VIEW POINT

https://doi.org/10.47811/bhj.168

Navigating the Ethical Terrain towards a Responsible Adoption of Health Information Systems: Recommended Ethical Pathways

Namgay Rinchen¹, Sonam Yoezer ¹

¹ National Medical Services, Ministry of Health, Bhutan

Corresponding author:

Namgay Rinchen namgyerinchey@gmail.com

ABSTRACT

Health Information System (HIS) improves healthcare data accuracy, care coordination, resource allocation, and informed decision-making. However, ethical concerns arise with data security, privacy, informed consent, and patient autonomy. This paper discusses the benefits and drawbacks of HIS and offers recommendations to address the ethical issues, crucial for countries like Bhutan undergoing healthcare digital transformation with Electronic Patient Information System (e-PIS) adoption. The main recommendations are: educating system personnel, establishing regulatory and ethical frameworks, implementing strong security standards, obtaining informed consent from patients, and enabling patients to access their own records. An integrated approach that balances technology and ethics is needed to successfully adopt HIS.

Keywords: Bhutan; Electronic Patient Information System (e-PIS); Ethical issues; Health Information System (HIS); Recommendations.

INTRODUCTION

The progression of information technology has led to the automation and transfer of numerous management systems that were previously managed manually, including the management of medical records1. A health information system (HIS) is a complete system meant to manage healthcare data, comprising the collection, storage, management, and transmission of patients' electronic medical records (EMRs), hospital operational management, and healthcare policy decision-support systems ^{2,as cited by 3}. Such systems are valuable resources for all stakeholders in the healthcare spectrum, ranging from patients and clinicians to public health officials. HIS collects and compiles data in a

manner that facilitates informed decision-making processes. Examples of HIS include electronic medical records (EMRs), electronic patient records (EPRs), electronic health records (EHRs), practice management software, patient portals, patient registration software, and patient care management systems, among others.

HIS possesses immense potential to transform healthcare delivery, especially in low-income countries, by improving data accuracy, care coordination, resource optimization, and supporting informed decision making. Nevertheless, there are potential downsides like technical and logistical challenges, clinician burnout from using electronic records, software defects leading to incorrect prescriptions or instructions, and ethical concerns4. To better understand these trade-offs and how they can be navigated, it is useful to first examine the advantages and challenges associated with the adoption of HIS.

ADVANTAGES AND CHALLENGES IN THE ADOPTION OF HIS

The adoption of HIS ensures efficient healthcare delivery with enhanced quality, leading to better patient outcomes^5-7. It enables resource optimization by integrating medical inventory, supplies and usage into the system, which is particularly beneficial in low- and middle-income countries. It reduces duplication of data and automates the workflow and tasks, allowing healthcare workers to focus better on patient care. HIS allows multiple users to access patient information at the same time, from anywhere in real time^1,4. A foundational element of digital healthcare is EPR, an electronically stored health information about one individual uniquely identified by an identifier^5-8. Systematic reviews have found that electronic records are associated with increased efficiency and quality of care, thus freeing up the resources of health professionals^9,13.

Electronic records eliminate the need of physical space for storing patient data and data can be retained for a longer duration compared to physical records^5,14. The clarity of digital records reduces the likelihood of medical errors, such as dispensing

incorrect medications or treatments, which is a possibility with paper-based records due to illegible handwriting^15,16. The system can be configured to restrict or alert clinicians in certain instances regarding potential drug-drug interactions. Furthermore, it can also restrict the prescription of drugs unsuitable for specific conditions or patients, or prompt clinicians to double confirm such prescriptions¹⁴. The database created from electronic patient records provides a valuable data source for medical and health related research, which can be used for evidence-based decision making in healthcare⁵.

While HIS offers numerous advantages, it also presents challenges that require attention. The challenges are technological, knowledge-related, cost-related, legal, ethical, and human-related¹⁷. The discussion here will, however, focus exclusively on the ethical challenges. Many have noted that the ethical challenges here mirror those arising from the digitization of healthcare, specifically in relation to data security, privacy, informed consent, confidentiality, and patient autonomy^1,17–20. Data loss or destruction can occur during data transfer, system crashes or theft in the event of cyber-attacks^9,14. Healthcare workers must safeguard the privacy and confidentiality of patient information confided in them for management purposes. Without strict access controls and monitoring policies, breaches can occur, resulting in unauthorized access to or disclosure of sensitive patient data to unauthorized individuals, undermining patient’s privacy. Patients have the autonomy to decide what happens to their personal information, as well as the right to refuse the storage and sharing of such information. This autonomy is compromised when patients’ information is captured and stored in HIS without their consent.

