ISBN 0-478-181xx-x

B.29[17o]

Ministry of Health: Supporting the implementation of patient portals

Presented to the House of Representatives under section 20 of the Public Audit Act 2001.

November 2017

ISBN 978-0-478-44276-2

Contents

Overview

Our recommendation

Part 1 – Introduction

What we looked at

Why we did this audit

What we did not look at

How we did our audit

The structure of this report

Part 2 – Understanding the intended benefits of patient portals

The Ministry of Health’s strategic outcomes

The intended benefits of patient portals

Part 3 – Working with the health sector

Working with a wide range of health sector organisations

Identifying and addressing barriers to the uptake of patient portals

Providing continued advice and support

Uptake of patient portals has increased

Part 4 – Monitoring and promoting the benefits achieved from patient portals

Monitoring impact and benefits of patient portals

Promising signs of benefits being achieved

Encouraging further uptake of patient portals

Part 5 – Safe and secure access

Requiring compliance with the Privacy Act and the Privacy Code

Advising on security issues

Balancing privacy, security, and access

Figures

1 – Barriers to the uptake and use of patient portals

2 – Number of general practices offering patient portals and patients over 18 registered to use patient portals, from March 2014 to March 2017

Overview

New Zealand’s health system supports nearly every New Zealander at some time in their life. As part of providing better services to New Zealanders, the Ministry of Health (the Ministry) is using emerging technology to help people use those services more easily.

Patient portals are secure websites that allow people to access their personal health information and interact with their doctor. Through patient portals, people can send secure messages to their doctor, order repeat prescriptions, and, in some patient portals, view lab results and doctors’ notes.

Private companies develop and run the patient portals, and primary health organisations and general medical practices buy access to them. As part of the New Zealand Health Strategy 2016’s goal of giving people access to their own health information and encouraging them to be more involved in decisions about their treatment, the Ministry supports the uptake and implementation of patient portals. The Ministry provided a small amount of funding to primary health organisations to help them increase patient portal uptake. However, primary health organisations and general practices had to pay for the patient portal software themselves.

My staff looked at how well the Ministry supported primary health organisations and general practices to implement patient portals.

The Ministry gathered support from, and worked co-operatively with, organisations throughout the health sector, including the Royal New Zealand College of General Practitioners. This support included helping the Ministry to identify, and then working to address, concerns that some doctors had about patient portals.

As at 31 March 2017, just over 50% of general practices were offering patient portals, and about 9% of patients over the age of 18 were registered to use them. There has been an increasing uptake in recent years, with most of those general practices having started offering patient portals since June 2015.

In my view, how the Ministry worked with the health sector contributed to this increased uptake of patient portals. This is a good example of different parts of the health sector working together to achieve a common goal.

Because patient portals give people access to their personal health information, primary health organisations and general practices need to ensure that patient portals are safe and secure from unauthorised access. The Ministry is part of a group that contributes to a strong framework of privacy rules and rights, standards, and guidelines. This framework supports primary health organisations and general practices to protect people’s personal health information.

As well as ensuring safety and security, privacy rules and rights also ensure that people have access to, and control of, their personal health information. By giving people greater access to their own health information, patient portals help to improve privacy rights.

My staff saw signs that patient portals were having a positive effect for people and general practices, including improved access to, and efficiency of, health services.

The Ministry is continuing to support primary health organisations and general practices to implement patient portals. However, the Ministry does not collect statistics on the benefits achieved from patient portals. Therefore, it cannot show how patient portals contribute to the strategic outcomes in the New Zealand Health Strategy 2016, or use that information to promote continued uptake and use.

In my view, there is an opportunity for the Ministry to provide added value by collecting statistical information that would enable it to demonstrate the benefits of patient portals. This could help encourage general practices that are reluctant to use them.

I thank the Ministry and its staff, and other interviewees, for their time and participation during our audit.

Greg Schollum
Deputy Controller and Auditor-General

21 November 2017

Our recommendation

We recommend that the Ministry of Health collect statistical information on the benefits achieved from patient portals and use this information to encourage general practices to implement and use them.

Part 1 – Introduction

1.1
In this Part, we discuss:

what we looked at;

why we did this audit;

what we did not look at;

how we did our audit; and

the structure of this report.

What we looked at

1.2
We focused on patient portals provided by general medical practices.

1.3
Patient portals, at their most basic, provide patients with a secure messaging function between them and their doctor, the ability to book an appointment, and the ability to order a repeat prescription. Some patient portals allow people to see their test results, a summary of their health record, and doctors’ notes.

1.4
Patient portals were initially a health sector-driven initiative. Private companies created patient portals, making them available to general practices in 2008. The Ministry increasingly recognised how patient portals could support various objectives in the Ministry’s National Health IT Plan Update 2013/14 and health strategy. Specifically, patient portals could improve people’s access to information about their health, encouraging and empowering them to be more involved in their healthcare and in decisions about their treatment.

