Individual Access to Health Records

In this section, we will cover:

What is Individual Access?

Individual access is the ability of individuals to view, download, and share data from their electronic health records. Once individuals view or download their data, they may want to take further action, such as sharing their data (transmit) with other people or importing it into health apps. We discuss those actions in the Health Records Integration section.

There is variation in how much data an individual can access and share depending on applicable country legislation, laws, and regulations. Sometimes, both view and download are packaged together. Other times, view only functionality without download functionality is the norm. In some countries, individuals can access their entire lifetime health record from all providers in one place. Often, individuals can access a part of their health record that was provided by a single organization (such as a physician or a hospital). They may have to gather their data from each healthcare provider and collate them to have a lifetime health record.

Individual access is an important element of empowered individuals. The following GDHP member stories discuss nationwide systems that collect records from multiple providers for purposes of sharing the data with individuals and other providers. Estonia’s health information system was created in 2008 with both provider-to-provider and provider-to-individual exchanges in mind.

Estonia | From Around the Globe

Nationwide Health Information System for Providers and Individuals

Estonia’s health information system is a central national database through which healthcare providers, such as doctors and nurses, can exchange data with each other and see the health data sent about the individual by other providers. Health care providers are obligated to forward the data to the health information system.

Through the individual portal, individuals can see their health data, submit declarations of intent, appoint a representative and perform actions on behalf of persons who have appointed them as their representative. (61)

Australia first deployed its nationwide personally controlled EHR system in 2012, which was renamed My Health Record in 2015.

Australia | From Around the Globe

A Health Record for Each Consumer

Australia launched My Health Record to put individuals at the center of their care. “My Health Record gives you secure and convenient access to your health information… It is available to you, your healthcare providers and your representatives whenever it is needed…You can keep important health information that you and your healthcare provider organisations have added, all in one place.” (19)

Austria’s national EHR system was first implemented in 2015 starting with public hospitals and nursing homes in Vienna. It has been expanding ever since.

Austria | From Around the Globe

ELGA (Electronic Health Records) for Individuals

“ELGA makes it easier for you to manage your most important health data. Using ELGA, you and your doctor can access your records from any location, whenever you want – simply and securely. The aim is to supplement medical treatments and consultation with improved information flows, particularly when several health service providers are working together.” (62)

ELGA’s website explains how individuals can use it. “To start with, it will display discharge notifications, as well as laboratory and radiological results provided by hospitals already working with ELGA. Subsequently, also medication data. As soon as ELGA health data are generated for you, you will be able to view them yourself online via the ELGA portal.” (63)

Individual access tends to increase individual engagement. The GDHP Citizen Access to Health Data white paper (64) notes more than half of respondents noted that, “The most impactful change associated with providing citizens with access to their personal health information is more engaged patients.” This is followed by improved public satisfaction and avoided visits or calls as other positive changes.”

How Many Individuals View their Digital Health Records?

The Organisation for Economic Co-operation and Development (OECD) published a study in 2022 including statistics from 27 countries on individual access and interaction. The study noted, “In most countries, patients have access to and can interact with their own medical records within a secure Internet portal. ‘Access’ means patients can view information contained in their own record and ‘interact’ means that patients can amend information, upload data or interact with their health care provider. Thirteen countries[1] reported that 100% of patients have access to their own medical records through an Internet portal and 12[2] reported that 100% of patients can interact with their portal. Eighteen[3] countries reported that patients can view their own records from all of their current health care providers and containing their current medications, lab tests, and imaging results.” (65)

There is a difference between what individuals can do (availability) and what functionality individuals use within a system (adoption). Based on survey responses from 22 GDHP members, The GDHP Citizen Access to Data white paper identifies “a gap in some countries between the number of citizens who can access their health information and the number that do access it…Adoption uptake by people has been gradual, with four countries estimating 25–50 per cent of their population are users (that is, those who have accessed their information online), with others reporting that less than a quarter of their population has accessed their personal health information electronically.” (64) Countries may consider analyzing the differences between availability and adoption, such as the following example from the United States of America.

