securing distributed partial medical records?

[signup at bealoid.co.uk]

Before this develops into a three hundred post thread about CfH: I  
don't like current medical IT systems and I strongly believe there is  
a need for better records sharing, but I don't think CfH is anywhere  
near getting it right.

Quoting Adrian Midgley <amidgley at gmail.com>:

> signup at bealoid.co.uk wrote:
>> i) Each person in the chain may well think "this isn't so bad, it's not
>> everything, it's just an xray, it's not all the history"
>
> There would be considerably more people in the chain, and the audit
> trails in more places.

There aren't that many people in the chain at the moment, and the  
quality of understanding of patient confidentiality is variable.   
Having a bunch of different systems means that 'information sharing  
agreements' are tricky to implement, and poorly trained busy frontline  
staff make mistakes.

To make it clear: I'm not talking about 'legitimate' enquiries (people  
either obey the rules, and there's discussion about whether the rules  
are strong enough, or they break the rules, and there's discussions  
about whether the penalties are severe enough) but about 'out of  
process' enquiries.

>> ii) It would tend not to be "xrays on the xray server" but everything
>> from Thistown Hospital on Thistown servers, and everything on Thatplace
>> hospital on Thatplace servers.  Lab results, xrays, MRIs, etc etc get
>> split up by hospital, not type of service.
>
> Actually, they get split up by type of service.

Please could you clarify this?  And explain why it feels as though one  
hospital has little access to records of stuff done in another  
hospital?  (Electronic stuff like Xrays are different, that seems easy  
to transfer, but why are surgery notes from (eg) Cheltenham not  
available to Bristol Frenchay when Cheltenham refer me there?  I'm  
often left giving a garbled account of what some surgeon did (I don't  
know - I was unconcious, I didn't talk to them afterwards, it involves  
a bunch of technical terms I can't remember properly, and the pain  
killers will also give me amnesia)

[snip]
> enabling a small number of existing systems to be questioned by a
> small number of existing systems over a network.

This would be a better way to do things.  Who's going to tell the GPs  
in a PCT/RHA/SHA that they all have to standardise on one system?

[snip]

>> But that isn't what happens now - the GPs employ practice managers and
>> outsource the computer stuff.
>
> TO not very many firms, which have considerable G influence in them.

>>  And the GPs who you want to
>> be in charge sometimes have nothing (absolutely nothing) to do with
>> confidentiality.
>
> Yes we do.

I'd be interested to see how many Caldicott Guardians are GPs vs  
Practice Managers.