1.5
We looked at how the Ministry has supported the uptake and implementation of patient portals by public health organisations (PHOs) and general practices. In particular, we looked at:

how well the Ministry worked with the health sector to encourage the uptake and implementation of patient portals;

how effectively the Ministry was monitoring whether patient portals were delivering the intended benefits; and

to what extent the Ministry was supporting safe and secure access to peoples’ personal health information.

Why we did this audit

1.6
We wanted to provide assurance to Parliament and the public about how effectively the Ministry has supported the uptake and implementation of patient portals.

1.7
The theme for our 2016/17 work programme was Information. Assessing the roll-out of patient portals aligned with what we wanted to examine under this theme. In particular, we wanted to see how well the public sector was:

deploying technology to enable accessible services that meet the changing needs of New Zealanders;

managing and making use of the information it collects or generates to inform the effective and efficient delivery of public services; and

managing security and privacy requirements so that the information it collects is suitably protected.

1.8
The findings and insights from our themed work become part of a report that is published at the end of each work programme, reflecting on what we have found. Our findings on the uptake and implementation of patient portals will contribute to a report reflecting on the Information work programme.

What we did not look at

1.9
We did not look at other information-sharing products and initiatives in the health sector, such as shared care records.

1.10
Although we looked at general practices, this was in relation to how the Ministry was supporting them to implement patient portals and to provide general context and background. We did not audit the activities of general practices, PHOs, or the private companies that develop and sell access to patient portals, nor did we directly audit the safety and security of patient portals.

How we did our audit

1.11
To carry out our audit, we reviewed:

the Ministry’s internal documents on patient portals;

the Ministry’s material promoting patient portals to general practitioners, practice managers, and the public;

documents produced by the Ministry, the Royal New Zealand College of General Practitioners (the College of GPs), and others that provided advice and information on patient portals; and

documents from the Ministry and others that provided more general advice and information on related matters, such as health information privacy, cloud computing, and information security.

1.12
We interviewed doctors and staff at several general practices and staff at the Ministry, the College of GPs, PHOs, the University of Auckland’s School of Population Health, and the Office of the Privacy Commissioner.

The structure of this report

1.13
In Part 2, we examine whether the Ministry had a clear understanding about what it wanted to achieve by supporting the implementation of patient portals, including the intended benefits.

1.14
In Part 3, we look at how the Ministry worked with the health sector and with the general public to support the implementation of patient portals. We also look at the Ministry’s work to address barriers to the uptake of patient portals.

1.15
In Part 4, we discuss whether the Ministry is monitoring the impact and benefits of patient portals.

1.16
In Part 5, we discuss how the Ministry has contributed to the established framework of privacy rules and rights, standards, and guidelines to support PHOs and general practices in managing the security and privacy of people’s personal health information.

Part 2 – Understanding the intended benefits of patient portals

2.1
In this Part, we examine whether the Ministry had a clear understanding of what it wanted to achieve from supporting the implementation of patient portals, including:

how this would support the Ministry’s strategic outcomes; and

the intended benefits for people, general practices, and the health system.

Summary of our findings

2.2
Patient portals were an important part of the Ministry’s strategic outcome to encourage and empower people to be more involved in managing their health and making decisions about their treatment.

2.3
The Ministry and other health sector organisations clearly understood the intended benefits from using patient portals, which included improving people’s access to, and the efficiency of, health services.

The Ministry of Health’s strategic outcomes

2.4
The Ministry was clear about how patient portals could support its strategic outcomes.

2.5
Patient portals were part of the Ministry’s eHealth work programme. The eHealth work programme aimed to contribute to achieving the strategic outcomes described in the New Zealand Health Strategy 2016.1

2.6
The Ministry saw initiatives from the eHealth work programme, such as patient portals, as making the best use of innovation, research, and emerging technology to deliver better health outcomes for the public.

2.7
The New Zealand Health Strategy 2016 had five strategic themes:

people-powered;

closer to home;

value and high performance;

one team; and

smart system.

2.8
Patient portals primarily supported the “people-powered” theme. This theme is about making people “health smart” – that is, people can get and understand the information they need to manage their care – and enabling them to make choices about the care or support they receive.

2.9
The Government’s vision for people-powered health by 2026 included that:

People are able to take greater control of their own health by making informed choices and accessing relevant information when they need it; for example, through electronic patient portals.

The intended benefits of patient portals

2.10
The intended benefits from using patient portals were widely reported. They were detailed on the Ministry’s website and in its strategic documents, in most of the guidelines and reports produced by the Ministry and other health sector organisations, and in some presentations to the heath sector.

2.11
We describe the main intended benefits below.

Intended benefits for people who use patient portals

2.12
Patient portals could support new ways for people to interact with their doctor. For example, people could log into the patient portal website and access services when and wherever it was convenient for them to do so. People no longer needed to wait for their general practice to open to book an appointment.

2.13
Patient portals could also make it easier for people in remote areas and those with limited mobility, such as older people or people with disabilities, to access care. For example, people could consult their doctor online through the patient portals, which would help reduce travel costs.

