consultations incur no fee as they are paid for by a government-determined reimbursement. The Commonwealth government also provides incentive payments outside the fee-for-service structure. There is an extensive private hospital network covered by voluntary private insurance, which supplies about 30% of hospital care and up to 60% of planned surgery nationally. Most allied health practitioners are in private practice, and the care they provide is not routinely covered by the government insurer.^{18 19}

Computerization is quite variable across the sector. General practice computerized rapidly in the late 1990s, and now nearly all GPs have a clinical information system. Hospitals, however, are subject to many jurisdictional influences and computerization is quite varied. Private specialists and allied health practitioners have very low computerization rates. Because of this variability, there is very little exchange of electronic information between healthcare providers, which is a barrier to PCEHR use.^{20 21}

Results: what has been delivered

System design

The PCEHR is a distributed system (see figure 1). The program has delivered the central infrastructure, and initially has also provided several repositories for essential services. The central infrastructure is designed to manage the location and transfer of information. Several repositories have been established to hold clinical documents, but there is no proscription to use the national repositories. Other organizations can set up their own repositories and provide information to the service, as in the case of Medicare Australia. This may also happen when pathology and radiology information becomes available in the future. The infrastructure is therefore designed to know the location of all information about an individual patient through their Individual Health Identifier (IHI) and to collate it on request, which it does through an indexing service. A registered repository must, on receiving patient information, inform the indexing service of the existence of patient data available for retrieval. It is in turn interrogated by the system to see if there is any atomic data, but is not required to send it until requested. In this way it differs from many other health banks which act as central repositories. Importantly, only the data sent to repositories is provided to the system. There is no direct querying of EHRs.

Figure 1.

System architecture. PBS, Pharmaceutical Benefits System; PCEHR, personally controlled electronic health record.

A various information sources were developed in preparation for the first release, and will increase in number over time. Consumers have the ability (amongst other things discussed later) to create consumer health summaries and consumer health notes. Specifications have been developed for providers to create and post a number of specific documents, including:

• Shared health summary (SHS): created by the patient’s regular medical practitioner, registered nurse or Aboriginal health worker, but usually their GP. SHSs are designed to be a curated record of the patient's current medical conditions, medications, allergies, and immunizations at a point in time, and will be created opportunistically.

• Discharge summary (DS): copies of the these documents, all with the same national specification, will be generated by hospitals as part of usual practice and sent to a national repository in a pre-determined format using the same architecture.

• Event summary: a new document designed to fill the gaps between the SHS (fixed at a point in time, and from a nominated provider) and other documents that have a defined purpose and defined users. This document will be created by providers at the time of a significant event.

• Referral letter: copies of referrals sent can be captured by the system.

• Specialist letter: copies of letters as a result of a specialist consultation.

Medicare Australia also holds a certain amount of administrative, but health relevant, information that is available through the portal: data about Medicare Benefits Schedule (MBS) claims, about activity on the Pharmaceutical Benefits System (PBS), and about the Australian Organ Donor Registry (AODR), and information from the Australian Childhood Immunization Register (ACIR). The architecture needed to connect to the PCEHR—the business to business gateway (B2B)—is used by each piece of software sending data, allowing for disparate systems to share data and gain some interoperability.

The essential item is the view and reporting services. There is a basic reporting service for system monitoring by the service operator. Most of the activity, however, is designed to be in the delivery of information to healthcare providers and to consumers. Currently, information can be accessed through both a consumer portal and a provider portal. Clinical information systems (CIS) are just beginning to come on line as they go through design, implementation, and conformance testing to allow them to connect to the infrastructure. This means that CIS (for healthcare providers) and consumer portals developed by third parties will be able to access and render information directly in their system, rather than accessing through a portal.

Each system (be it a portal or CIS) must first have the IHI of the consumer in order to interrogate the index service to see what information is available. This information is then presented according to the design decisions made by each system. Figure 2 shows the consumer portal. Individual documents are called and loaded only if selected.

