.avif){kind=small}
Introduction
Healthcare around the globe has seen a gradual movement towards community-based care, especially with the rise of an ageing population and the need to provide for those with chronic diseases. As such, technological innovations have been developed and implemented to allow the health of an individual to be longitudinally tracked over the course of their lifetime to ensure continuity of care and improvement of preventive healthcare, among other benefits.
Malaysia has been no exception to this trend in its efforts to put in place a system that digitalises health records. Historically, the nomenclature for Malaysia’s envisioned system has varied. In this article, we use the term “electronic health record” (EHR) to refer to “a digital, longitudinal record of patient health that can be shared between multiple healthcare providers and facilities”. We will briefly summarise the potential benefits of EHRs, and focus on outlining some of the possible pitfalls and risks of EHRs to inform Malaysia’s journey towards digitalising the nation’s health records.
The Benefits of EHRs
We have addressed the benefits of EHRs extensively in previous writing. Most of these benefits stem from the advantages of having a centralised database of patient data in a digital format, so that data can be processed and read in useful ways by different stakeholders.
At a macro level, healthcare administrators have more information to manage patient flow between large hospitals and community/primary healthcare providers, and to recommend digital consultations if appropriate. With an EHR system housing updated and comprehensive patient data, it is also possible to conduct health screening campaigns targeted at patient populations vulnerable to specific health conditions to catch developing diseases at early stages.
At the patient level, having access to their medical history and health data empowers them to monitor their health and make more informed decisions. An integrated data sharing system across healthcare facilities also eliminates expensive duplicative testing when patients move between different facilities. Another way that an EHR supports patient empowerment is through automated reminders for follow-up appointments and taking medication at scheduled times, which can help significantly in improving and maintaining patient health.
All these lead to desirable outcomes of saving cost, promoting continuity of care, and improving preventative services, at the levels of population and patient care. A well-maintained EHR also forms the foundation for data analytics and machine learning for further applications such as epidemic detection and improving medical diagnostics, which rely on robust and large datasets.
Potential Risks of EHRs
While the benefits of EHRs are many, it is important to recognise challenges that will arise with the introduction of a centralised database of sensitive health data and a digital layer onto the already complex healthcare system.
Security and privacy risks
The digital infrastructure of critical systems is a lucrative target for cybercriminals. As healthcare facilities share information and data across devices and third party vendors, there are multiple points of vulnerability that can be exploited by attackers that are often (but not always) motivated by profit. In recent years, there have been multiple ransomware attacks on the digital infrastructure of hospitals, whereby criminals conduct a “double extortion” on hospitals.
The first point of blackmail happens by capturing and restricting access to data and hospital systems, which can lead to life and death situations. The second point exploits the fact that healthcare data is sensitive and valuable, and criminals threaten to release the data into the public domain unless their demands are met. A particularly chilling example of ransomware happened to a psychotherapist centre in Finland, involving a third dimension of extortion beyond the usual. Cybercriminals did not only target the facility, but also individual patients, threatening to publish personal identity codes and therapy session transcripts if they did not pay the ransom.
The Ministry of Health in Malaysia has acknowledged that ransomware attacks might be a concern once the country builds an integrated health database system. Data breaches are not uncommon in Malaysia, which ranks 11th in the most breached countries in the world. Ransomware attacks have also affected Malaysian companies, as seen in the November 2022 attack on AirAsia, in which the data of five million passengers and AirAsia staff were compromised. Incidentally, Daixin Team, the group claiming responsibility for the AirAsia attack, also has a history of attacking healthcare businesses in the US.
Besides guarding against data breaches and malicious cyberattacks, it is important that healthcare data is insulated from commercial exploitation. The Code of Practice for Private Hospitals in the Healthcare Industry in Malaysia requires private hospitals to obtain additional consent if patient data is used for non-medical purposes, such as for direct marketing activities. However, it is also stated within the Code of Practice that anonymised personal data can be kept “for research, education, or for uses that does not require identifiable information” without restrictions on data retention so long as data subjects are not identifiable.
