Governance

In this section, we will cover:

Governance references legislation, laws, and regulations. For the I-E, we focus the scope of governance to individual engagement in digital health. Examples of this governance include:

• Individuals’ rights regarding healthcare decisions;
• Individuals’ rights to access, share, amend, or contribute data to their health records;
• Organizational responsibilities towards individuals;
• Policies to increase health equity;
• Standards for exchanging information among providers and individuals; and
• Evaluation or certification of digital health, including mobile health apps.

The governance of the content of digital health records –including individual-contributed data— is important because individuals and caregivers play a direct role in supplying the data and in partnering with providers to govern access to it.

Legislation, Laws, and Regulations

GDHP members report they have laws covering individuals’ rights to access their health information.

• In the European Union (EU), the General Data Protection Regulation (GDPR) applies to member countries and provides individual privacy protections. It also empowers individuals with several rights such as the right to access their health data and data portability. This ensures individuals maintain control over their personal health records. EU members may supplement the GDPR with their own laws. (9) The EU is also advancing the European Health Data Space which proposes rules, standards, infrastructure, and a governance framework to empower individuals through increased digital access and control of their electronic data; it also proposes provisions for secondary use of the electronic data. (10)
• Brazil has multiple laws, including Ordinance No. 589 of May 20, 2015, which implements the National Information Policy and Health Informatics. This allows the use of modern information and communication technologies in the democratization of access to information. (11)
• The United States of America grants an individual the right to direct a provider to transmit the individual’s health information directly to another person or entity designated by the individual. The individual’s request must be signed in writing or electronic copy (such as a PDF) or be submitted through an electronic request (such as a secure web portal that includes an electronic signature). (14)

Sweden’s two national regulations cover individual rights from different perspectives.

Sweden | From Around the Globe 

Sweden’s Rights for Patients

Sweden is a member of the EU and is governed by GDPR and has two national regulations allowing individuals to access their data.

1. The Patient Data Act focuses on the management and protection of patient healthcare data. It mandates that patients should be able to access their medical record information and logs of who has read the information. Additionally, it regulates that patients have the right to withhold medical records from other individuals or organizations.

2. The Patient Act focuses on the rights of patients in the context of their care. It gives patients additional influence over their care, including the right to information about their care.

Sri Lanka has artifacts of many types (laws, guidelines, policies, and blueprints) governing individuals’ rights and setting direction for digital health.

 Sri Lanka | From Around the Globe

Acts, Policies, Blueprints, and Guidelines

Sri Lanka has the Electronic Transactions Act of 2006 (12) which gives legal recognition for the use of electronic documents, electronic records, electronic signatures, etc. for official activities.  The Right to Information Act of 2016 (13) establishes the right for citizens to access public-related information; and the Personal Data Protection Act of 2022 (14) is related to management of personal information in the country. Also, the 2023 Information and Cyber Security Policy for Government Organizations (15) gives information security practice guideline for state institutes.  

Further, there are also policies and guidelines specific to digital health in Sri Lanka. The National Digital Health Guidelines and Standards 2021 (16) contains guidance about digital health related recommended standards on interoperability, privacy, confidentiality, network connectivity etc. essential for digital health implementations. The National Policy on Health Information was published in 2017 and the Sri Lanka Digital Health Blueprint (17) was published in 2023. This Blueprint proposes a national EHR (NeHR) to store lifelong health records as one of its central components. The Ministry of Health is also in the process of developing telemedicine guidelines to support the increasing demand.

Sometimes individuals may need others to make care decisions on their behalf. Some GDHP members have laws defining the legal status and rights of different types of individual representatives such as caregivers (18) or others holding power of attorney.

Australia | From Around the Globe

Legal Framework for Individual Representatives

Australia has legislation authorizing a representative framework allowing access to the individual controlled My Health Record. Until the age of 14, a parent or guardian is the authorized representative for a child. There is online training that teaches individuals and representatives such as parents, guardians, and caregivers, how to manage the portal (19). After 14 years of age, a person with legal authority (or who is otherwise considered appropriate) is an authorized representative of someone who lacks capacity to manage their My Health Record.

What Data Can Individuals Contribute to Their Health Records?

