Managing Health Data Privacy and Security: A Case Study from New Zealand

Abstract

The past decade has seen a rapid upsurge of interest and concern relating to protecting the privacy of personal information. Some countries have enacted adequate privacy legislation: others have not. Protection of personal information privacy is generally accepted as a fundamental civil right: failure to respect this right is widely seen as associated more with oppressive and totalitarian regimes than with free democracies.

Nowhere is the issue brought into clearer focus than in the context of wide area health information systems. Patients expect the information they share with their clinician in the context of receiving care to be respected and kept confidential, whether or not that data is seen by others as potentially sensitive. Providers of care services expect to be able to do this, but are increasingly finding that administrators, and especially purchasers of care services, are requiring access to information which is inconsistent with this ethic.

Introduction of computer systems offers improved accessibility and mobility of data, bringing clear benefits, but also risks, especially to confidentiality. The popular perception, based on past experiences, is that such systems do not protect personal privacy: where security is suspect, information will be withheld and the usefulness of the system will be degraded. Systems where privacy and security issues are inadequately managed will never be able to fulfill their intended purpose, and therefore represent poor value for the money that must be invested in them.

This paper addresses some of the key issues, and outlines how they have been successfully addressed in the context of a national health information system in New Zealand.