With the increased digitisation of hospital health records across Aotearoa New Zealand, providing patients with access to their hospital-held health information should become easier. It is well known that patients want access to the health information stored by health services as well as the ability to correct any inaccuracies in the information.[[1,2]] The Privacy Act 2020 and Health Information Privacy Code stipulate the right for individuals to access and request corrections to their health information stored by a health service.[[3]]

Online patient portals have been implemented in around 70% of primary care practices, with one in five of these practices offering patient access to clinical notes.[[4]] However, there are no similar secondary care (hospital) patient access portals in New Zealand. There has been an incremental “best of breed” approach to building electronic health record systems in hospitals to date, resulting in an array of different systems which makes providing consumer access to their hospital-held health information difficult, and the ability to make patient corrections across multiple systems even more challenging. The New Zealand Ministry of Health recently launched Hira (National health information platform), creating an ecosystem of data and digital services. Hira is intended to provide patients with better access to and control over their health information.[[5]]

Several countries, such as Sweden and Estonia have a longer history of providing patient accessible electronic health records (PAEHRs) than New Zealand.[[6]] PAEHRs are purported to benefit patients, health services and the wider health system.[[7]] The benefits of patient access have included the opportunity to empower patients, inform patients about their health, increase patient health literacy, and involve patients in their own care.[[8,9]] Furthermore, a key benefit is quick and easy access to health information whenever it is needed, including when accessing care with a different provider/service. This convenient access is also particularly advantageous in emergency situations.[[8]] Being able to give family/whānau or caregivers access to patient health information has also been regularly noted as a benefit.[[8]] Although the benefits to patients seem vast, it is important to consider that the use of electronic platforms to provide patients access to health information could potentially contribute to increasing inequities resulting from the digital divide. Access is not equal, despite the widespread availability of the internet and personal digital devices, with those already experiencing poorer health outcomes having lower access.[[10,11]] Internationally, those from ethnic minority groups, those with lower income levels or those from lower levels of education have been found to be less likely to adopt PAEHRs.[[12]] Implementation of PAEHRs should occur alongside strategies to address the digital divide and ensure all can benefit.

There is some evidence of clinician resistance to providing patients with digital access to their health records. Much of this appears to stem from resistance to change or to learn new systems, concerns about time management and impact on workload, potential impact on patient rapport, and concerns about patient anxiety and confusion.[[7,13–15]] Some resistance from clinicians has been linked to concerns about how transparent records may interfere with the clinician–patient relationship. This was particularly so for mental health clinicians, who reported changing the way that they wrote if they knew the patient was going to be able to see their notes.[[8]]

As part of continuous quality improvement processes the Northern Region Health Systems Design Council and healthAlliance recently set up a platform with Waitematā District Health Board to give a selected group of patients access to some of their hospital healthcare information for six weeks. This proof-of-concept was designed to identify the issues that would need to be addressed in the design of a future consumer hospital-held information portal. The online portal, named Mabel, enabled the small group of consumers access to view their hospital letters, test results and medication records from Northern Region DHB datasets. Users were given a web link to use to log on to Mabel from an internet-enabled device at any time during the period it was available. Access to Mabel was view only with no ability to edit or add information. After having access to Mabel users could provide optional anonymous feedback on the service. Users reported Mabel to have high usability and found several benefits from having access to hospital-held their health information. The main benefits identified by users were around being able to access the information they did not otherwise have easy access to, having the information all in one place, being able to track information over time, being able to access it whenever they wanted, and feeling more informed and involved in their care.

“Having a comprehensive overview of all results from blood tests, etc, compiled in one place. I would not usually have access to all of the information unless I went through a (somewhat convoluted) process to obtain it from my GP. Only the most significant results are normally provided, so it was helpful to see them all.”

Although Mabel received positive user reports, the proof-of-concept encountered many data-related challenges due to the complexity of the many data systems and difficulties related to integrating data seamlessly for the user. The project took longer than expected due to the exploration of clinical concerns, privacy, and security risk clearance.

Making available and supporting a portal for consumers to access their hospital data is mired in governance challenges, such as who can take what action, upon what data, in what situations, and using what methods. Moreover, there was a lack of common terminologies, coding of information or data standards across the various clinical systems as well as operational standards to reduce errors in classification. It was recommended that future projects invest resources in finding national or international guidelines and evidence on governance and system design in a number of areas. These areas included:

1. What should be the age of personal access, and how should the transition from parental access be managed?

2. How should delegated access to the portal be managed?

3. How should sensitive information be managed?

4. Should patients have access to information, such as test results, before their clinician has had an opportunity to discuss their implications with them?