2.14
More importantly, patient portals could improve the quality and safety of health services by providing people with better access to information about their health. This could help people to:

understand their health condition better;

be better prepared for consultations;

understand and take their medication better by having the instructions available;

remember and follow their care plan; and

be more involved in their own healthcare, including detecting and resolving health problems earlier.

2.15
Patient portals are expected to help people improve the quality of their relationship with their doctor, based on people having a more informed view of their own healthcare needs.

Intended benefits for general practices

2.16
As well as improving the quality of the relationship between people and their doctors and people’s engagement in their own health information, the intended benefits for general practices mainly centred on improving the efficiency of administrative tasks. For example, patient portals could reduce:

the time staff spend on booking appointments;

paperwork; and

the number of phone calls staff need to make (by having automated patient recalls and appointment reminders).

2.17
Patient portals were expected to reduce information and activities going through or involving multiple people. For example, through the patient portal, people could order a repeat prescription directly from the doctor instead of having to go through the administration and nursing staff first. General practices could also tell people, through the patient portal messaging system, when their prescription was ready.

2.18
Patient portals could also be a useful quality control measure because people were able to spot errors in their health record and request corrections.

Intended benefits for the health system

2.19
The Ministry had reported that people who were more involved in their healthcare through the use of patient portals could improve the quality and timeliness of health services, reducing demand on health organisations.

2.20
The Ministry also reported that there was increasing evidence that people who felt able to make decisions about their healthcare often chose lower-intervention and lower-cost options. This was in contrast to decisions made by doctors in traditional healthcare settings. To make better decisions about their own healthcare, people need reliable access to information about their health and to understand the various healthcare options available to them.

2.21
The intended benefits of patient portals included improving people’s access to their personal health information, improving the efficiency of health services, and contributing to the quality and safety of health information.

2.22
In our view, the Ministry had a clear understanding of how patient portals could support the strategic outcomes in the New Zealand Health Strategy 2016, including the intended benefits for people, general practices, and the health system.

1 Ministry of Health (2016), New Zealand Health Strategy: Future direction, Wellington.

Part 3 – Working with the health sector

3.1
In this Part, we discuss:

how well the Ministry worked with health sector organisations and the general public to support the implementation of patient portals;

how the Ministry identified and addressed the concerns that doctors and people had about using patient portals;

whether the Ministry continues to provide advice and support for the continued implementation of patient portals; and

how the uptake of patient portals has increased.

Summary of our findings

3.2
The Ministry worked well with the health sector and with a consumer panel that represented the interests of the general public. This collaboration contributed to improved uptake of patient portals.

3.3
Working with a range of organisations in the health sector helped the Ministry to identify and address the reasons why some general practices were reluctant to implement patient portals.

3.4
The Ministry is continuing to work with the health sector to provide support and advice to general practices, which should continue to increase the uptake of patient portals.

Working with a wide range of health sector organisations

3.5
To support the successful implementation of patient portals, the Ministry worked with a wide range of organisations from the health sector, including:

PHOs and district health boards (DHBs);

the College of GPs, General Practice New Zealand Incorporated, and the New Zealand Rural General Practice Network;

Patients First Limited – a not-for-profit charitable company that supports the delivery of health services to the public by facilitating the preparation and implementation of health information technology (IT) solutions and frameworks; and

some general practitioners.

3.6
The Ministry also worked with expert advisory groups. For example, the National Information Clinical Leadership Group provided clinical leadership and advice into IT programmes, such as patient portals. The group’s members came from a variety of professional bodies and colleges.

3.7
The Ministry also set up a consumer panel in late 2010 to ensure that a viewpoint from the general public was provided on IT matters related to healthcare, including patient portals. The consumer panel’s role includes advising the Ministry on consumer-centred health issues, such as how to give people the confidence to allow their health information to be shared online. The panel can include up to 14 New Zealanders with different health statuses and from different ethnicities, age groups, and regions.

3.8
In 2012, the Ministry worked with the health sector through a series of public and community seminars and DHB briefings focused on sharing health information online. The Ministry told us that the seminars were an important first step to supporting the implementation of patient portals.

3.9
The Ministry consulted with experts, gathered a range of views, and commissioned research to understand the issues around patient portals and help shape the approach that would best support their successful implementation. Part of this approach included setting minimum criteria requirements that systems had to meet to be classed as a portal. These requirements included people being able to:

book appointments online at any time;

request repeat prescriptions;

receive recalls for screening or immunisations;

communicate with their doctor through secure two-way messaging;

see annotated lab results;

see summaries of clinical notes; and

see a list of their medications, health events, and immunisations.

3.10
General practices could choose which functions they would start with. Many started with just one or two functions while they adapted to the new service.

Identifying and addressing barriers to the uptake of patient portals

3.11
Working with a broad range of health sector organisations, the Ministry identified several barriers to the uptake and use of patient portals (Figure 1).

