A shocking news is reported in the newspapers on 23rd February 2008 disclosing a registered medical practitioner convicted for not complying with the Personal Data (Privacy) Ordinance (Cap. 486) and he was fined HK$ 1,000.00. The story goes back to 2007 when one of his patients requested twice for copies of the medical records which the doctor could only comply with the first request but not the second. Explanation given by the doctor was that the 15 years・ medical records for the second request on July 7, 2007 could not be retrieved. However, the doctor did not explain such to the patient in the process. He was convicted for delaying in releasing copies of the medical report to his patient more than 40 days, and without appropriate explanation. I can・t imagine the doctor・s shock on having such punishment, but surely it would be a bitter lesson to learn for all of us.
Another story behind the scene nearly ends up in High Investigation case from the Office of the Privacy Commissioner for Personal Data. The story goes back to almost the same time as the aforesaid case in June 2007 when another patient requested photocopies of her medical record from one of our member doctors. The doctor quoted the charge of HK$ 300.00 for data access. However, the patient considered that the price was unjustified and complained to the Privacy Commissioner for Personal Data (PCPD). The doctor reduced the charge to HK$ 165.00 taking reference from the price set by the Hospital Authority for similar procedures. (The prices quoted in HA and some private hospitals are tabulated on P. 3 for your reference.)
However, the PCPD persisted to judge that the prices quoted were still unjustified and repeatedly demanded that doctor to give a breakdown of the costs. Despite several communications between the doctor and the PCPD, the issue remained unsettled. Finally, the patient on her own accord accepted the offer and paid the said cost for the photocopies.
This member referred his case to your Council for assistance complaining the PCPD failed to act according to the ：Complaint Handling Policy； by not acting within the period to settle the issue for the benefit of both parties and on the contrary persistently exerted unwarranted pressure unilaterally on the doctor demanding breakdown figures on an unsolvable problem beyond the capacity of the doctor.
Your Council took the initiative to request a meeting with PCPD on 17th April 2008 as reported on Page xx of this Bulletin. Topics discussed during the meeting included:
1. To discuss how to comply with data access request under the provisions of the Personal Data (Privacy) Ordinance;
2. To discuss the administrative fees for data retrieval;
3. To discuss the ownership of patients・ records;
4. To discuss the storage/disposal of patients・ records;
5. To discuss the implication of computer usage in patients・ records.
I would like to highlight the following essential points during the meeting for members' reference:-
A data user (doctor in our case) is required by law to comply with a data access request (DAR) within 40 days of its receipt unless written explanation is given to the DAR prior to the deadline for the reason of noncompliance, e.g. lost of data. According to the PCPD, the data (especially medical records in our profession) should be kept as long as such data is still useful. For our Profession, the Dangerous Drugs Ordinance requires in and out data of dangerous drugs for at least two years, and for data containing financial transactions, the Inland Revenue Ordinance demands us to keep the records for at least 7 years while the Medical Council advised doctors to keep the medical records as long as possible in order to protect the patients and the doctors themselves.
As long as the administrative fees for data retrieval are concerned, the PCPD said it should be reasonable and not excessive. The costs should be that amount to recover only the labour costs and actual out-of-pocket expenses involved in the process of complying with a DAR in-so-far as they relate to the location, retrieval and reproduction for the data requested. The labour costs should only refer to the normal salary of a clerical or administrative staff who handle the location, retrieval or reproduction. The extra work by a registered medical practitioners in the process, e.g. explanatory notes on abbreviations, corrections to the medical records, etc, should not be charged to the DAR.
The medical records belong to the clinics, institutes or the owners of such. Employee doctors are not entitled to retrieve the records once they have left their employers. If confronted by DAR, he may refer the DAR to his previous employer for copies of the medical records.
Under Section 26 of the Ordinance, a data user is required to erase personal data held by him if such data are no longer required for the purpose for which they are used unless the erasure is prohibited by law or contrary to public interest. Ways of disposal of medical records would be the same as that required in Clause 1.3 ：Handling of medical record upon transfer or cessation of practice； under the title of Patient・s privacy and confidentiality of our Professional Code and Conduct.
As for computer manipulation of medical records, data user on complying with the data request from DAR should make sure that the medical records transferred electronically be 100% secure. We have asked the PCPD and the Hospital Authority (HA) on the way of handling of the medical records obtained through the ePR project. The HA said that if the data user of ePR make notes of the essential points of the patient from HA record onto his own records, that part of the medical records can still be photocopied to the patients. However, please note that HA do not allow doctors to copy and paste electronically the whole medical notes from the ePR to their own medical records. So please take care of this point in your record retrieval.
Yes, our method or culture on record keeping would have to change to cope with new expectations of our society. Just like we have to face the effects of global warming with the record breaking earliest arrival of Typhoon Neoguri on 18th April 2008. I hope we have clarified the issue to a great extent with the PCPD and your medical records should now be ready at all times for data retrieval!
Dr. Yeung Chiu Fat Henry