Electronic Medical Records andElectronic Health Records: Overviewfor Nurse PractitionersPatricia C. McMullen, PhD, JD, William O. Howie, DNP, CRNA,Nayna Philipsen, JD, PhD, Virletta C. Bryant, PhD, LICSW,Patricia D. Setlow, DNP, FNP-BC, Mona Calhoun, MS, MEd, andZakevia D. Green, PhD, MSHA

The Jo660

ABSTRACTElectronic medical records (EMRs) and electronic health records (EHRs) havebecome essential systems by which nurse practitioners (NPs) communicate vitalpatient information to other members of the health care team as well as to patients. Inthis article we examine the important distinctions between EMRs and EHRs; reviewthe genesis of these types of records; summarize applicable provisions of the HealthInsurance Portability and Accountability Act from a recent legal case centered aroundNP utilization of EMRs and EHRs; address open patient access to medicalinformation; and examine threats to security. Suggestions are offered on ways in whichNPs can safeguard confidential patient information.

Keywords: Affordable Care Act, electronic health records, electronic medical records,Health Information Technology for Economic and Clinical Health, HIPAA� 2014 Elsevier, Inc. All rights reserved.

lectronic medical records (EMRs) and elec-tronic health records (EHRs) have become

Eessential systems by which nurse practitioners

(NPs) communicate vital patient information to othermembers of the health care team as well as to patients.In this article we discuss important distinctions be-tween EMRs and EHRs and review the genesis ofthese types of records. Important HIPAA provisions,a selected legal case, open patient access to medicalinformation, and threats to security are considered.Recommendations are offered on ways in which NPscan safeguard confidential patient information.

OVERVIEWHistorically, EMRs were the first electronic sourcesused to digitize patient information.1 EMRs grewin popularity because of the added benefits theyhave available that are not present in paper charts,including the ability to easily collate and track sets

urnal for Nurse Practitioners - JNP

of information, monitor changes in patient outcomesafter implementation of a new practice or procedure,and determine which patients are due for physicalexams, procedures, immunizations, and the like.Unfortunately, EMRs are often practice-specific,making it difficult to transfer information to outsidegroups of providers, to other health care systems,and to patients.1 Because of such limitations, overtime, EHRs were developed and gained popularity.

EHRs are able to accommodate all of the func-tions of the EMR and have important added elements.EHRs are specifically designed for information sharing,not only among various types of providers who may belocated in a number of settings (primary care, in-patient,emergency department, abroad), but between providersand patients. In a true EHR system, patients can logonto their own records, read and track test results,communicate with providers, and implementchanges that ultimately improve their health.1

Volume 10, Issue 9, October 2014

EMRs AND EHRs: BENEFITS AND CAUTIONSBenefitsNPs have long partnered with patients in activitiesdesigned to improve care and in efforts to havepatients adopt healthier lifestyles. An EHR canstrengthen such a partnership. According toMenachemi and Collum,2 the advantages of theEHR can be grouped into 3 outcome categories:clinical; organizational; and social benefits.

Clinical outcomes focus on the concept of qualityin relation to direct patient-care services and treat-ments. Studies have verified that EHRs can increasethe quality of patient-care services and treatments byserving as a platform for readily available access tocomplete and accurate patient information. Suchinformation can be used to support health careproviders in the planning, delivery, and monitoringof patient responses to the services and treatmentsprovided.2 For example, in 1999, the Institute ofMedicine released To Err is Human, a report thatpresented research findings showing a startling rate ofmedical errors in United States health care facilities.Communication of important health information,such as current medication use, allergies, healthhistory, and other data, were a prime cause of adversepatient events. EHRs are a valuable tool in reducingsuch occurrences because they facilitate transfer ofimportant patient information.3

Organizational entities within a health care facil-ity, such as health information management, casemanagement, and health care management, are EHRbeneficiaries as well. Utilization of EHRs typicallyincreases medical billing and coding accuracy,improves rates of reimbursement from third-partypayers, increases job productivity and satisfactionamong direct and indirect users of the EHR, andresults in a decline in medical errors.2 EHRs not onlyimprove the quality of care, but such systems can alsoreduce health care costs by improving outcomes,resulting in better management of chronic illnesses,and eliminate the duplication of services.2

EHRs facilitate research by collecting data thatcan then be collated into larger data sets, leadingto more powerful quantitative research studies,the findings of which are more generalizable toother patient situations. Additionally, studies have

www.npjournal.org

demonstrated that adoption of EHRs improvesprovider satisfaction, likely due to such factors asease of access to information, faster charting times(once the system has been mastered), and retrievalof information from multiple sources.2

