OBJECTIVES
This paper aims at identifying the data protection and security requirements for a cross-institutional EPR. Three possible models and the first steps towards a cross-institutional EPR for the Thoraxklinik Heidelberg and the Department of Clinical Radiology of the University Medical Center of Heidelberg shall be discussed.
METHODS
A comprehensive analysis of literature and legal documents supplied information for determining the data protection and security requirements. By means of information system analysis, the technical preconditions in both institutions as well as three possible models towards a cross-institutional EPR were identified.
RESULTS
According to the German penal code it is only allowed to reveal patient information to external physicians in cases of so-called "treatment connection". An extension of the written consent, signed by the patient, verifying the patient agreement that his/her patient data will be stored in a cross-institutional EPR is needed. Among the three models that we identified, the model that constitutes of a virtual EPR with distributed data capture in both institutions was favored. By means of SecuRemote software a secure connection between the Thoraxklinik Heidelberg and the Department of Clinical Radiology was established, allowing the physicians to view the complete cross-institutional health information of a jointly treated patient during the weekly consultation on radiotherapy.
CONCLUSIONS
Many requirements listed in this paper are requirements for electronic patient records in general. Besides these general requirements there are specific requirements for a cross-institutional EPR. The legal situation in Germany complicates the development and implementation of a cross-institutional EPR. However, we think that the efforts are reasonable, because a cross-institutional EPR will be able to improve the communication between health institutions, medical disciplines and persons involved in shared care processes. It provides them with more complete health information about the jointly treated patients. A cross-institutional EPR is, therefore, expected to improve the quality of patient care.