Figure 2.

Consumer portal screen. The health overview is shown on the right and the index view on the left.

Personal control

Most consumer access, at least in the first instance, will be via the consumer portal as shown in figure 2. The initial screen has a health overview and index view. The health overview brings together salient information, prioritizing the latest shared health summary and any clinical documents available to the system since the last SHS was posted. The index view is a listing of all available documents grouped by document type.

Record access

Access to the record is controlled through ‘Manage Access to my Record’ on the portal. The most obvious method of control is though consumer control of access to their record, which occurs at many levels. The first level is that the system as a whole is an ‘opt-in’ model. Consumers must register through the website http://www.ehealth.gov.au in order to obtain an eHealth record. This decision has effects on the consent model, discussed later.

Once registered, the default access is open; any healthcare professional who has a relationship with the consumer (and can therefore obtain their IHI) can access the consumer's record. Consumers can also elect to create a record access code (RAC), which must be given to health professionals before the record can be opened, as an extra layer of security. Records can be hidden, which means that they are only available on a specific search, not on routine clinical access.

Document access

Access to documents is controlled through ‘Manage Document Access’ on the portal. Each individual document in the record can be manipulated by consumers according to their desired level of comfort with the information contained in that document. Documents can be restricted, in which case they are hidden from general view, but can be revealed if the health professional is given a limited document access code (LDAC), or can be removed from the record. Only one LDAC can be created, which must serve for all documents the consumer wishes to restrict. Removed documents are not purged from the system, but simply removed from document lists and trees. Logs of document restrictions are kept for medico-legal reasons (in the instance of a provider basing a clinical decision on a document before it is removed).

Provider access

Once a provider has accessed the record, they are placed on a list of provider organizations within the record. Consumers can access that list and remove providers as desired. Those providers are then denied access to the record. The ability to block providers prior to access was discussed, but was technically difficult, and concerned consumers have other options to limit access (as discussed earlier).

Emergency access is a special case. If the consumer is incapacitated in an emergency situation, the health professional can assert an emergency and over-ride the access controls. All of these access controls are summarized in figure 3.

Figure 3.

Access control summary. The end-user controls record access status and document status. LDAC, limited document access code; RAC, record access code.

Notifications and audit

The system logs all access and this information is available to the consumer as an audit log. By selecting a date range, consumers can see what organizations have accessed the record and what elements of the record they accessed. To maintain the privacy of individual providers, the audit log does not provide details of individual access. Consumers can, however, apply to organizations to see which individuals accessed the record if they have any concerns.

Consumers can also set notifications, either by SMS or email, for certain activities. They can, for instance, set up SMS notification of emergency access, notifications of first access by a healthcare provider, or notification of loading a shared health summary.

Consumer information

Consumers have the ability to create various documents within the portal, with many more types of documents anticipated in the future. Current documents include:

• Personal health summary: a document designed for consumers to record allergies and medications they are taking.

• Personal health note: a free text area for consumers to record any information they wish about their health for their own purposes. Significantly, these personal health notes are not available to providers. Consultation in the design phase revealed significant problems with the medico-legal risk of consumers recording information in this section. There is no expectation that clinicians will access a consumer's e-record routinely, and the presence of such information, if not accessed, may create a medico-legal risk.

• Advance care directive (ACD) location: ACDs are governed by individual state legislation, and therefore it was not possible in the development timeframes to align all the states to create an electronic ACD. So in the first release this section only contains information about the presence and location of an ACD. The ability to create an ACD is planned for the 2014 release.

• Emergency contact details.

Consent

The adoption of the ‘opt-in’ model allows for a flexible model of consent, in that consumers can be assumed to have a basic understanding of the operation of the PCEHR, while the access controls give consumers extensive controls once documents are posted. Therefore, the consent model allows for clinicians to assume consent unless the consumer otherwise expresses concerns. In order to minimize workflow demands, clinicians do not need to ask consumers about loading each and every document (which might include individual prescription items, for instance). Instead, it is up to the consumer to ask for information not to be sent. In reality, it is expected that clinicians will use common sense and ask about potentially sensitive information (such as sexually transmitted diseases, for instance), much as they would in existing communications.

