*Professional Psychology: Research & Practice" has scheduled an article for publication in a future issue of the journal: "Record Keeping in the Cloud: Ethical Considerations."The authors are Robert L. Devereaux and Michael C. Gottlieb.
Here's an excerpt: "In this article, we briefly review technological advances in electronic storage, define "the cloud" and explain how it functions, discuss risks and benefits of its use, and provide questions for practitioners when considering the appropriateness of maintaining patient records in this manner."
Here's another excerpt: "Consider the following example. A practitioner, using an online patient management system, decides to change service providers for any number of reasons (e.g., cost, poor service). The stored patient data may be contained within a proprietary system that cannot be easily migrated to a new system/provider. As mentioned previously, online service providers each have a unique system and moving from one to another might require unknown amounts of time, resources, and temporary loss of access to patient records during the move. In addition to the possible frustration of a transition process, it would be important for the practitioner to understand how data are deleted from the old system. For example, Facebook, a cloud-based social profile software system, maintains user accounts even after they are inactivated at the user's request. Permanently deleting the account is much more involved, and there is no way of knowing if Facebook maintains historical records of old accounts, although this may be discussed in their Terms and Conditions of Use Agreement. This could also be the case for other online storage or electronic medical record companies, and practitioners are well advised to investigate this matter before agreeing to store records on the cloud. Also, a practitioner would need to decide how much information to disclose to clients as part of a continued informed consent process if/when he or she decides to move records from one company to another. Such disclosure would need to be consistent with the level of detail about record keeping provided to the client at the onset of treatment."
Here's how the article concludes: "With the broad spectrum of electronic storage and management options available to practitioners, the abdication of control to a third-party, cloud-based company may represent unnecessary additional risk at this relatively early stage. In part, aggregation of documents from users worldwide may create a much more appealng target for malicious hackers than a single office with only a few patient documents. Also, the question of liability has not yet been clearly defined. We are responsible for protecting patient information, but computing companies carry no such obligation beyond their own internal policies and contractual obligations. We recommend that practitioners who move their EHR to the cloud do so with caution and careful consideration of the accompanying risks and benefits."
The author note provides the following contact information for reprint requests, questions, or comments: Robert
L. Devereaux, Division of Psychology, Department of Psychiatry, University of Texas Southwestern Medical Center, Dallas, TX 75390-9044; E-mail: robert.devereaux@
Thanks to Ken Pope for this information.