Elsewhere, researchers have raised ethical concerns on private companies acquiring databases of healthcare systems, even when anonymised, as there is a danger of that data being traceable back to the individual. Vulnerable populations can be targeted by those with commercial interests, such as exposing recovering addicts to triggering advertisements, or charging higher insurance premiums to those who have medical conditions. Stringent data governance will have to accompany an EHR to safeguard the population against such violations.
System design and implementation issues
A study interviewing 31 medical doctors in three Malaysian government hospitals uncovered some themes on unsafe use of hospital information systems (HIS) relevant to our discussion on EHRs. Factors that contributed to higher error rates that affect patient safety include the following:
- Lack of capacity in using the HIS: This applied especially for new doctors who did not understand how the system worked, and how to integrate the use of HIS in the healthcare delivery process.
- System quality in terms of usability and reliability: An example of a usability problem is that patient data was spread out in different pages of the HIS interface, causing delays and increasing the likelihood of confusing patient identities. Doctors also related that system breakdowns forced them to do the work manually, causing problems in patient data entry and critical tasks such as ordering medication.
- High workload, multitasking and interruptions: These were cited as common stressors in the doctors’ work that increased the likelihood of erroneous data entry and information processing.
- Insufficient computer resources: In some clinics and wards, doctors had to share computers and laptops, causing delays and double work in data entry, as notes had to be taken by hand first and then entered into the system later.
- Teamwork and coordination: The HIS did not ensure seamless coordination and clear communication within the medical team, leading to problems such as multiple ordering of medication, or wrong treatments based on outdated information within the system.
The factors above inform us about the Malaysian context in which EHRs will be applied, providing a preview of potential problems that might happen in local healthcare facilities when adopting digital technologies. Studies connecting EHRs and patient safety have been conducted outside of Malaysia, and appear to confirm some of the anticipated pitfalls.
In general, the existence of EHRs does not automatically lead to better and safer outcomes for patients. EHRs are able to enhance healthcare delivery only when they are designed and implemented properly. As Malaysia embarks on its EHR journey, more empirical research needs to be done to monitor and evaluate that the process of digitalising healthcare does not compromise patient care.
Inequalities in access and literacy
The usage of EHRs will require healthcare providers and patients to undergo a digital transition, exposing inequalities in access and literacy in the fields of healthcare and communications. Even though the Covid-19 pandemic had expedited this process, some indicators show that the transition does not happen at an equal pace across the population.
To begin with, the quality of digital infrastructure within different states in Malaysia differs, as indicated by the Network Performance Reports published by the Malaysian Communication and Multimedia Commission. Different providers of wireless and wired broadband services in different parts of the country yield uneven quality of service, and therefore a nation-wide digitalised health records system needs to take into account disparities in access.
In terms of actual usage of the internet for health-related purposes, the ICT Use and Access by Individuals and Households Survey (ICTHS) 2021 published by the Department of Statistics Malaysia (DOSM) provides some idea of usage patterns across different states. For example, there is a significant difference in percentage points in individuals using the internet to seek health information between the most active state (Terengganu, at 91.5%) and the least active state (Sarawak, at 57.9%). For making medical appointments online, the disparity is even worse (Terengganu at 75.5% compared with Perlis, at 11.9%).
Conclusion
As seen during the Covid-19 pandemic, embracing technology within the healthcare landscape is integral to ensuring that Malaysia’s people continue to be protected against current and future health challenges. In the process of digitalising healthcare records, minimising risks and unintended consequences on patient lives, the healthcare system, and society in general needs to be of the utmost priority.
As Malaysia is still in early stages of implementing a full-fledged EHR, the country is well-placed to proactively address issues that may arise from this digital transition. Stringent data security and data governance measures have to be set in place to counter security and privacy risks. We need to design the system to be inclusive, thoroughly test it for usability issues and incorporate low-tech backup protocols. This is to reap the full range of benefits of EHRs, as the country closes its digital divide in the years to come.