5. How should patients be able to audit who has accessed their health records?

6. Should patients be able to add their own data, and how should patients be able to correct any incorrect information in their record?

7. How far back in time should patient access to retrospective records go?

This paper discusses these challenges and presents a review of the literature on how other countries and health settings have managed them, as well as how they have been managed in the New Zealand primary care context. Finally, it provides recommendations for potential solutions for the New Zealand secondary care (hospital) context.

Age of access

The question of when a child or adolescent should gain access to their personal health record, and furthermore when parental access should cease, is complex. As a child grows and develops into a young adult, they become better able to comprehend their personal health information and make decisions about their care. This progression to independence comes with an expectation that health professionals and the health system will respect their autonomy over their health information. When it comes to the personal health record, adolescents should be encouraged to have access if requested.

In New Zealand, when a child turns 16 they are entitled to full access to their health records and parental access can cease. Due to the complexity of this issue, the Royal New Zealand College of General Practitioners published a guidance on patient portals which included access for young people.[[15]] Their guidance on portal access for young people aged under 16 includes the options of:

• access for the young person only (if there are determined to have sufficient maturity and understanding),

• shared portal access for both the young person and their parent(s) or guardian(s), or

• access only for the parent(s) or guardian(s).

Contrary to this, portals in New Zealand primary care such as ManageMyHealth™, ConnectMed, and myindici, state in their terms and conditions that access is limited to those 16 or older,[[17–19]] and that parental access should cease at 16.[[18]] This highlights the discrepancies between national guidance and what vendors offer.

Internationally, countries vary in the age of access to PAEHRs. Some countries allow individual access from ages as young as 12, with shared access for parents and children until ages 16 or 18, at which point the record becomes restricted for parents and entirely owned by the child.[[6,20]] In some cases, the parent is required to request access and the adolescent to either grant it or be notified when a parent has accessed their record.[[6,21]]

It has been recommended that differential access should be provided for adolescents and parents, allowing parents to view non-confidential information in the child’s record, and giving the child the ability to hide information from the parent (e.g., sexual health information). Similarly, parents should be able to restrict their child’s access to specific sensitive family information that the parent contributed to their record (e.g., family history of genetic diseases, substance abuse).[[21]] Importantly there cannot be a one size fits all model as there needs to be exemptions to allow full parental access for unusual or complex situations (e.g., intellectual disability). In all situations, however, the privacy settings would ideally be customisable by the adolescent to protect their confidentiality.

Delegated access

Beyond the complexity of the age of access to PAEHRs, there are challenges of providing delegated access for whānau or caregivers involved in a person’s care. Many patients have whānau, friends or caregivers who help them navigate the health system, and who play an active role in supporting them to manage their health. To do this effectively having access to the patient’s health record is essential, but without a delegated access functionality they will require the patient to share their login information presenting privacy and security concerns.[[22,23]] Proxy access to primary care portals in New Zealand is available with patient permission but, anecdotally, informal sharing more often takes place.

International studies indicate that a high proportion of patients want a delegated person, a care partner, to be able to access their health records.[[24,25]] In our proof-of-concept, 58% of users who provided feedback reported that they would like the option to give someone they choose (e.g., a whānau member) access to view their health information in the portal. Estonia is an example of where delegated access is an option, and patients can delegate access to an individual who can then view the patient’s personal information and purchase prescribed medication on their behalf.[[20]] Similarly in Australia, delegated access is available where carers can register and then view and add to their family member or clients’ records.[[20]]

A qualitative study in Germany highlighted that, although patients find it helpful to be able to share their health records with care partners, they want the option to withhold some information and prefer proxy access.[[26]] Proxy access should allow the delegated person to access the patient’s information through their own login and password, to prevent sharing of that patient’s login details. This helps to ensure that providers can tell who they are exchanging messages with (i.e., patient or their care partner) and protects the patient's privacy.[[27]] These preferences have been echoed by a number of papers and commentaries reviewing the personal health record system in the US.[[27–29]] The US literature recommends that the service should allow the patient granular control over what their care partner can access and action; for example, choosing what information their care partner can see, whether they have the authority to book appointments on the patient’s behalf, order prescription refills or communicate with providers. In summary, it is clear that PAEHRs need to have the option of delegating access, but this needs to be made as user-friendly as possible and reduce the need for sharing of passwords or for care partners to log in as the patient.

