Security of health care records in Belgium

Abstract

Access rules to electronic patient records (EPR) have been issued by the Belgian Council of Physicians. Access to identifiable data of the EPR is restricted to anyone responsible for diagnosis, treatment and continuity of care of the patient. By delegation, associated personnel, like secretaries, can also be authorised to have access. A new perspective is given by the availability in 2003 of a national identification card allowing electronic signature of patients. It could not only authorise but also forbid some accesses. A law in 2002 gives right to patients to access to their own record. Health personnel can also be identified by cards but the system is not yet implemented. In the meantime, local measures have been made. We describe practical solutions that have been taken as priorities in a University Hospital. It was felt more important to allow access to lifesaving EPR data than to restrict its access by too strictly theoretical rules. A pilot study (S3 project) is also in progress for interinstitutional communication in Belgium, using the unique identification number of the patient and a "third server".

Data Behind the Walls – An Advanced Architecture for Data Privacy Management

“…They highlighted that the processes for defining the roles in an EHR system play a vital part in access privileges management. Others proposed structured roles and grant access only to entities located in the authorisation table [11]. The privacy and security maintenance committee is the only authority that can act on the authorisation table.…”