Such a system also creates a digital divide, raising concerns about equity. Patients' access to their own medical records necessitates digital literacy, and the marginalized section of society may struggle to access and engage with such a system. Additionally, in clinical research, several ethical issues arise while using electronic patient records without their consent. Failure to address these issues related to ethics may result in potential litigation against healthcare workers and healthcare organizations at large¹⁷.

To address these challenges and ensure the successful implementation of HIS while upholding ethical principles, a comprehensive approach is necessary. Having discussed the advantages and challenges of HIS implementation, let’s now examine the present situation in Bhutan, a country actively pursuing digital transformation in healthcare.

CURRENT STATE OF HIS IN BHUTAN

Bhutan is on its way to digital transformation and aspires to provide secure healthcare supported by a responsive, real-time health information system for personal care, program management, and public health²⁴. It has already implemented e-health solutions in varying degrees, which include, among others, the National Early Warning, Alert and Response Surveillance (NEWARS), District Health Information System Version 2 (DHIS2), Electronic Bhutan Medical Supply Inventory System (e-BMSIS), Laboratory Information System (LIS), Bhutan Vaccine System (BVS) and Electronic Patient Information System (e-PIS)²⁴. These e-health solutions are being used mostly in silos, owned by specific departments within the Ministry of Health. There is a lack of interoperability, which the government intends to address by integrating all the digital services related to healthcare delivery into a single efficient platform²⁵.

Since 2023, the e-PIS is being rolled out across health centers in a phase-wise manner, with larger hospitals already implementing its use. It is a part of the Digital Drukyul Flagship Programme of the 12^th five-year plan of the Royal Government of Bhutan (RGoB)²⁶. The e-PIS project is co-funded by the RGoB and the Asian Development Bank (ADB). It is a health program as well as a software, which was outsourced and developed locally by Thimphu Tech Park Limited²⁷. With features designed to facilitate interoperability, the e-PIS platform for electronic patient records may be linked to other databases. The Government Technology (GovTech) Agency, which provides data center services such as hosting data recovery sites, manages the government data center in Bhutan.

As of now, the ethical issues surrounding the adoption of this system seem to be underemphasized. This oversight could be presumed to be temporary, to facilitate a smooth transition from the traditional paper-based system by avoiding end-users being overwhelmed with too many concerns expressed by the implementers from the outset. Alternatively, it could stem from the assumption that healthcare professionals are already aware of the ethical components of patient care.

Although the system has successfully integrated the government’s Civil Registration and Immigration database and replaced the erstwhile Polytech Laboratory Information System (LIS) with an all-new advanced LIS, it has yet to mature and unlock its full features to leverage other additional advantages that can further promote patient safety. These include measures like restricting the prescription of medication causing allergies to specific patients once documented in their records and flagging possible drug-drug interactions. The system also lacks accountability features, such as mandating healthcare workers to electronically acknowledge receipt of crucial or sensitive information concerning specific patients, and consistently logging their real-time access to patients' personal data.

The patients do not have access to their own electronic medical records, including investigation reports, which hinders their ability to take informed action for follow-up care and track their health conditions. These reports, however, are accessible to all categories of healthcare workers with an e-PIS account, contingent upon their knowledge of the individual's unique health identity or citizenship identity number. The accessibility of these records to a broad range of healthcare workers, but not the patients themselves, highlights the compromise of patient autonomy, the potential security risks, and the need for stricter access controls. Furthermore, a potential privacy threat existed in the system at the time this article was submitted. At least one active generic user account existed, intended for shared use among healthcare workers, which enables easy access to patient medical records. The existence of such a shared account compromises privacy and accountability, as it becomes near impossible to trace which specific individuals accessed patients' sensitive information.

Nevertheless, the reassuring part is that the system is actively seeking feedback to make it more user friendly, troubleshoot practical issues, address any concerns expressed, and unleash its additional features as users become more comfortable. As Bhutan moves forward with its e-PIS implementation, it is crucial to learn from the shared experiences of other countries and adopt best applicable practices to address the ethical challenges identified earlier.

