Lisa Devos is glad to have access to her patient's health information.
The owner of the St. Albert Salvus Rxellence Professional Dispensary said the Alberta Electronic Health Record (also known as Alberta Netcare) aids her in keeping track of treatments, prescriptions, and to check if patients were using their medication appropriately.
"For instance, if we are doing an adaptation to extend their prescription we can access their lab (results) to make sure everything is okay," she said.
"We can see where they are at and they like that we can do that on their behalf."
Devos said many of her patients assume that the pharmacists share information with doctors on diagnosis and treatment. And for the most part, she said they are happy about that.
Less happy were those Albertans who dealt with unauthorized health professionals "snooping out" their patient information in the past.
That's why the Office of Alberta's Information and Privacy Commissioner now wants to heighten people's awareness on privacy rights and information provided in Netcare.
Patients cannot control information made available to health care professionals, said Brian Hamilton, Director for the Health Information Act. But they can exercise control over the information in Netcare.
"It's becoming more and more apparent that Albertans don't really understand what their rights are in relation to Netcare," he said.
"And a lot may not be aware that they can do things to have some control over what's done with their health information."
Netcare is not the same as a medical record held by family physicians, which often includes intimate information and details on conversations.
But it provides the core summary of a patient's medical history, such as information on prescriptions, age, height or weight, diagnostic images or x-ray reports.
"This is the basics that would be good to know if you showed up somewhere where people didn't know you and you needed medical care," Hamilton said.
He added that patients are free to see the information on them. The official process of gaining access is to request it through a physician who then has 30 days to respond.
If a patient is not satisfied with the response they can ask for a review with the Office of the Privacy Commissioner. They can also know what's in Netcare by asking for a print-out.
But many physicians will just turn the computer screen and let their patients look at the information, Hamilton said.
Masking
Patients can also mask information, making it inaccessible to any physician unless they provide a specific reason.
"If you place a mask on your record a user might search for your name but they wouldn't be able to see your medical details unless they remove that mask by providing a reason for why they are removing it," he said.
"For example, an emergency information where they remove the mask to provide you with care."
He said patients often place masks on their record to protect their privacy.
In the past, the office investigated care providers looking up information on patients for no obvious reason, maybe after a falling out, or to find out where someone lived.
"It's not always malicious. Sometimes it's just curiosity but it's still against the rules," Hamilton said.
He added that the decision to unmask a health record is always audited.
If someone removes a mask without due reason they can be disciplined or fired. Some cases are brought before the Office of the Commissioner who can lay charges under the Health Information Act and fine someone for up to $50,000 in severe cases of privacy fraud.
Devos said her pharmacy had to go through a privacy impact assessment before getting access to Netcare. They also have privacy screens and encrypted firewalls on their computers.
"Netcare has highlighted some of the privacy issues that may or may not have existed previously," she said.
"But from a pharmacy standpoint it has been really beneficial for us to have this."
The Health Information Act also allows patients to see who accessed the record and to correct errors and omissions. The care provider then contacts Alberta Health Services to handle the request.
"There's no ability to say you want something erased or deleted and the responding custodian does not have to obey those requests but consider them," Hamilton added.
"But generally people in the health-care system want to get things right."