Sensitive information

Allowing patients the ability to hide some information from their care partners, parents or children, raises the question of what is considered sensitive health information and how this should be managed. Generally, sensitive information includes information pertaining to domestic violence, genetic information, mental health information, reproductive and sexual health, and substance abuse.[[30]] Evidence shows that patients prefer granular control over what information their health care providers can access, and this is true for both sensitive information and their health record in general.[[31]]

In a US study, patients indicated they would not want to share their entire health record with any healthcare professional, and preferred to be able to control what they could access. This preference was stronger when the patient had sensitive information in their record, or for clinicians who were not their primary care provider.[[31]] Many countries, such as Switzerland, Australia, Denmark and Estonia, have already allowed patient control over what information their health care professional can access. In some cases, there are “break the glass” protocols, allowing clinicians to access restricted patient information in case of need/emergency, or if the patient is not able to communicate their preference.[[20,32]] Concerns have been expressed by both patients and clinicians about the restriction of clinician access to information impacting the quality of care. A study of US clinicians showed that while providers respected patients privacy, they felt that patient restriction of data could harm clinician–patient relations and quality of care.[[33]] A patient sample in Belgium also believed that restricting information from clinicians could impair their quality of care, and felt it was the patients’ responsibility for any negative consequences that may occur from hiding information from their clinician.[[34]] These studies highlight the balancing act between patient preferences and health care provider needs when it comes to privacy and restricted access.

“Break the glass” protocols are already used in some contexts in New Zealand hospital systems, such as for access to full mental health service notes where these are held in separate systems from the rest of the hospital record. The use of these protocols is generally audited to ensure that use was appropriate.

Automatic visibility of health information

One of the most frequently used and most liked part of Mabel was access to test results. Patients reported that it allowed them the ability to track changes over time and take a more active role in their health.

“I could easily take an interest in my own health data; I didn't have to wait to see someone to get a test result or notes.”

“In the past, I wouldn't be informed if my test results were normal or slightly off. with Mabel I can check this myself, so I don't have to wonder.”

Although access to test results has clear benefits, the use of patient portals for accessing electronic health records can result in patients having access to health information—such as new test results—before a clinician has had the opportunity to discuss the results with them. A mixed-methods study from the US indicated that patients highly valued rapid access to test results before they have been reviewed by their clinician, or before they had met to discuss them. However, it also suggested that such access may lead to increased anxiety and increased rates of patient contacting/visiting their clinicians due to confusion, and therefore add to clinician workload. It was proposed that adding clinical interpretation notes in the record would help to mitigate these negative consequences,[[35]] and is commonplace in primary care portals.[[23]]

In contrast, a recent study in the Netherlands showed that accessing test results before reviewing them with a clinician did not result in significant negative consequences. Any anxiety experienced by the patients was not thought to exceed that caused by the alternative—delay in the test results to allow for clinician review—or the anxiety when delivered abnormal results in person by their clinician. Confusion was more prevalent than anxiety but considered to be less concerning, and it was suggested this could be alleviated by improving communication within the health record, such as clinician notes and minimising time between results being released and a follow-up appointment.[[36]]

A final notable study showed similar results indicating insignificant changes in anxiety and confusion in most participants. Of the few who did experience negative consequences, the results released were considered sensitive or highly emotive, such as relating to suspicion of cancer or incurable genetic conditions. A patient group in a recent study in Belgium preferred concerning test results to be delivered in a consult setting face-to-face with their clinician.[[37]] This highlights the potential benefit of being able to categorise sensitive test results for clinician approval before release. This would allow clinicians to withhold any distressing or confusing results until they were able to speak with the patient or, similarly, not release such results at times when the patient cannot ask questions; for example, just before the weekend.[[37]]

There are identified benefits to automatic loading of test results into PAEHRs without clinician moderation.[[38]] A study with cancer patients illustrated the benefits of patients accessing test results prior to their appointments, as it allowed patients to be more prepared and have questions ready for their clinician prior to the appointment.[[39]] The results showed that accessing results prior to review by their clinician was not associated with increased anxiety, which is similar to the results of another study in cancer patients.[[40]] Further, it is thought that automatic access may mean that patients pick up important results in the rare cases that these fall through the cracks between various clinicians/services in the hospital setting.

