Understanding Causes of Patient Privacy Loss in EHRs and Health IT Systems

Most Patients don't understand the concept of Digital Privacy

Digital is a "cyber world" and not easy to picture so patients believe their data and privacy is protected when they may not be. The digital health IT world of today is like walking into a patient's room in a hospital in which it's a large shared space with no curtains, no walls, no doors, etc. (even for bathrooms or showers!). In this imaginary universe, each private discussion happens with the goal that others can hear it, all methods are acted before others, and so forth without the patient's assent and their protests don't much make any difference. It is likely that if patients can imagine that scenario, they would have some idea of how digital privacy today is conducted - a big shared room where everyone watches and listens, regardless of what the patients think.

It's less Expensive to Create Non-Privacy-Aware IT Solutions

Since creating privacy into software from the beginning is difficult and requires expensive security resources, we frequently see developers wait until the end to consider privacy. It isn't possible to add privacy on top of an existing system like it is to add security - either it is built into the system or it won't work. Since leaving it out is more economical than putting it in, it's often left out.

As designers, architects, and engineers talk the talk but it is difficult to walk the walk when it comes to privacy due to the difficulties of creating viable systems within a coordinated, integrated digital ecosystem. Because digital privacy is so difficult to define, even in simple single enterprise systems, the difficulty in defining it across multiple integrated systems explains many poor privacy implementations in modern systems.

Patients don't Request Privacy from their Providers

As far as we are concerned, all patients should be given access to their health data securely. Yet, it's rare for patients to choose doctors, health systems, or other care providers based on how they view privacy. Although patients usually switch providers even when privacy violations are found and punished, they will rarely switch providers afterward.