Medical records are of vital importance both in the medical and legal spheres in South Africa. These records contain all vital information pertaining to a patient, their condition, diagnosis and treatment, either in or out of hospital. This information can be utilised by medical practitioners who have access to these records to make informed decisions regarding the patient and by legal practitioners in order to determine whether there was any negligence on the part of a medical practitioner.
While most view medical records as mere scribblings of a patient's sniffles, it cannot be emphasised enough just how important these records are. Having regard to their importance, it is difficult to understand why the legislature does not provide clear guidance in respect of the making and retaining of medical records.
What does the law say?
In South Africa, one would expect that all you need to know in respect of medical records should be contained in the National Health Act 61 of 2003 (NHA), however, this is not the case. Not only does the NHA not provide a definition for healthcare/medical record, but section 13 imposes a very vague obligation on persons in charge of healthcare establishments to keep records of patient healthcare and nothing further is prescribed. Healthcare legislation is severely lacking in the sense that the finer details of making, retaining and sharing of medical records has not been dealt with at all.
Are there any guidelines?
Establishing how medical records are currently dealt with can be done by examining various pieces of legislation. As stated above, the NHA does not provide much assistance regarding healthcare records but neither does the Health Professions Act 56 of 1974 (HPA) and the regulations thereto. While the purpose of the HPA is to establish the Health Professions Council of South Africa (HPCSA) and provide it with certain powers, including disciplinary powers, nothing further has been legislated regarding medical records.
The HPCSA therefore attempts to compensate for the lack of clarity regarding medical records by publishing booklets that include certain guidelines, ranging from guidelines on good practice to waste management and include guidelines on keeping of patient records. It is important to bear in mind that these guidelines have not been legislated and are merely a publication for medical practitioners. Although these booklets provide guidelines to medical practitioners, they also comprise the standards against which medical practitioners are judged when a complaint of unprofessional conduct is lodged against them. It would be in the medical practitioner's best interests if these guidelines were included by the legislature, even as regulations, so that when they are held to certain standards of practice, the standards are in place and applied consistently.
However, at this stage, the best explanation of what should be contained in and how a medical record should be retained can only be found in the HPCSA's Booklet 14: Guidelines on the Keeping of Patient Records. The booklet contains sections on the definition of a health record, what constitutes a health record, why documents or materials should be retained, etc. This booklet holds vital information that should regulate medical practitioners and therefore should be promulgated, although the provisions in the booklet could stand to be bolstered prior to promulgation.
Why are medical records to important?
What is of great importance to those who deal with claims in the legal sphere is both the retention of and accessibility to medical records. Medical records are the only objective evidence that we have to inform those involved what occurred at the time of the incident. Without medical records, the claim becomes a "he-said-she-said" debacle, where it is often unclear what the actual truth is and allegations are made without any supporting documentation.
However, this is not the only instance of litigation where these documents may be relevant. A claimant may require his or her records for a personal injury claim against a third party or for a claim against the Compensation for Occupational Injuries and Diseases Commission. Therefore it is of vital importance that these medical records be kept.
How long should medical records be kept?
But the question often asked by medical practitioners is "for what period of time should these records be kept?" This question is of obvious importance, especially in instances where an establishment holds a large number of patient records such as a public or private hospital. Unfortunately, there is no definite answer. However, various guides can be obtained from the reading of different sources. Booklet 14 from the HPCSA contains the most comprehensive answer. Paragraph 9 of the booklet states that the records should be stored in a safe place for no less than six years from when they became dormant.
There are, however, alternate circumstances such as where the patient is a minor or mentally disabled. With regard to minors, medical practitioners are advised to keep medical records up until the minor has turned 21. However, where a patient is mentally disabled, medical practitioners are advised to keep the patient's medical record for the duration of the patient's lifetime.
These alternative time periods are as a result of the Prescription Act 68 of 1969. Section 11 of the Prescription Act indicates that a debt against another person prescribes after a period of three years and section 12 specifies that prescription on a debt begins to run once the injured party becomes aware of the debt. However, this position is altered for minor children. Prescription against a debt owed to a minor will only begin to run when the minor has reached the age of majority. Therefore, when the minor turns 18 years old, prescription starts to run. The debt will then prescribe when the minor turns 21 years old.