These studies highlight that there are clear benefits to the automatic loading of test results, but that there may be a degree of heterogeneity between different patient samples and contexts. In summary, the evidence recommends that within patient portal systems: there is the ability to categorise sensitive test results for clinician approval before release; that there is space for clinician interpretation notes in the record; that if not immediate there is a time cut-off for automatic loading of results if not actioned by a clinician; and that if possible individual patients should have the ability to choose whether they are able to access their results automatically in their health record or only through a clinician.

Auditing

A variety of access and auditing of access protocols exist across different countries and electronic health record systems. A key characteristic of access control is whether health provider access to the record requires explicit consent from the patient, or whether it is implied. Most countries require the patient to give explicit consent for their information to be shared with healthcare providers, although there are some situations where consent is implied if the patient has a therapeutic relationship with the clinician. Even when patient consent is given, there can still be other guidelines in place, such as in Switzerland, where healthcare providers have further defined safety and access levels.[[32]] Other countries, however, such as France, have implied consent whereby the creation of the electronic health record requires explicit consent but from then on consent for sharing information is implied.[[41]] In France, patients are sent a text message when a new physician accesses their information, so that they are aware of who is accessing their information. This is similar to a process in Denmark, whereby patients are sent a letter if a clinician with no known therapeutic relationship to the patient accesses their record.[[20,42]]

As mentioned earlier, many countries allow patients to control what information their clinicians can access, particularly access to sensitive information.[[20,32]] Where countries have a “break the glass” protocol allowing clinicians to access restricted patient information in the case of emergency,[[20,32]] the patient is informed of this exceptional access later. However, Australia differs in that if a patient has hidden information, a clinician cannot access it even in an emergency.

Auditing, and the ability for patients to view the audit results on who has accessed their record, varies between countries, with some countries requiring audits to be done internally, others independently. For example, in Estonia electronic patient record systems are independently audited every two years, while in Sweden access logs to patient records are required to be verified regularly and systematically by healthcare providers and documented or stored for 10 years.[[41]] In many countries, including Australia, Denmark and Estonia, all patient record access activity is logged, and these log files are accessible by the patient, and they can report irregularities.[[20]] In New Zealand, primary care patients are not able to easily audit who has access to their primary care records.

Patient additions or edits to the health record

Previous work has highlighted that many patients want the ability to edit incorrect information when they identify this in their records.[[2]] Furthermore, the Privacy Act 2020 and Health Information Privacy Code stipulate the right for people to access and request corrections to their personal health information stored by the health service.[[3]] Current processes for requesting and handling corrections to their information are time- and resource-intensive on both sides. PAEHRs could potentially allow people to directly edit certain information (such as changes to address or phone number) or to make additions of information to the record.

Although there is consensus that patients should have the ability to request corrections to information in their records, there is little published on the actual use and impact of patient requested amendments.[[43]] Generally, patient additions to electronic health records are limited to personal information such as demographics, current medications and allergies, and do not allow patients to edit information that has been entered by others.[[44]] This allows patients to ensure their information is correct, while protecting the integrity of clinician’s input. Where patient portals do not allow patients edit access, if a patient would like information to be edited or amended they can request this through their healthcare provider.[[45]] This is the case in the New Zealand primary care portals, where patients are generally advised to contact their general practice through their portal regarding errors and for corrections, and do not have the ability to add to or edit their health record directly.[[22]] In our proof-of-concept, the ability to identify errors and correct them (by contacting their clinician) was seen as a benefit of the use of the portal.

“There were a few discrepancies I noticed regarding medical equipment I use which I was able to address with my healthcare provider.”

Further to correcting health information through patient portals, there is benefit to patients adding to the record with their own information (e.g., symptom reporting, treatment outcomes, activity logs). Like patients’ corrections of their records, there is little published on the processes and benefits of patient additions to their electronic records. Allowing patients to add to their electronic health records allows patients to provide their clinicians with up-to-date information, supports better clinician understanding of the patient’s health,[[46]] and also improves the accuracy of the records.[[47]] It is recommended that digital solutions for providing patients with their health information should allow patients to enter their own information, supporting easy and convenient data collection and improving the accuracy of the records.[[48]]

How far back in time should records be made available

Many health records preceded the rise of technology in healthcare or the concept of sharing notes with patients. Therefore, at the time of documentation many clinicians would not have considered this a possibility. Questions arise as to whether it is appropriate for all available records to be available to patients in digital form, or if this should be limited to only those from a specific time point onwards.