Figure 1
Barriers to the uptake and use of patient portals

Cost and ease of implementation and use | There were concerns about the cost of implementing a patient portal, such as purchasing and installing the software, training staff, and maintaining the patient portal. There were also uncertainties about the financial effect of online consultations.
Safety issues | Doctors were concerned about the risk of misdiagnosis, and that patients might not see an email or would not understand or would misinterpret the doctor’s notes.
Privacy and confidentiality | There were concerns about people sharing or accessing information inappropriately or hacking into the patient portal.
Increased workload | There were concerns about a high volume of emails or people overusing the messaging function.
The attitude of doctors | Some doctors were resistant to change for several reasons, including thinking that people who were poor, old, had disabilities, or were not native English speakers would not be able to, or want to, use patient portals.
Lack of access to the internet | Lack of internet access can be a barrier, particularly in rural areas, and for some Māori communities.

3.12
The Ministry recognised that these barriers and concerns needed to be addressed. With support and endorsement from the College of GPs, and help from other health sector organisations, the Ministry worked to address these barriers in a number of ways. We describe them below.

Providing funding and financial advice

3.13
The Ministry provided a small amount of funding to PHOs to help them increase patient portal uptake in their general practices. The funding was used to provide a “clinical champion” – someone who could give promotional and educational support to general practices, help general practices to prepare their IT infrastructure, and install software if required. General practices had to pay for the patient portal software, though sometimes PHOs funded the purchase. We were told that funding patient portals remains a significant barrier for some general practices.

3.14
To address doctors’ concerns about the effect of patient portals on their costs and revenue, Patients First, on behalf of the Ministry, commissioned a research firm to carry out financial and business modelling. The research found that patient portals could have potential benefits for a general practice because they reduced administrative tasks, leaving staff free to do other work. The group’s research is available on the Ministry’s website, along with a link to a financial modelling tool that allows general practices to examine the financial effect of offering a patient portal.

Guidelines for using patient portals

3.15
Some health sector organisations prepared, either separately or in collaboration with the Ministry, guidelines for using patient portals. For example, in April 2015 the Ministry and the College of GPs produced guidelines on subjects such as privacy and security of people’s health information and provided examples of mapping workflow processes to help general practices understand a patient portal’s effect.²

3.16
Staff from the College of GPs said producing these guidelines was a “very collaborative effort”. The guidelines are available on the Ministry’s website.³

3.17
A PHO called Compass Health also prepared guidelines, which are available on the Ministry’s website.⁴ The guidelines were for general practices using or thinking of using the ManageMyHealth patient portal system. They provide advice about business and financial considerations, and include a section that can be used as a training manual for staff.

eHealth ambassadors

3.18
The Ministry appointed eHealth ambassadors to promote patient portals, raise awareness and interest among doctors, answer concerns, and provide guidance and support to general practices that established their own patient portals.

3.19
A review of patient portals by Patients First in September 2014 said that its panel supported having ambassadors “who promote the use and uptake of portals through their own stories and experiences (good and bad)”. In our view, this was a good initiative.

3.20
The eHealth ambassadors we spoke with seemed happy with how the programme initially worked. However, they said that they now had little or no contact with the Ministry. Some continued to provide advice at conferences and other forums but they no longer felt like they were part of a larger initiative. Instead, it was up to the ambassadors individually whether they continued to take part in the programme.

3.21
The Ministry told us that it highly regarded the work the eHealth ambassadors have done and is continuing to use their advice and support (see paragraph 4.30). The eHealth ambassadors are still listed on the Ministry’s website, and the Ministry can put people in touch with them if requested.

Awareness campaigns

3.22
The Ministry ran campaigns to raise awareness about patient portals. The first awareness campaign ran from April 2015 until December 2015 and included magazine advertisements and a website where people could register their interest in a patient portal.

3.23
A second campaign ran between April and June 2016 and focused on promoting patient portals to parents and elderly people. The campaign aimed to drive traffic to the patient portal website.⁵ As part of this campaign, the Ministry added an interactive map to this website that allowed people to see whether their general practice offered a patient portal service. People could send an anonymous email to their general practice requesting it to offer a patient portal if it did not already do so.

3.24
As part of the campaigns, the Ministry also prepared promotional resources in collaboration with PHOs and the eHealth ambassadors to increase doctors’ support for patient portals. These resources included posters, brochures, videos, and microsites.

Providing continued advice and support

3.25
We expected the Ministry to continue to provide advice and support for the ongoing implementation of patient portals.

3.26
Some of the people we spoke with felt that the Ministry was no longer doing much to support the implementation of patient portals. However, we found that the Ministry, in collaboration with some health sector organisations, was continuing to provide advice and support.

3.27
In May 2017, the College of GPs released guidance on how young people can get access to a patient portal. The guidance was prepared in collaboration with the Ministry, the Office of the Privacy Commissioner, the consumer panel, doctors, and IT vendors. It was available only to the College of GPs’ members. The Ministry’s website provided a link to the College of GPs’ website. During our audit, several interviewees had raised issues they had about young people and patient portals. This suggested that the guidance would meet a significant need.

3.28
The Ministry had been doing other work that should help address doctors’ concerns and contribute to the uptake of patient portals. For example, the Ministry has worked on Health Information Governance Guidelines (see paragraphs 5.17-5.20) and a “system-level measures framework”.