Discussion of issues

The preceding section has outlined the extensive control and involvement consumers will have with the record. This section is a discussion of some of the resultant issues.

Information access

One of the significant proposed benefits is that consumers will have access to their information. As any health problem concerns the consumer, involving patients in their own care by sharing information promotes safety²² and benefits the shared decision model.²³ However, despite this, clinical information is usually written with a clinical audience in mind and health literacy levels vary in the population.^{24 25} Test results are confusing and often opaque to consumers, and can be worrying when viewed out of context. Abnormal results can be clinically insignificant, and vice versa. Current plans are that pathology and radiology results will not be released to the PCEHR until reviewed by the ordering clinician. This process is problematic as it does not apply to existing clinical documents that may contain radiology or pathology information. Nor is it reasonable in the long term to treat these two categories of information separately. The ideal solution is to develop mechanisms whereby test results can be presented so that consumers can interpret and understand them, perhaps with access to supporting information and/or in conjunction with their healthcare provider. Access to information must be provided so as to empower patients, not confuse them.

Similarly, the record is designed to be for all Australians, and is therefore required to cover all situations. The default access settings allow the record to build and provide benefit to clinicians, without the consumer ever having to access the record. For those without online access, the full range of controls are available through the Medicare call center or by visiting the government service shopfronts.

Access controls

One of the dichotomies in the design consultation phase related to the perceived need for access controls. It was a clear requirement by consumer groups, and indeed, is expressed in other work.²⁶ Provision of access controls in any implementation of this type is required so that consumers trust the system. However, experience in other implementations suggests that the use of these access controls is low. Local experience in a pre-existing shared record in the Northern Territory reveals a very low use of access controls, an experience similar to that in New Zealand.²⁷ Opt-out rates in the UK²⁸ for their Summary Care Records are similarly low. The dilemma, then, is that if usage rates for access controls are low, then the risk that a consumer will inadvertently apply an access control to a crucial piece of information increases.

Opt in versus opt out

As previously mentioned, a key requirement in early consultation was that the record be a voluntary, opt-in model. Yet another view holds that, for the record to be most effective, and if it is an essential part of healthcare, then the model should be opt out and all consumers should have a record by default. Practically, this maximizes benefits by allowing both consumers and clinicians to understand that most Australians will have a record, and there is an ethical argument that the groups most likely to benefit from a shared record (the chronically ill, the homeless, etc) are those also least likely to opt in.²⁹ An opt-out model is currently recommended by the national consumer body, the Consumers Health Forum (the submission can be found at https://www.chf.org.au/pdfs/sub/sub-803-Con-Ops-Response-Oct-2011.pdf).

In practical terms, this is a moot point; it is at the time of posting information to the PCEHR that people have to decide whether to have or not have a record in the future and what information goes onto it and who can read it. Opt in may be more convenient and those who opt out can then do so knowing what they are leaving. The converse could be argued that with suitable informed consent and information, the same clarity of decision making is available, providing real patient choice and control.

Workflow/benefit conundrum

One of the challenges for the program is that consumers derive most benefit, yet most of the workflow costs and change is borne by clinicians. This is exemplified by the SHS. While GPs keep information about allergies, etc in their own systems, ensuring that the data are complete, regularly collated, curated, and rendered fit for sharing is not part of their current remit. The program represents a change in workflow and leverages pre-existing effort and (under Australian law) the clinician's intellectual property. Patients may be seeing many specialists or other GPs for specific problems. GPs will have to ensure that data not currently included in their system are placed in an SHS. GP requests for specific funding for PCEHR activities have not been met, and instead GPs must use existing reimbursement items.