The following section delineates some approaches, albeit not exhaustive, for the successful implementation of HIS, like e-PIS, while upholding ethical principles. These are generally applicable to any country, and may include some measures that are already underway in case of Bhutan.

THE WAY FORWARD

Providing comprehensive training to healthcare workers and other personnel involved in the use of HIS, beyond just the system interface and usage is a crucial step in addressing the aforementioned issues. This training should focus on broader aspects such as data security, privacy, confidentiality and accountability. The users should be made to understand that they are accountable for the use and misuse of the information they are privileged to access, which is solely intended for the execution of their duties¹⁴. Instituting real-time recording of access to patient data within the system can facilitate tracing and ensuring accountability when necessary.

A well-functioning EPR requires the development of a regulatory and governance framework, as well as an ethical framework to guide the implementation of the system. This necessitates the expertise and multi-stakeholder collaboration between healthcare workers, technology experts, managers, administration personnel, policymakers, regulators, ethicists, and patients¹⁴. Strict adherence to national and international ethical standards is highly recommended²³.

To maintain data integrity, it's essential to utilize security measures such as firewalls, antivirus software, internet security protocols, and intrusion detection software. Additional methods include strong encryption, stringent access limits, and rigorous authentication measures¹⁴. Random audits should be carried out to assess system security, privacy, and confidentiality protection.

It is advisable to establish a breach protocol alongside redressal mechanisms for breaches that could occur.

The practice of obtaining informed consent for the digitization of their records from the patient will help gain their trust, while giving them the opportunity to opt-out will serve as an ideal solution. Patients should be informed about how their data will be used, stored, and shared within an EPR system, including potential risks and benefits. Access to their own records should be facilitated to foster transparency and gain their trust and engagement. When allowing access to patient data for research purposes, all feasible steps should be taken to protect patient privacy, such as de-identifying the data to the greatest extent possible while still meeting the research aims and following the best practices in data management⁹. Healthcare organizations should also consider insurance coverage to deal with lawsuits arising due to the usage of such systems, with the population becoming more informed.

To summarize, as rightly pointed out by Terry, the privacy, confidentiality, and security requirements of users must be met by an electronic health record system²⁸.

ACKNOWLEDGEMENT

The authors would like to express heartfelt gratitude to Mr. Garab Dorji, Chief ICT Officer and e-PIS project director, GovTech Agency, Royal Government of Bhutan, for validating the information gathered from publicly available sources regarding the eHealth strategy of the Royal Government of Bhutan and the e-PIS project. He was also kind enough to review the initial draft of the manuscript and give insights from a system management perspective.

REFERENCES

1. Kiah MLM, Nabi MS, Zaidan BB, Zaidan AA. An Enhanced Security Solution for Electronic Medical Records Based on AES Hybrid Technique with SOAP/XML and SHA-1. J Med Syst. 2013;37(5):9971. [PubMed | Full Text | DOI]

2. Honavar SG. Electronic medical records – The good, the bad and the ugly. Indian J Ophthalmol. 2020;68(3):417-418. [PubMed | Full Text | DOI]

3. Ardielli E. Use of eHealth Tools by Primary Care Physicians According to the Provided Healthcare in the Czech Republic.

SciPap. 2021;29(3). [Full Text | DOI]

4. National Academies of Sciences E, Medicine NA of, WellBeing C on SA to IPC by SC. Health Information Technology. In: Taking Action Against Clinician Burnout: A Systems Approach to Professional Well-Being. National Academies Press (US); 2019. Accessed May 6, 2024. [Full Text]

5. Jacquemard T, Doherty CP, Fitzsimons MB. The anatomy of electronic patient record ethics: a framework to guide design, development, implementation, and use. BMC Med Ethics. 2021;22(1):9. [PubMed | Full Text | DOI]

6. Eysenbach G. What is e-health? J Med Internet Res. 2001;3(2):e20. [PubMed | Full Text | DOI ]

7. Zhang XY, Zhang P. Recent perspectives of electronic medical record systems. Exp Ther Med. 2016;11(6):2083-

2085. [PubMed | Full Text | DOI]

8. Almunawar MN, Anshari M. Health Information Systems (HIS): Concept and Technology. Published online March 18, 2012. [PubMed | Full Text | DOI]

9. Porsdam MS, Savulescu J, Sahakian BJ. Facilitating the ethical use of health data for the benefit of society: electronic health records, consent and the duty of easy rescue. Phil Trans R Soc A. 2016;374(2083):20160130. [PubMed | Full Text | DOI]