Mentally disabled persons are subject to a different regime of prescription. Prescription only begins to run when a curator ad litem is appointed for the mentally disabled person, and will run for three years. Therefore, based on the Prescription Act, the HPCSA has provided medical practitioners with these guidelines in respect of retaining medical records.
No guidelines for medical institutions
It must, however, be borne in mind that the HPCSA's guidelines are applicable only to medical practitioners and not the medical establishments for which they practice. Section 13 of the NHA applies to medical establishments such as hospitals, but there is no further regulation or legislation determining the manner in which hospital records are to be kept and for what period of time.
This is of great concern considering that both medical practitioners and medical institutions are involved in litigation. Hospital files are of significant importance when litigation arises but are also vital to the continued treatment of a patient, should a patient not attend the same hospital the next time they are ill. Therefore, the boundaries should be drawn so that those responsible for keeping medical records in terms of section 13 of the NHA are given more definitive answers as to what they may and may not do regarding a patient's file, thereby protecting the patient and the institution.
Other legislation
Very few Acts exist that have an effect on the necessity to retain and store medical records, specifically the Occupational Health and Safety Act 85 of 1993 (OHSA). In terms of OHSA, a medical practitioner is required to keep a patient's records for 20 years after the patient's treatment in cases where it is suspected that patients may have been exposed to diseases that develop over time such as asbestosis.
However, there is another Act that is of significant importance when dealing with medical records and that is the Protection of Personal Information Act 4 of 2013 (POPI). While POPI is significant when having regard to medical records, it should be noted that POPI is not in full effect as yet, only certain sections of POPI have been promulgated. So it is anticipated that a promulgation date for the remainder POPI will be announced shortly, it is therefore not governing legislation as yet.
Section 1 of POPI comprehensively defines "personal information" and all information contained in a patient's medical record would constitute personal information. Therefore the manner in which medical records are dealt with is governed by POPI. Section 14 of POPI directs that because a medical record contains a patient's personal information, that medical record may not be retained any longer than the purpose that the information was initially collected requires, unless the medical practitioner is authorised or required to do so by law.
Therefore, as the only legislation that is in place that has a bearing on the retaining of medical records is OHSA, in terms of POPI, medical records can be retained for as long purpose for the creation of those medical records requires. As can be seen, there is very little guidance and direction provided in respect of the retaining of medical records as there are no specified timelines other than those suggested by the HPCSA in Booklet 14.
The concern at this stage is that the medical practitioners are uncertain as to how and for how long their records should be kept. This position could be altered in a relatively simple manner. POPI includes section 60, which section makes reference to codes of conduct. Section 60(3) states as follows:
“A code of conduct may apply in relation to any one or more of the following:
(a) Any specified information or class of information;
(b) any specified body or class of bodies;
(c) any specified activity or class of activities; or
(d) any specified industry, profession, or vocation or class of industries, professions, or vocations.”
Therefore the HPCSA, in respect of medical practitioners, could issue its own code of conduct, which would govern the manner in which medical records are kept and for how long. This will then, in terms of section 14 of POPI, govern the manner in which medical practitioners deal with medical records. Unfortunately, as there is no single regulating body for public and private hospitals in South Africa, the best alternative would be to promulgate an amendment to the National Health Act.
Access to medical records
Another aspect relating to medical records is a person's access to them. The purpose of medical records is not merely to record a patient's current treatment, but also to ensure that the patient receives continual treatment. In order to ensure this continual treatment is possible and used in the patient's best interests, a patient and their healthcare practitioner must have access to the records, regardless of the actual physical location of the file.
Furthermore, as has been established from Booklet 14, there are other purposes for which medical records are kept, such as to provide evidence during litigation. Here the focus is drawn specifically to medical malpractice claims against a practitioner as the plaintiff's medical records have to be disseminated among so many parties. For instance, the plaintiff and their legal representatives will require access to the medical practitioner's notes regarding the plaintiff diagnosis and treatment, the medical practitioner, his or her insurer and his or her legal representatives will require access to that practitioner's notes.