System-level measures framework

3.29
System-level measures are high-level goals for the health sector that align with the five strategic themes of the New Zealand Health Strategy 2016 and other national strategic priorities, such as Better Public Service targets.

3.30
The measures focus on helping children, youth, and vulnerable populations. They promote better understanding and use of health information, involving people in the design and delivery of health services, and better health investment in models of care based on local population needs.

3.31
The Ministry worked closely with the health sector to prepare six measures. Some examples include:

reducing hospital admission rates for children aged 0-4 years old;

reducing how long people stayed in hospital; and

reducing amenable mortality.⁶

3.32
Another measure is patient experience of care.

3.33
Each system-level measure has several contributory measures that are tracked over time. The contributory measures for patient experience of care include:

general practices offering a patient portal; and

people who are registered to use a patient portal.

3.34
The system-level measures are part of the DHBs’ annual planning process and provide an opportunity for DHBs to work with their primary, secondary, and community care providers to improve the health outcomes of their local population. DHBs and PHOs need to work through these district alliances to ensure that these measures are implemented.

3.35
One doctor we spoke to described using patient portals as a contributory measure for patient experience of care as a “very clever” way to increase the number of general practices offering patient portals. We agree.

Uptake of patient portals has increased

3.36
Interviewees told us it required a lot of effort from all staff in the general practice to get people signed up and using the patient portal.

3.37
International evidence suggests that general practices are doing well if they can get 25% of their patients signed up to use patient portals.

3.38
As at March 2017, the number of general practices offering patient portals represented just over 50% of general practices and the number of people registered to use them represented about 9% of patients over the age of 18.

3.39
Nearly two-thirds of general practices started offering patient portals after June 2015. Figure 2 shows the increase in the availability of patient portals, and the number of people registered to use them, from March 2014 to March 2017.

Figure 2
Number of general practices offering patient portals and patients over 18 registered to use patient portals, from March 2014 to March 2017

Source: Ministry of Health website.

3.40
In our view, working effectively with the health sector, including identifying and addressing barriers to using patient portals, contributed to the increase in uptake of patient portals since June 2015.

2 The Royal New Zealand College of General Practitioners and the Ministry of Health’s National IT Board, Patient Portals: Practical guidelines for implementation, April 2015.

3 See health.govt.nz.

4 Compass Health (2016), Health care online: start-up guide for general practice.

5 See patientportals.co.nz.

6 Amenable mortality is premature death that could potentially have been prevented, given effective and timely healthcare.

Part 4 – Monitoring and promoting the benefits achieved from patient portals

4.1
In this Part, we discuss:

whether the Ministry monitors the impact and benefits of patient portals;

evidence that benefits are being achieved; and

how further uptake of patient portals could be encouraged.

Summary of our findings

4.2
The Ministry monitored the uptake of patient portals but did not monitor whether the expected benefits were achieved. Therefore, the Ministry did not know what effect patient portals were having on its strategic outcomes.

4.3
We did see evidence of benefits and, despite earlier concerns, patient portals did not appear to negatively affect general practices. These were promising signs.

4.4
There is an opportunity for the Ministry to monitor the intended benefits from using patient portals and show these to general practices that are reluctant to offer patient portals.

Monitoring impact and benefits of patient portals

4.5
The Ministry did not collect statistics to monitor the benefits achieved from using patient portals. However, it did monitor uptake by general practices and people.

4.6
The increase in uptake since June 2015, as shown in Figure 2, provides an opportunity for the Ministry to monitor benefits. This is because the more people who use patient portals, the more likely it is that the intended benefits will be achieved. For example, some general practice staff confirmed that they started to see greater efficiencies when a larger number of their patients were using the patient portals.

4.7
Monitoring the actual use of patient portals is possible. One patient portal, for example, provided reports and statistics that showed how staff and patients were using the portal. This patient portal also had information on the people who had registered to use it but had not activated their account. The Ministry told us that it has started work with vendors and general practices to collect statistical information on the actual use of the different functions of patient portals.

4.8
However, information about uptake alone, or in combination with information about the use of patient portals, does not give the Ministry a full understanding of the effects that patient portals are having on people, general practices, or its strategic outcomes.

Promising signs of benefits being achieved

4.9
Although the Ministry has not collected statistical information about the benefits achieved from implementing and using patient portals, it has gathered anecdotal evidence about the benefits patient portals can deliver for general practices. This is documented in 45 case studies that have been produced since 2015 and have been used to promote patient portals with practices. The case studies included lessons that had been learned, and tips and tricks for implementing portals.

4.10
We also saw some promising signs during our audit that benefits were being achieved. For example, we were told that parents appreciated the convenience of being able to book appointments in the middle of the night when a child was sick, thus ensuring that they got an early appointment the next day.

4.11
People also liked the convenience of ordering repeat prescriptions online and having a list of their prescriptions that they could choose from if they could not remember the name of the medication or how to spell it.