Part of the solution to this is to change the whole system, so that GPs have access to information (such as discharge summaries or specialist letters) they could not previously obtain. This indirect benefit of participating in the system is meant to counteract the direct ‘dysbenefit’ of workflow changes.

The effects of the requirements on providers will be quite variable. Discharge summaries from hospital, for instance, will be simply sent as copies of existing communications, creating no workflow change. For other clinical documents, the degree of workflow disruption will depend on each implementation by the many vendors involved. There are 22 different GP vendors in the Australian market, the seven most common of which have been engaged by NEHTA to modify their existing software.

Medico-legal

Consultations were held with the various medical indemnity insurers and with representative professional bodies such as the Australian Medical Association. The most significant concerns related to provenance of information and veracity of information. The first resulted in significant constraints on what consumer information was made available to providers. Providers were concerned about the risks posed by consumers posting information to their record, assuming providers would read it. The legislation supporting the PCEHR specifies that providers are not required to access the record in between consultations, and only highly structured data are available to clinicians in the form of information on medications and allergies from the personal health summary, and infant developmental information in the child developmental record.

The second issue relates to veracity and has two elements: quality and completeness of information. Data that exist in a local system are not necessarily fit for sharing.³⁰ While there are many programs to improve data quality, they are often more about population health than making data fit for a shared record.³¹ Such data quality issues are outside the control of the PCEHR, but are a fundamental issue for the users of the system.

Completeness of information has also been an issue of difference between consumers and providers. Although consumers have asked for the ability to hide information (and providers will not know that it has been hidden) just as they now can conceal by not telling providers, providers have expressed concerns that they will not be able to trust the record.

Progress

The most important issue in the future will be understanding the derived benefits and uses of this record. Despite excellent design, no system delivers perfectly on design objectives. Evaluation of systems is required to identify the benefits, failures, and unintended consequences.^{32 33} Unfortunately, it is too early yet to determine this. The national infrastructure was released in July 2012, but in keeping with the distributed nature of the system, this did not result in immediate uptake. Source systems are required to provide information, but no clinical system was able to upload data and only information from Medicare Australia was available. At the time of writing, seven GP systems, two pharmacy systems, and one hospital system are able to interact with the system. Most of these have become available only in the past few months, and therefore there are too few clinical document to allow any conclusions.

However, consumer registration is encouraging. As an opt-in model, consumers are required to register for a record. This can happen online, through government offices, or via an assisted registration process in hospitals and Medicare Locals.³⁴ There has also been a public advertizing campaign. As a result, 1 500 000 (6% of the population) consumers have registered so far. Over 6000 healthcare organizations have also registered for the system. Overall, 0.3% of consumers have availed themselves of the RAC, and 0.15% the LDAC, although without large numbers of clinical documents, the significance of the latter is uncertain.

The future

The functionality of the 2012 release has been described in this article. Design and planning for subsequent releases are underway, and have an increasing focus on delivering consumer benefit and raising the maturity of the system. Future releases include: an electronic childhood record, incorporating growth charts and immunizations, and allowing for a mobile device interface; increased accessibility to medicines information by providing access to electronic prescription details; the integration of pathology and diagnostic imaging reports; and full ACDs.

Conclusions

The PCEHR is a national-scale shared EHR which has been designed and built from the ground up in a distributed environment where the command and control mechanisms differ from those in centralized systems, such as the National Health Service (NHS) in the UK. Inherent in the design were many compromises between the various stakeholder groups (eg, clinicians vs consumers and privacy advocates vs ‘share for care’ advocates within the consumer environment). There were also many technical challenges in designing and building a complex system, including the development of new national foundation requirements and standards for clinical documents, and the capability to track and accept information from varied sources and then deliver it reliably to users. Central to the original build has been direct clinical leadership in the design to ensure clinical utility, assurance, safety, and ‘meaningful use’ so that the providers deployed by the consumer can and want to use the documents. The next challenge is to monitor the expected and unexpected ways consumers use their information and whether their providers find the system useful rather than a hindrance.