Governance of individual-contributed digital health data is another area of focus in the development of individual engagement approaches. For example, individuals can contribute data indirectly through an individual visit with a healthcare professional and may also contribute data directly through digital tools such as an individual portal. The following list gives examples of the data individuals may contribute:

• Advance directives (living will);
• Allergy list;
• Biometric data (such as blood pressure or glucose) from health devices and apps;
• Child development information;
• Donor information;
• Emergency contacts;
• Family history;
• Health goals (such as smoking cessation or weight loss);
• Health history;
• History of previous surgeries;
• Immunization list;
• Lifestyle choices (such as diet, exercise, and drug use);
• Medication list;
• Individual intake forms (registration);
• Individual-reported outcomes[1];
• Personal health notes;
• Personal health summary;
• Reason for visit; and
• Symptoms.

[1] This information, like all items in this list, is initiated by the patient. It is not the same as the quantitative Patient-Reported Outcome Measures (PROMs) that providers or researchers gather.

United States of America | From Around the Globe

Empower Individuals to Contribute Data

The Assistant Secretary for Technology Policy in the U.S. Department of Health and Human Services encourages clinicians to empower individuals by integrating individual-generated health data into EHRs. In the ASTP/ONC Patient Engagement Playbook, Chapter 5 states “Historically, clinicians have had limited access to data on patients’ health and well-being. They’ve made do with information collected during patient visits…[Now,] technology is transforming our ability to collect accurate, reliable patient data… Using technology, patients can also share information that’s critical for healthcare decision making but often too time-consuming or cumbersome for clinicians to gather — like family medical histories. What’s more, patients can provide this data from home, so that clinicians can maximize precious office visit time.” (20)

Individual-contributed data are sometimes called patient-generated health data (PGHD). Healthcare professionals may request individuals to contribute to their data. For example, a physician can prescribe an individual to wear a heart monitor which sends data to the physician. A nurse can ask an individual to log liquid intake and urination for a follow-up visit. At other times, an individual may initiate the data without a clinician’s request, such as logging exercise with the aim of sharing the logs with clinicians to inform treatment.

Switzerland | From Around the Globe

A Nationwide Individual-Driven Sharing Platform

To complement the provider’s medical record for an individual, Switzerland offers a voluntary and free sharing platform for individuals and healthcare professionals where they can upload or delete documents, images, audio, and video. “The electronic patient record (EPR) is a personal collection of health-related documents. These could include, for example, your hospital discharge report, Spitex (home care) report, medication list, X-ray findings, or vaccination card.” (21)

Providers may accept PGHD but treat it differently than the data the provider gathers because PGHD, especially when unsolicited by the provider, is not under the provider’s control. Medical records management principles teach us it is necessary to know the data’s provenance (origin and source) to understand if that data can be trusted to make decisions. (22)

Italy | From Around the Globe

Separation of Individual-Contributed Data from Provider Data

Through a personal web application, individuals in Italy can enrich their own EHR page by uploading personal health data, notes, and documents. It’s a notebook page written by the individual and it includes attachments. It is visible to healthcare providers when the individual agrees. It includes daily measurements of clinical parameters (such as blood pressure, glycemia, cholesterol), personal notes on health status, diet and lifestyle, allergies, blood group, fitness plans (everyday exercise), medication, and individual-reported outcomes. It is a useful service to sustain individual empowerment and therapeutic adherence, and it assists in continuity of care.

How Can Individuals Update Their Records?

Individuals and health care providers want health records to be correct and updated. Individuals who visit multiple providers are familiar with the experience of having to verify whether each provider has the latest data. Providers also ask individuals if the data they have is correct and updated. Additionally, with digital health records, individuals may look at their records and notice missing or inaccurate health information.

Engaged individuals may want the ability to correct errors. We encourage you to ensure that the process to correct errors is easy, responsive to individuals, and effective. Typically, data in health records (digital or nondigital) are amended so the original data are not erased or lost. Providers need to know what data were in the record at a point-in-time in case healthcare decisions were based on those data.

Australia | From Around the Globe

Individuals Updating and Correcting their Records

Consumer control is central to My Health Record. Laws protect a consumer’s right to direct healthcare providers to not upload health information, control who has access to their health information, and see what has been accessed. Healthcare recipients can add or remove information in their My Health Record. In addition, they can apply access controls to restrict providers from viewing their entire record or a specific document. Documents can also be deleted, or a request made to cancel and delete all information in a My Health Record. (23)

How Can Individuals and Caregivers Grant Access to Others for their Health Records?