4.12
Some general practices were starting to see that patient portals helped to fix issues that some doctors were already experiencing. For example, through the patient portals, doctors were able to better manage some of their more high-use patients by allowing them to see their information on the patient portal, rather than having the patient visit the general practice most weeks.

4.13
Doctors who were concerned about people overusing the messaging function have the ability to block people from using that function. One PHO told us that it was starting to get data that showed that general practices were not overwhelmed by emails as a result of patient portals.

4.14
Some of the doctors we talked with found that other doctors’ concerns about people not understanding or misinterpreting notes were not eventuating. One doctor said they had a very educated and articulate population with a high degree of health literacy, and that those people were highly involved in their own healthcare.

4.15
An interviewee from the consumer panel said that doctors should not assume that people who were poor, old, or not native English speakers would not be able, or want, to use a patient portal. They knew of people who were blind, people who were not native English speakers, and elderly people who wanted to use the patient portal because they thought it would help them.

4.16
The general practices were also finding that the patient portals created efficiencies for them because administration staff had more time for other work. For example, people directly interacting with the doctor through the patient portal for prescriptions meant less work for administration staff. One PHO told us that it was starting to get data that showed these efficiencies as well.

4.17
One doctor told us that people going straight to them for repeat prescriptions also meant there was less room for error.

4.18
One PHO had forecast demand for medical services for the next 25 years. It found that it would probably not be able to meet the expected demand if it continued with only face-to-face consultations.

4.19
However, we were told that using technology such as patient portals was having a major effect on the PHO’s general practices’ ability to remain sustainable because they were able to move a large number of consultations online. The face-to-face consultations were left for those people who really needed them. This allowed the general practices more scope to proactively engage with at-risk people who, for whatever reason, were not engaging with primary care. The general practices were able to achieve this by restructuring their daily schedule, which the PHO had helped them to do.

4.20
Other interviewees said that general practices were at risk of being overtaken by health application services from other countries. In their view, if general practices did not change to meet modern requirements then people could use these applications to self-diagnose rather than consult a medical professional.

Enhancing access to and control of personal health information

4.21
Under the Health Information Privacy Code 1994, people are entitled to see their own health information. Patient portals substantially help with this. People can easily see their own health records, either in summary or in detail, on the patient portal. This makes patient portals better than paper records or electronic records that need to be printed.

4.22
Staff from the Office of the Privacy Commissioner pointed out that, in this respect, patient portals enhance privacy rights about access to information because people “can just sign in and see” their own information.

4.23
Staff from the Office of the Privacy Commissioner also noted that patient portals can help to improve the accuracy of health information. People can communicate directly with their doctor through the patient portals and ask to fix anything incorrect they see in their notes. People working in general practices told us that they find this particularly useful. People also feel more empowered because they are more involved in their own healthcare. As one doctor told us:

One lady picked up a trend in her blood tests because she mapped it out over time, whereas the blood test had looked normal individually but she had noticed a downward trend and contacted me to ask what was that about. I looked and realised she needed more investigation. So patients are more involved in their healthcare … and usually that’s a benefit for both physician and patient.

4.24
General practice staff also appreciated being able to send messages to people directly through a secure website rather than by email, which might not always be secure.

4.25
Patient portals also have an audit trail function that shows who accessed the system and when. This provides a level of protection that paper records do not have because it identifies anyone who may use health information for inappropriate purposes.

Encouraging further uptake of patient portals

4.26
Systematic monitoring of benefits would enable the Ministry to:

form a clearer picture of the benefits achieved;

understand patterns, problems, or barriers general practices or people experience when using the patient portals; and

make or support improvements so that patient portals can best contribute to the Ministry’s strategic outcomes.

4.27
The Ministry told us that it is not until at least 40% of people are using the patient portals that the real benefits can be measured, and it can take at least three years to get to this level of use. We acknowledge that, in the first few years of implementing patient portals, it would have been difficult to monitor and collect reliable information about how they were used because of the low uptake.

4.28
With the increase in uptake since June 2015, general practices and PHOs starting to collect data on the use of patient portals, and the promising signs we saw that benefits are being achieved, now is an opportune time for the Ministry to consider how it could systematically monitor the benefits achieved from using patient portals.

4.29
If the Ministry does this, it would enable it to use the information to:

identify and then address barriers to achieving desired benefits (including uptake and use);

understand the effect that patient portals are having on the achievement of benefits for people and general practices, and on strategic outcomes; and

highlight the benefits achieved so far to encourage the continued uptake and use of patient portals by others.

Recommendation

We recommend that the Ministry of Health collect statistical information on the benefits achieved from patient portals and use this information to encourage general practices to implement and use them.

4.30
After we had drafted our report, the Ministry told us that it has started work to collect statistical information to measure the benefits general practices are achieving from patient portals once they have sufficient numbers of patients using them. eHealth ambassadors, general practice managers, nurses, and PHO portal co-ordinators will work with Ministry staff on this. This group will also monitor use and continue to monitor uptake.