[1] Denmark, Estonia, Finland, Germany, Iceland, Israel, Italy, Japan, Lithuania, Luxembourg, Russian Federation, Sweden, Turkey

[2] Denmark, Finland, Iceland, Israel, Germany, Italy, Japan, Lithuania, Russian Federation, Sweden, Switzerland, Turkey

[3] Countries listed in table 2.12 of the OECD report are: Australia, Denmark, Estonia, Germany, Hungary, Israel, Italy, Japan, Lithuania, Luxembourg, Netherlands, Russian Federation, Slovenia, Sweden, Switzerland, Turkey

United States of America | From Around the Globe

Trends in Availability and Adoption

In October 2023, the United States of America released a study of availability and adoption of individual access, portals, and health apps. The study presents analysis of how often individuals accessed their online medical records in a year. It shows a trend of growing adoption. (66)

A country may benefit from periodic analysis of digital health availability and adoption among its population. It may want to assess whether the percentage of people who regularly use digital health increases over time. Countries may find the OECD and GDHP analyses helpful to evaluate their availability and adoption levels compared to other countries.

Do Individuals Get the Data They Need?

In some GDHP countries, individuals can access summary information such as diagnoses, medications, allergies, lab results, immunizations, encounter history, referrals, and discharge summaries. Depending on the country, information may be available, such as patient-generated data or clinician notes. This is highlighted in Australia’s example.

Australia | From Around the Globe

Key Information Inside My Health Record

My Health Record contains “key health information like immunisations, pathology and diagnostic imaging reports, prescription and dispensing information, hospital discharge summaries and more, all in one place.” It also contains consumer uploads of data including free text entry of allergies, adverse reactions, and current medications, personal health notes, advance care planning, emergency contact, and child development information. (67)

In deciding what data is or is not displayed in a portal, countries may want to consider applicable laws and regulations regarding the security and privacy protections for individual information. For example, the United States of America has federal and state level government agencies focusing on individuals’ mental health and substance abuse (68). This type of individual information may be configured differently by healthcare organizations and may include the ability to identify and limit categories of information such as mental health, and alcohol and drug addiction. (69) Additionally, health care providers in the United States of America should abide by the Health Insurance Portability and Accountability Act (HIPAA) (70), which grants an individual rights to their health information including the right to get a copy or inspect their information, making requests to amend or correct their information, sending their information to other persons, and requesting an accounting of who has seen their information. HIPAA regulates health plans, most health care providers, and health care clearinghouses.

The EU GDPR outlines information individuals have access to, the level of rights and responsibilities individuals have, and the form in which they are to receive data. For healthcare organizations, GDPR presents a legally binding framework for how they approach individual data privacy. It mandates a shift towards more transparent, secure, and individual–centered data processing practices. GDPR for healthcare emphasize the need for healthcare providers to obtain explicit consent from individuals before processing their personal data, except in situations where processing is necessary for healthcare provision under legal obligations. Central to GDPR are the reinforced rights it grants individuals regarding their personal data. For individuals, this means having greater control over their health information. Key among GDPR individual rights are the Right to Access and the Right to be Forgotten. The former allows individuals to obtain copies of their personal data held by a healthcare provider, while the latter enables them to request the deletion of their data under certain conditions. The GDPR “applies to organizations that handle such data whether they are EU-based organizations or not, known as “extra-territorial effect.” Under the GDPR, EU data protection law applies when personal data is processed in the context of the activities of a controller’s or processor’s establishment in the EU. This rule applies regardless of whether or not the data processing takes place in the EU. (71)

Individuals may place high value on parts of the record that give them new insights (such as clinicians’ notes) or recommend steps to improve their health (such as post-visit instructions). Clinician notes may give individuals a snapshot of a visit so they can better remember, understand, and act on their clinician’s advice after the visit ends. It may be helpful to consider whether healthcare providers can digitize clinical notes, instructions, and other information individuals may value. In addition to asking individuals what data they value most, you may consider asking individuals how their data should be managed. Ireland provides one example of this approach.

Ireland | From Around the Globe

Ask People What They Need

A National Public Engagement on Health Information initiative in 2022 used a national survey and focus groups to ask the public how their health information should be collected, used, and shared. They found the public recognized the value in moving towards a more electronic health system with secure data which they believe will contribute to timely and appropriate care. (72)

Understanding the perceptions of your healthcare professionals is also important. For example, the Republic of Korea cited a study on Hospital Workers’ Awareness and Attitude Towards Medical Records and OpenNotes (73) which reports positive attitudes towards sharing the medical records, including the sharing of OpenNotes. The study does report some medical staff are concerned about honestly recording their opinions if they know individuals will look at them. However, the study notes when individuals can access their own medical records easily, unnecessary misunderstandings between individuals and medical staff can be reduced and trust in the doctor-patient relationship can be built. In the United States of America, individuals also noted the benefit of clinical notes being available to them.