GDHP members note individuals have rights to decide who can see their health records. When laws give individuals (and possibly caregivers) the right to grant access to health records, a process called authorization, digital health systems can enable individuals to exercise those rights. Some GDHP members allow individuals to control access digitally while others offer manual methods. Others do not give individuals the ability to control access to their records. We highlight examples below where individuals can grant access to their records.

Portugal | From Around the Globe

Citizens Granting Authorizations through the National Portal

The Portugal National Health System’s portal offers citizens a comprehensive range of online services and information from institutions under the Ministry of Health. The portal’s “My Area” includes an “Authorizations” subsection where individuals and representatives can grant or restrict access. There is another “Who saw my information?” subsection where individuals can see who accessed their health data, when they accessed it, and where they accessed it. (24)

My Area

Authorizations

Who Saw My Information

Use cases for authorizing caregivers and representatives to access individual data include advocacy for individuals who cannot speak for themselves, such as:

• Children;
• Individuals with dementia;
• People who cannot communicate;
• Individuals who are unconscious; and
• Persons in situations covered by advance care planning (also known as advance directives). (9)

Depending on the law, caregivers or other personal representatives designated under the law have the right to access the individual’s personal health information and, in some cases, share it with others.

How Can Individuals Participate in Governance?

Individuals are key participants in healthcare organizations. Understanding their values, experiences, and preferences are vital to individuals being engaged in their care. With this understanding, countries can integrate individual viewpoints into the design and governance of organizations and programs, especially individual engagement initiatives.

Ireland | From Around the Globe

A “National Health Information Guardian”

There are individual forums established across the Irish health system. Incorporating individual representatives on governance groups for digital health initiatives is becoming more commonplace. As part of proposed health information legislation, the Department of Health recently announced the appointment of a National Health Information Guardian, a person in an advisory position, who will be an independent champion for the public on how health information is used. The role and responsibility of the National Health Information Guardian should be co-created with citizens to maintain public trust and ensure the needs of citizens are met. (25)

You could gather individual viewpoints qualitatively by talking to individuals directly through advisory groups and other individual and caregiver organizations. You could also gather this data systematically and quantitatively. Canada, for example, uses both qualitative and quantitative approaches.

Canada | From Around the Globe

Patient-Reported Experience Measures

Involving individuals in governance is largely done at the regional or local level through:

• Patient advisory groups;
• Individual participation in governance; and
• Patient-reported experience measures.

Canada published results of their 2022 Canadian Digital Health Survey (26) which is based on a variety of use and attitudinal metrics for digital health services in Canada. This includes experiences with accessing personal health information electronically.

A different study, Assessing Performance Using PREMs data, focused exclusively on individuals experiences of care. “Understanding a patient’s experience during a hospital stay is central to understanding overall health system performance. Patient reported experience measures (PREMs) can amplify the voice of patients to support quality improvement. Using these measures can help care providers, hospitals, and regions improve the overall patient experience and be more responsive to patient preferences and needs.” (27) (28) The measures include questions such as:

New Zealand’s Consumer and Clinician Digital Council provides a pivotal link between the data and clinicians, consumers, groups, and communities.

New Zealand | From Around the Globe

Data and Digital Technologies

Te Whatu Ora – Health New Zealand Whānau, Consumer and Clinician Digital Council links the Data and Digital Executive Board and clinicians, consumers, whānau (family), hapori (groups) and communities. Grounded in Te Tiriti o Waitangi principles, the Council plays a significant role engaging with diverse partners, including differently abled and rainbow communities, and working with Māori to effect Te Tiriti o Waitangi. The Council helps shape data and digital technologies to enable improved and equitable health outcomes across New Zealand.
 
New Zealand’s approach is to build people’s trust in its communities and develop a partnership approach called “trusted faces in trusted places” to gain insights into resilient communities in a manner that is controlled and respectful of cultural practices. This approach offers an opportunity to fully immerse the whānau and consumer voice into their data and digital program outcomes. (29)

Governance Recap

Governance actions include:

• Define individuals’ rights to access their health records in your country’s legislation, laws, and regulations;
• Define what rights can be authorized for caregivers and individual representatives;
• Support individuals’ abilities to contribute to their health records;
• Give individuals a simple way to amend their records;
• Give individuals opportunities to participate in the governance of healthcare organizations and your individual engagement initiatives; and
• Use PREMs to measure and improve the quality of your health system.