4.31
The Ministry intends to use this information to promote the increase of patient registration and use in general practices that already have patient portals. The Ministry will then focus on general practices that have not purchased a patient portal. The Ministry expects uptake to increase as more general practices see the benefits others are receiving.

Part 5 – Safe and secure access

5.1
In this Part, we discuss:

the requirements on PHOs and general practices to comply with the Privacy Act 1993 and the Health Information Privacy Code 1994 when implementing patient portals;

the Ministry’s advice to PHOs and general practices about the security of health information; and

balancing privacy of, and access to, personal health information.

Summary of our findings

5.2
The Ministry takes privacy and security seriously. Recognising that it is ultimately the role of PHOs and general practices to protect personal health information, the Ministry has supported PHOs and general practices to manage people’s personal health information effectively by contributing to an established framework of privacy rules and rights, standards, and guidelines.

Requiring compliance with the Privacy Act and the Privacy Code

5.3
We looked at how the Ministry was supporting PHOs and general practices to manage the security and privacy of people’s personal health information, but we did not directly audit the safety and security of patient portals.

5.4
The Privacy Act 1993 (the Act) covers the privacy and security of personal information. The Act sets expectations for how agencies collect, use, disclose, store, and give access to personal information.

5.5
The Act allows the Privacy Commissioner to issue codes of practice for specific sectors. For the health sector, the code of practice is the Health Information Privacy Code 1994 (the Privacy Code), which sets specific rules for all New Zealand health and disability service organisations. The Privacy Code has 12 rules for how health organisations should gather, use, store, release, and dispose of people’s personal health information.

5.6
The Ministry expects and supports PHOs to ensure that general practices are following the Privacy Code.

Privacy impact assessments

5.7
A privacy impact assessment is a tool that organisations can use to:

check whether a project (including a patient portal) is likely to comply with privacy laws;

make decisions about whether, and how, to adjust a project to manage any privacy risks; and

create a reference point for future action as the project or organisation changes (for example, when a general practice decides to increase the functionality of its patient portal).

5.8
For general practices implementing a patient portal, part of the assessment would include looking at the rules in the Privacy Code to determine whether anything needs to be done to meet each rule.

5.9
The College of GPs provided guidance to PHOs and general practices to help them complete privacy impact assessments for patient portals. Other guidance is available, including from the Office of the Privacy Commissioner. The Commissioner’s staff can also review draft assessments and provide assurance to PHOs and general practices that the assessments cover everything they need to. The Commissioner’s staff said that they do this fairly often.

5.10
The Ministry required PHOs that were receiving some funding to support implementing patient portals (see paragraph 3.13) to complete a privacy impact assessment. A Ministry representative said that some funding applications were sent back because of an inadequate privacy impact assessment. The Ministry expected PHOs, rather than the general practices, to do the assessments because PHOs tended to be better resourced. Having PHOs do the assessments would also avoid duplication.

5.11
The PHOs we spoke to confirmed that they did a privacy impact assessment for their general practices. One PHO prepared a template that other PHOs and general practices could use to complete a privacy impact assessment. The Office of the Privacy Commissioner supported the use of the template and a link to it is provided on the Ministry’s website.

5.12
The Privacy Commissioner’s staff told us that the health sector was generally very engaged with privacy issues, and that the health sector was keen to ensure that good practice was followed. Assessments can provide a layer of protection for general practices and PHOs in the event of a privacy breach because it would help show that they had taken reasonable steps to protect people’s privacy.⁷

The College of GPs’ Foundation standard

5.13
The College of GPs’ Foundation standard (the Foundation standard) is a quality standard for general practices, designed and run by the College of GPs. It represents the minimum “legal, professional and regulatory requirements that a general practice must meet as part of providing safe, effective and equitable care”.⁸

5.14
The Foundation standard requires general practices to meet the requirements of the Privacy Code. As part of achieving the standard, a general practice must:

have a privacy policy that complies with the Act and the Privacy Code;

train its team on the Act and the Privacy Code;

collect, use, store, disclose, and dispose of people’s health information in accordance with the Privacy Code; and

set up safeguards in the reception area to ensure confidentiality of people’s information.

5.15
From 1 July 2017, DHBs and PHOs were required by the Ministry to enter into service agreements. These agreements set out the roles, responsibilities, and accountabilities of DHBs, PHOs, and contracted providers to ensure that primary healthcare services are funded and delivered in each district or region in a collaborative and consistent way throughout the country. They also require PHOs to ensure that all of their general practices meet the Foundation standard.

Health Information Governance Guidelines

5.16
The Ministry has also designed guidelines on sharing health information called the Health Information Governance Guidelines. At the time of our audit, these guidelines were still in draft form. They are intended to ensure that organisations that hold personal health information meet their obligations under the Act and the Privacy Code. The draft guidelines provide policies and help for health organisations to manage and share personal health information while upholding people’s privacy rights.