Can Individuals See All Their Records Together?

Individuals’ abilities to see some or all their health records depends on each country’s digital health infrastructure. For some GDHP members with national individual portals, individuals may be able to see provider-selected records aggregated from providers who agree to update the portal. They may not be able to see all their health records together as they may have to view their data in a national portal and individual providers’ portals. They may need to register, log in, and learn how multiple portals work since the portals can use software from various developers. For example, Sweden reports multiple EHR files (another word for digital health records) that can exist in many regions of the country and in many providers’ systems for the same individual.

Sweden | From Around the Globe

Federating Electronic Health Records

In Sweden, everyone who has contact with a healthcare provider has at least one EHR file. Since healthcare is federated in Sweden, an EHR file exists in every region an individual has visited. If they have visited a private provider, they have additional EHR files with them. It is not the individual who decides if an EHR should be opened. It is a legal requirement by The Patient Data Act (2008:335) to document in a health record and almost all healthcare providers are using an electronic one. The law that was introduced on 1 July 2008 and replaced the Patient Records Act and the Health Records Act. The Patient Data Act regulates how personal data and medical records should be handled in health care. The Patient Data Act contains information about who is required to keep medical records, what an individual record should contain and what rights and obligations individuals and health care providers have regarding individual records. Both private and public healthcare are covered by the Patient Data Act.

In some countries, such as Uruguay, the national portal may contain summary information from multiple providers while there are separate portals containing detailed information from a single provider.

Uruguay | From Around the Globe

National Portal and Provider Portals

Uruguay offers a national health portal where individuals can consult their clinical history which is comprised of clinical documents generated in health institutions across the country. Some health providers have their own portals where individuals can view clinical information performed in their specific organization while others require individuals to request the written health record. (74)

In other GDHP member countries, such as Poland, individuals can access all their health data in one place.

Poland | From Around the Globe

A Unified View through the National Patient Portal

Everyone in Poland, citizens and permanent inhabitants, have Personal Identity Numbers (PESEL). Using PESEL, they can access information on their electronic health records in one place via their portal called the Patient’s Internet Account – Internetowe Konto Pacjenta (IKP). Currently, 18 million individual portal accounts are established which accounts for 50% of the total population of Poland. (75)

The Patient Internet Account is a tool that facilitates access to digital services and individual health data. Through IKP, individuals can get information about their e-prescriptions, e-referrals, also for their children, the history of visits and medical leaves, and the medications history together with dosage. In 2021, the mojeIKP application was launched as a mobile version of IKP and now has over two million users. (76)

Can Individuals Download their Health Records?

Individuals in some GDHP countries can download their health records. This capability is not ubiquitous among all GDHP members. Some GDHP members say individuals can request paper copies of their records. Providers (such as imaging centers) may give individuals copies of data (such as X-rays) on digital physical media like CD-ROMs. Data on these physical media is considered digital but is often difficult to share with other providers because the individual must deliver it by hand or mail to the provider.

Besides sharing downloaded data with providers, individuals may want to integrate their health records into other digital health systems, such as mobile health apps. Using health IT standards, as well as communication methods used by most mobile devices (such as Wi-Fi, Internet, and Bluetooth) will make it easier for individuals to achieve health records integration. GDHP members endorse industry health IT standards for interoperability among healthcare organizations and electronic health records as indicated by the Portugal member story below.

Portugal | From Around the Globe

Coordination of Standards and Interoperability

Technical interoperability is part of the vision for Shared Services of the Ministry of Health. It is served by an Interoperability Gateway for Healthcare, a Portuguese National Broker (PNB), and a National Contact Point. The gateway provides internal systems with an integration mechanism, based on Health Level Seven (HL7®) v2.5 messages. Communication with the central PNB system is done using Health Level Seven (HL7®) Fast Health Interoperability Resources (FHIR®). The PNB implements international best practices in interoperability standards. The National Contact Point supports all communication between the national infrastructure of the Ministry of Health and other European countries.

Individual Access Recap

Individual access considerations include:

• Offering individuals the ability to download, view, and share their records;
• Understanding and narrowing the gap between availability and adoption;
• Asking individuals what parts of their health records they most want to view, download, and share;
• Making data available that individuals consider most valuable, especially data that help them manage their care (like clinician notes and instructions);
• Helping individuals have a unified view of their health records to minimize the number of portals they use to access all their information; and
• Using industry standards for individuals’ health data interoperability to make it easier for individuals to share and continue using the data they download.