Patient Privacy Protection in China in the Age of Electronic Health Records

Abstract

China has embarked on the establishment of a national electronic health records (EHRs) system since 2009. The ongoing transition from the traditional paper based medical records to a centralised EHRs system is expected to bring about significant improvement in safety, quality, integration and efficiency of the health care system. At the same time, these advantages are a threat because they increase the risks of unauthorised access, disclosures and unwelcome secondary uses of patient health information. The potential benefits of an EHRs system can be realised only if patient privacy protection is guaranteed. This article explores how the Chinese law should provide necessary patient privacy protection in the age of EHRs. The discussion is framed by using the OECD's Guidelines on the Protection of Privacy and Transborder Flows of Personal Data, and focuses on five key legal issues of patient privacy protection regarding EHRs, including information collection, information disclosure, sharing and use, rights of the subject patients, data quality and security and enforcement of patient privacy standards. This article provides specific suggestions for the Chinese law to address each legal issue and calls for establishing a comprehensive legal framework to protect patient privacy in China in the age of EHRs.