Internationally, there is variation in the extent to which historical data is included in digital solutions providing patients access to their records. When rolling out their electronic health record, Estonia made a national standard that all information from 2009 must be included.[[6]] In contrast, in most other countries it was up to the regional government or healthcare provider to decide to what extent historical data was to be displayed (Sweden, Norway, Denmark, Finland, France, Netherlands, Australia, New Zealand, US). When implemented in Denmark, there was an overview of personal medical history included from as far back as 1977 (which includes information such as a list of contacts with hospitals), whereas the overview of contacts with general practitioners only went back as far as 2003 (the year the electronic health record was implemented).[[20]] While there was variation among the different countries, most countries only give patients access to records from the date at which the electronic system was implemented—anything older had to be requested as a paper copy. As most health systems have been guided by what is feasible, there is no answer to the question around what leads to a better experience for patients.

Discussion and recommendations

A patient and whānau centred healthcare system includes patients having easy access to their hospital-held health information when and where they need it. Accessible digital solutions providing patients with access to their hospital-held healthcare records will support patients and whānau to be active and informed participants in their health. Our proof-of-concept raised many design questions that will need to be answered in any future digital consumer access to hospital-held electronic health records.

As other countries have more experience of large scale secondary care PAEHRs, there is much we can learn from them. This review of the available evidence has shown that there is variation in PAEHRs around the world and that the design challenges we identified are not always easy to solve. From this review, it appears that there are some areas where the design will be relatively easy to agree, based on the evidence and the New Zealand context. Some will require investigation of technical solutions, and some may require legal/privacy considerations and potentially national mandates (e.g., how far back records should go).

In summary, this paper discussed a number of challenges that need to be addressed in the design of PAEHRs. Based on how other countries and New Zealand primary care have managed these, we recommend that digital solutions for consumer access to hospital-held health information include the following:

•The option of different access levels where the primary user can provide their delegated whānau or caregiver proxy access to their record with selected functionalities. This will allow support people to be actively involved in supporting a patient;

•The ability for adolescents to have access with the ability to restrict parental/caregiver access for sensitive information. Adolescents taking an active role in managing their health should be encouraged, and therefore access should be available if and when they want it;

•Along with the automatic and immediate loading of test results, the ability for patients to hide the visibility of non-clinician reviewed results if they prefer. This will minimise anxiety associated with delays in test results, but allow choice for those that would prefer to wait;

•A patient-facing log of all users, and accesses to their electronic health records, so patients have the ability to know who is accessing their record and when;

•The ability for patients to add to and comment on information in their record, and the assurance that existing pathways for correcting information should continue. This will ensure patients can actively participate in their care but will also ensure the integrity of the health professional’s judgement is not compromised.

•Transparency by healthcare providers about the date from which records will be made available through electronic solutions (with the principle of ‘as far back as makes sense to consumers and clinicians’), and assurance that other processes for accessing records earlier than this date continue. This may vary due to digital information systems, and technical and clinical processes within each provider.

The above could be seen as the ideal default settings for the New Zealand health system across both primary and secondary care. There will no doubt be some variation across the system, but we suggest this should be transparent and justified for the public.

Other areas still require further investigation before default settings could be agreed, including how to manage sensitive health information. It is recommended that further work with consumers in Aotearoa New Zealand is undertaken to better understand their expectations on these issues.

Conclusion

A Northern Region proof-of-concept providing patients with electronic access to their hospital healthcare information identified several challenges in the design of such “portals”. International and New Zealand primary care portal examples and evidence have led us to make several recommendations around delegated access, auditing access, adding and correcting information, the timing of test result availability, and retrospective records. However, more investigation is required into some challenges around how various types of more sensitive information should be handled. There is also considerable work to be done on how to technically and operationally turn these “default design principles” into reality within the complexity of New Zealand hospitals’ electronic health information systems. This will no doubt lead to some variation in their implementation. Still, shared aims and principles would undoubtedly be a good start to empowering patients to be more involved in their hospital-based healthcare.