Often there is great difficulty in gaining access to a patient's notes, not only because there is only one physical file available, but also because physical files are often misplaced. In order to ensure that there is continuity of treatment regardless of which medical facility or practitioner a patient attends, and in order to safeguard the rights of patients and medical practitioners alike, a different approach has to be taken to the storage of and access to medical records.
Safeguarding of medical records
POPI provides for safeguards that must be established when processing and storing personal information. This can be seen from section 19 wherein it prescribes that the integrity and confidentiality of personal information must be secured by taking "appropriate, reasonable, technical and organisational measures" to prevent any unauthorised access to personal information or any loss or damage thereto.
For example, should a medical record be stored electronically, the relevant passwords, encryption and anti-virus software should be put in place to ensure that the patient's personal information is secured. Should the medical record be on paper as they currently are, they should be kept in an access controlled environment where they will not be exposed to certain elements that may cause damage.
While these safeguards are determinable, they have a wide scope for application. Therefore, as long as the medical establishment or medical practitioner ensures that all reasonable and technical measures have been enabled to ensure any loss or damage to the patient's personal information and to prevent the any unlawful access to the patient's personal information, after having assessed the risks surrounding the patient's personal information (which should be done regularly), this information can be stored in any manner that the a reasonable person, or in this instance, the reasonable medical practitioner, would deem fit.
At this point in our technological evolution it is both beneficial and necessary for the storing of a patient's medical records to be done electronically.
Electronic storage of medical records
The electronic storing of medical records has already been introduced in the United States of America. In fact, the USA has two versions of storing medical records electronically, Electronic Medical Records (EMR) and Electronic Health Records (EHR).
This shift from paper record would provide a number of benefits to all those parties involved in a patient's healthcare and matters that develop. These benefits include the legibility and accuracy with which we are able to read notes, both storage and accessibility of medical records will be more affordable, secure and less prone to human error, and the costs relating to paper files will significantly decrease.
Should this system be implemented, it would in all likelihood be required to begin in individual healthcare establishments, whereafter the systems would be able to be interlinked. If we examine the ideal situation, it would be where information would be shared between healthcare providers, irrespective of whether they fall within the public or private sector, thereby allowing the continuity of healthcare, subject to the patient's consent.
The documents as completed by medical practitioners could also be shared with their insurers and legal representatives, quickly and efficiently. This would prevent unnecessary delays and would enable these parties to have access to the whole file.
Lastly, the files would all remain intact. Test results, scans and medical notes would all be kept together in the same electronic file and there would be no risk of medical records being misplaced or portions of documents being misfiled.
How safe is it?
As with all developments based on technology, there is a concern relating to security. The concern relates to whether personal information as contained in medical records, if stored electronically, could be accessed by an unauthorised third party. This is a legitimate concern based on the content of these records. But this could prevented by technology experts who would assess the risk and be able to create the correct security measures in order to take all reasonable precautions to prevent a breach from occurring.
There are numerous questions that would need to be answered before the implementation of a sophisticated system such as this: what format would the software take, would it be better to have this system based on a programme or an application, where would the information be stored in the cloud or on a central database, would it be backed up and to where. These questions would have to be answered by IT experts.
The way forward
The progress required in the medical sphere regarding medical records is obvious. Not only do we require further clarity to be provided by those responsible for governing the various areas of the medical field in relation to the recording and storing of medical records, but the evolution of medical records from paper to electronic is also becoming a greater necessity. To begin recording information and storing it in an electronic format may seem like a problematic and daunting task.
However, based on patient rights, advancements in technology and the need for efficiency in the medical and legal practices, now may be the time that we need to act. Technology may be a difficult and frightening concept to attorneys and law makers, the first step needs to be taken in order to revolutionise our healthcare system and its record keeping.
If the legislature works in harmony with the technological options available to them, it would be to the benefit of all key players in the arena, including the patients themselves. Perhaps it is not viable to introduce at this very moment, but the process certainly has to begin somewhere, and what better time than now.
