Privacy fears hang over EU-wide patient data system

The pharmacist, with the consent of his client, retrieves the prescription over the Internet via so-called national contact points that convert the Italian drug to its Greek equivalent, and all ends well.

The scene is from a promotional video from epSOS, an EU-funded pilot project which is to lay the groundwork for a union-wide system of easily exchangeable patient data, to be in place by 2015.

Making the change

The benefits are obvious. Today, there are big differences across Europe in the kind of patient data collected and the way in which it is stored. In reality, the man from Italy would have had to visit a doctor in Athens first to get a Greek prescription.

Even within member states, differences exist. "Sometimes even within cities, or even within hospitals," says Birgit Beger, secretary general of the Standing Committee of European Doctors.

According to a study conducted for the European Commission, only two thirds of European hospitals have an integrated system in place of electronic patient records. One fifth of hospitals only use paper.

Furthermore, the European Commission argues, today's fragmentation forms a barrier to the internal market and to innovation in the field of healthcare.

But what about the drawbacks? Does an EU-wide system not pose an increased risk to privacy?

"It depends," says Giovanni Buttarelli, assistant European Data Protection Supervisor.

It would if it meant the creation of one big central database of personal health records that reveal people's entire medical history.

That would be "simply a monster," he says. It would be prone to security breaches. "Security is something you can look for, but not ensure."

Better is to introduce access to data on a need-to-know basis - a general practitioner would not have the same access as, say, a neurosurgeon - and to spread out the data over a network of local repositories.

The harmonisation of standards would bring some much-needed clarity to the rules about who has access to which data and for what purpose, says Buttarelli, something which is often missing today.

"I see a major problem with local and national public authorities," he says. "There is often a lack of data protection culture."

It is a claim supported by several incidents. In June 2011, a laptop went missing from an office of the UK National Health Service carrying the unencrypted medical details of more than 8 million people.

In other countries, including Finland, the Netherlands and Spain, health data - on a par with data on race, political opinion or sexual preference, according to the EU's data protection law - has accidentally been exposed.

"At this point in time, the security of patient data [in Europe] is not at the optimal level, to use a euphemism," Paolo Balboni, scientific director at the European Privacy Association, told EUobserver.

Going global

The precise infrastructure of the future system remains unclear for now, but is likely to be based on national contact points, like epSOS, on intermediaries between healthcare practitioners across the continent.

But the move towards electronic health data is becoming more inevitable by the day as technology continues to progress and borders fade.

"It is the future, we cannot stop it," says Balboni.

"The portability of health data is a necessity for the current world," says Buttarelli. "You cannot simply say: Okay, let's go back to paper."

The European Commission and the US health department in 2010 both promised "to promote a common approach" on the interchangeability of health records. Other countries around the globe, such as China, Russia and Brazil have already expressed interest.

The future may hold a global system of interchangeable health records. In which case the man from Italy could ask for medication in a pharmacy in Beijing and be sure to get it with an e-prescription.