5.17
The Health Information Governance Guidelines apply to all electronic health information systems and include a section on patient portals. This section specifies that a patient portal should:

meet the Health Information Security Framework standard (see paragraph 5.21);

be available to all eligible and registered people; and

have the capability for allowing people to:

view their medical records;

send and receive secure messages;

view the audit trail of people who have accessed their patient portal; and

give other people, such as family members, access to their patient portal.

5.18
Under the draft guidelines, health organisations should also:

train their staff on how to use patient portals;

have a policy on staff access to patient portals that complies with the Act and the Privacy Code;

ensure that people are aware of any sensitive reports or results before they are put on the patient portal; and

include plain language explanations in patient portals.

5.19
The draft guidelines are intended to be finalised as part of the implementation of the single electronic health record and other regional and national systems.

Advising on security issues

5.20
We expected the Ministry to provide advice on how to ensure the security of health information when using patient portals.

Health Information Security Framework

5.21
The Health Information Security Framework standard (the standard) provides the main advice from the Ministry on the confidentiality and security of health information. The standard sets out security management requirements for health provider organisations and governs the security of all health information.

5.22
The standard is designed to support health and disability sector organisations and practitioners holding personally identifiable health information to improve and manage the security of that information. According to the Privacy Commissioner, health organisations can use the standard to make sure that they and their information systems are complying with rule five of the Privacy Code. Rule five requires health agencies to ensure that they have reasonable safeguards in place to prevent loss, unauthorised access, misuse, or disclosure of health information.

5.23
Health organisations must comply with the standard’s risk management section (section 1.4). This requires health organisations to undertake at least three risk management activities so they can meet their responsibilities in managing and protecting health information. They are:

regularly undertaking or reviewing an existing health-information-related risk assessment, specifically covering:

the probability of the risk occurring;

the impact if the risk occurs; and

available risk mitigation actions and countermeasures;

preparing and applying policies and procedures to address each of the identified risks; and

regularly monitoring and reporting on the performance of the above policies and procedures.

5.24
The standard, an 82-page document, provides guidance, ideas, and comment to support these tasks. Patients First condensed the standard to 14 key points to help general practices assess whether they are meeting the IT security requirements. Patients First also created a checklist for a self-assessment and a guide with additional explanation and clarification.

5.25
Although the standard covers all health information, it was published in December 2015 and does not specifically mention patient portals. The draft Health Information Governance Guidelines makes it clear that patient portals are required to meet the standard.

5.26
The standard also includes a section on “cloud computing”, which patient portals often use to store information. Before 2016, the Ministry’s policy on cloud computing was that personal health information could not be stored or processed outside of New Zealand by a public cloud service without a Ministry-granted exemption. In early 2016, the Ministry allowed health organisations to use public cloud services without obtaining an exemption, provided the services had been approved by the Ministry as fit for purpose.

5.27
In July 2016, Cabinet actively promoted the use of public cloud services for government agencies. The Ministry worked with the Government Chief Information Officer to update its approach to the use of cloud-based services. In April 2017, they released a joint document advising of the changes. The Health Information Governance Guidelines reflect this change in policy. The guidelines state that health organisations can store personal health information in the cloud as long as they carry out a risk assessment before doing so and are satisfied with the resulting risk profile. The recommended tool for the assessment is the Government Chief Information Officer’s cloud assessment tool, which is mandatory for DHBs and government agencies.

Aiming for excellence

5.28
“Aiming for excellence” is the College of GPs’ quality standard for general practices, which is used in the Cornerstone accreditation programme. The Cornerstone accreditation programme sets out best practice criteria for general practices to achieve over and above the minimum requirements of the Foundation standard (see paragraph 5.13).

5.29
To qualify for Cornerstone accreditation, all general practices that offer a patient portal must meet the requirements of the Health Information Security Framework standard and the Foundation standard.

Balancing privacy, security, and access

5.30
Discussions of privacy and security often focus on keeping information safe and secure from people who should not have it. However, it is equally important that information can be accessed by the right people. For example, it is important that everyone treating a patient has access to all their relevant health information. One doctor pointed out to us that the risks of not sharing information can be greater than the risks of sharing it.

5.31
The need to get this balance right was a common theme in our interviews. Staff from the Office of the Privacy Commissioner did not express any major concerns about patient portals. As staff told us:

Privacy isn’t all about security and secrecy. It’s also about people’s control of their information … On the one hand, it’s access to patient information for clinical people, on the other hand it’s access to your own information. So you’ve got a right of access to your own information anyway, but if you can just sign in and see it, that’s a privacy enhancing process. And it also improves the accuracy of the information. So that’s the way [we’ve] approached [patient portals], it’s an enhancement of privacy.

5.32
In our view, the Ministry takes privacy and security seriously. PHOs and general practices are ultimately responsible for protecting the privacy and security of their patients’ personal health information. PHOs and general practices are required to comply with privacy laws, health information standards, and various guidelines designed to help them manage people’s personal health information effectively. The Ministry, along with others, has contributed to an established framework to support PHOs and general practices to do this job well.

7 Anyone who feels that their privacy has been breached can complain to the organisation concerned or the Privacy Commissioner.

8 See rnzcgp.org.nz.