10. Chaudhry B, Wang J, Wu S, et al. Systematic Review: Impact of Health Information Technology on Quality, Efficiency, and Costs of Medical Care. Ann Intern Med. 2006;144(10):742-752. [PubMed | Full Text | DOI]

11. Jones SS, Rudin RS, Perry T, Shekelle PG. Health Information Technology: An Updated Systematic Review With a Focus on Meaningful Use. Ann Intern Med. 2014;160(1):48-54. [PubMed | Full | Text | DOI]

12. Poissant L, Pereira J, Tamblyn R, Kawasumi Y. The Impact of Electronic Health Records on Time Efficiency of Physicians and Nurses: A Systematic Review. J Am Med Inform Assoc, 2005;12(5):505-16. [Full Text | DOI ]

13. Buntin MB, Burke MF, Hoaglin MC, Blumenthal D. The Benefits Of Health Information Technology: A Review Of The Recent Literature Shows Predominantly Positive Results. Health Affairs. 2011;30(3):464-471. [PubMed | Full Text | DOI]

14. Jamshed N, Ozair F, Sharma A, Aggarwal P. Ethical issues in electronic health records: A general overview. Perspect Clin Res. 2015;6(2):73. [PubMed | Full Text | DOI]

15. Holroyd-Leduc JM, Lorenzetti D, Straus SE, Sykes L, Quan H. The impact of the electronic medical record on structure, process, and outcomes within primary care: a systematic review of the evidence. J Am Med Inform Assoc. 2011;18(6):732. [PubMed | Full Text | DOI]

16. Hippisley-Cox J. The electronic patient record in primary care-regression or progression? A cross sectional study. BMJ. 2003;326(7404):1439-43. [PubMed | Full Text | DOI]

17. Ismail NIB, Abdullah NHB. Developing electronic medical records (EMR) framework for Malaysia’s public hospitals. IEEE Colloquium on Humanities, Science and Engineering. IEEE; 2011:131-136. [Full Text | DOI]

18. Pinto S, Caldeira S, Marques G, Da Conceição AP. Healthcare technologies: An ethical discussion. British J Healthcare Management. 2018;24(2):65-70. [Full Text | DOI ]

19. Afzal S, Arshad A. Ethical issues among healthcare workers using electronic medical records: A systematic review. Comput Methods Programs Biomed Update. 2021;1:100030. [Full Text | DOI ]

20. Alanazi HO, Zaidan AA, Zaidan BB, Kiah MLM, Al-Bakri SH. Meeting the Security Requirements of Electronic Medical Records in the ERA of High-Speed Computing. J Med Syst. 2015;39(1):165. [PubMed | Full Text | DOI]

21. Enaizan O, Zaidan AA, Alwi NHM, et al. Electronic medical record systems: decision support examination framework for individual, security and privacy concerns using multiperspective analysis. Health Technol. 2020;10(3):795-822. [Full Text | DOI ]

22. Dornan L, Pinyopornpanish K, Jiraporncharoen W, Hashmi A, Dejkriengkraikul N, Angkurawaranon C. Utilisation of Electronic Health Records for Public Health in Asia: A Review of Success Factors and Potential Challenges. BioMed Res Int. 2019;2019:e7341841. [PubMed | Full Text | DOI]

23. Kazi AM, Qazi SA, Ahsan N, et al. Current Challenges of Digital Health Interventions in Pakistan: Mixed Methods Analysis. J Med Internet Res. 2020;22(9):e21691. [PubMed | Full Text | DOI]

24. Ministry of Health, Kingdom of Bhutan. National eHealth Strategy and Action Plan. 2018. [Full Text]

25. Gurung M, Dorji G, Khetrapal S, Ra S, Babu G, Krishnamurthy R. Transforming health care through Bhutan’s digital health strategy: progress to date. WHO South-East Asia J Public Health. 2019;8(2):77. [PubMed | Full Text | DOI] 26. Royal Government of Bhutan NSB. 12 Five Year Plan. 2018. [Full Text]

27. ePIS Project Team, Royal Government of Bhutan. Electronic Patient Information System (ePIS) Project Report.; 2023.

28. Terry N. Privacy and the Health Information Domain: Properties, Models and Unintended Results. Eur J Health

Law. 2003;10(3):223-237. [Full Text | DOI ]