Level of access in health care

Access to healthcare is central in the performance of health care systems around the world. In fact, the importance of service delivery for people has resulted in measurement of utilization and access having a prominent role in the health policy

Privacy protection

1. limited scope of sharable data

Healthcare providers can only access to the data within the pre-defined scope of Electronic Health Record EHR sharable data (not all your personal data provided during treatment). Hence, before joining the System, you should as certain the scope of sharable data from healthcare providers.

2. Clear understanding before joining

• Before joining the System, you should carefully read the Personal Information Collection Statement, Privacy Policy Statement and Participant Information Notice provided by the Commissioner for the Electronic Health Record to understand what personal data is kept in the System, how the data is used, the parties to whom the data may be transferred, etc.
• Before giving the sharing consent, you should carefully read the privacy policy of a healthcare provider to understand how your personal data will be processed in the System, as the privacy policies vary between healthcare providers.

3. Cautious consideration before giving consent

• Consent referred to in the System means express consent of a patient.  Hence, if you have any questions about the collection, processing and protection of personal data in the System, you should clarify them with EHR Registration Centers or healthcare providers before giving joining consent or sharing consent.
• After you have given your consent, healthcare providers may access your EHR on the need-to-know principle. Hence, you must cautiously consider and decide before giving your sharing consent.

4. Right to revoke consent at any time

• Participation in the System is voluntary. You may withdraw from the System and revoke your sharing consent given to any healthcare providers by making an application to the Commissioner for the Electronic Health Record at any time. 
• As it takes time to process your revocation or withdrawal request, if you need to receive treatment during this processing period, you should inform the healthcare provider of your application for revocation or withdrawal. The healthcare provider should respect your decision.

5. Maintaining consent record

after you have given your sharing consent, the System will send you a notification by a means chosen by you (like SMS). You may record the details of the sharing consent given to healthcare providers (including names of healthcare providers, dates of giving the sharing consent and validity of sharing consent) for future reference.

6. Right to access data

For access to your personal data in the System, you may exercise your data access right under the Personal Data (Privacy) Ordinance. You can make a data access request to the Commissioner for the Electronic Health Record by completing a Data Access Request Form issued by him.

You may also make a data access request to an individual healthcare provider for accessing your personal data in its local system. As a data system operated by an individual healthcare provider is independent of the System, a healthcare provider is Not entitled to provide you with the health records uploaded to the System by other healthcare providers, when you make a data access request to that healthcare provider.

7. Safe keeping of data

You must safeguard the copies of EHR obtained in a data access request to avoid leakage of personal data.

8. Right to correct data

If you find your personal data accessed via the above channel to be inaccurate, you may request for data correction by writing to the Commissioner for the Electronic Health Record.

However, as the EHR in the System is provided and uploaded by healthcare providers, you may make enquiries with the healthcare provider concerned first.

9. Paying attention to access notification

All access activities will be logged in the System. At the time of registration, you may indicate the means (like SMS) by which the System sends notification to you whenever your EHR is accessed.

If you suspect that your EHR is accessed by an unauthorized party (a healthcare provider without your sharing consent), you should notify the Commissioner for the Electronic Health Record immediately or make enquiries with the healthcare provider concerned.  

10. Giving consent on behalf of minors or persons in capable of Managing their own affairs

The System respects a participant’s right to self-determination. Hence, decision of joining the System or giving sharing consent must be given by the participant himself, unless the participant is a minor (aged below 16) or a person incapable of managing his own affairs.

For the above person, his parents, guardians, person appointed by court, his family member or a person residing with them, or a prescribed healthcare provider will act as a substitute decision maker, who should make decisions in the best interest of the above person.