EHRs not only affect providers and health careagencies, but they enhance the patients’ ability tofollow their own medical plans and insure thatthe information is available to those designated bythe patient, whether it be a “significant-other” or ahealth care provider. EHRs also facilitate a patient’sability to review and re-review information con-tained in the record, to absorb medical informationat their own pace, to question what is not under-standable, to provide additional information thathas not been solicited, and to report additionalinformation concerning activities that lead to ahealthier lifestyle, such as joining a health club,receipt of acupuncture, or new membership in aweight-management plan.4 A recent study wasconducted by Reed and colleagues to determinewhether utilization of an EHR system couldpositively impact health outcomes among over169,000 patients with diabetes. Study participantswho had access to their health care informationdemonstrated significant improvements in theirhemoglobin A1C values, lipid levels, and frequencyof monitoring, particularly among those whosediabetes was not previously well controlled.5

CautionsAlthough there are many benefits associated withthe use of EMRs and EHRs, some concerns remain.Overall, one of the greatest disadvantages of EHRsis the difficulty in maintaining privacy and addressingsecurity risks. More specifically, viable EHR systemsmust constantly work to prevent unauthorizedpatient information access that may originate frominternal and external pathways. Internal threats toprivate patient information may result from suchthings as poor password management, disgruntledand disloyal employees, and transparent physicalsecurity measures. External threats include unau-thorized access to protected health information byhackers and theft of electronic devices containinghealth information.6

The Journal for Nurse Practitioners - JNP 661

In response to concerns raised about the privacy ofpatient health care records, the US Congress hasenacted 3 important pieces of legislation: the HealthInsurance Portability and Accountability Act of 1996(HIPAA)7; the Health Information Technology forEconomic and Clinical Health Act8; and the PatientProtection and Affordable Care Act of 2010(PPACA).9 This legislation was founded on theprinciple that individually identifiable healthinformation requires some degree of protection;HIPAA “requires that all patients be able to accesstheir own medical records, correct errors oromissions, and be informed how personalinformation is shared and used. Other provisionsinvolve notification of privacy procedures to thepatient.”10 Five sets of rules (security rule,transactions rule, identifiers rule, privacy rule,enforcement rule) determine what types ofinformation is subject to HIPAA, who may accessprotected health information, and enforcementmeasures.11

The Health Information Technology for Eco-nomic and Clinical Health Act, enacted as part ofthe American Recovery and Reinvestment Act of2009, was designed to promote the adoption andmeaningful use of health information technology.Incentive payments are paid to eligible professionals,hospitals, and critical access hospitals participating inMedicare and Medicaid programs that adopt andsuccessfully demonstrate meaningful use of certifiedEHR technology.12

The PPACA strengthened HIPAA privacy pro-tections and added mandates and incentives forEHRs. It requires health plans to adopt and imple-ment secure, confidential EHRs to standardizebilling, and to reduce paperwork, administrativecosts, and medical errors. It also called for a federalhealth program to collect and report data to helpidentify health care disparities so the quality of careand patient outcomes could be improved.13 ThePPACA further provided financial incentives toeligible practitioners (EPs) to address the costbarrier to purchasing and implementing an EHRsystem in their practice. NPs are EPs under theMedicaid program.14

Other concerns have been raised about the useof EHRs. They are not the answer for every patient

The Journal for Nurse Practitioners - JNP662

population, because utilization of computerizedpatient systems may negatively impact thoseunderserved patients who do not have access to acomputer or those with insufficient knowledge onhow to use a computer. In these instances, it hasbeen suggested that a provider should make patientmedical notes, lab reports, and procedural andhospitalization summaries available in paper formatto address such barriers.6 Other disadvantagesassociated with implementation of EHRs includecost, design limitations, training, resistance, and fearof failure.6

Given the ubiquitous nature of EMRs and EHRsin the US health care system, NPs and other pro-viders have questioned whether their legal exposurehas increased as a consequence of the adoption ofelectronic records. Fortunately, research by Victoroffand colleagues in Colorado indicates that lawsuitshave not increased.15 More specifically, 894primary-care physicians insured through the COPICInsurance Company completed a survey on EHRuse. There were no significant differences in therates of liability claims between EHR and non-EHRusers, nor was there a change in liability claimsrates after adoption of EHRs. The research teamconcluded that additional research on EHR useacross larger groups of physicians and other providersis needed.15

In the present study we performed a Lexis searchcontaining the terms nurse practitioner, electronic medicalrecord, electronic health record, and negligence or malprac-tice. Over 70 cases were retrieved and most indicatedthat EMRs and EHRs are used in ways that aresimilar to paper records—to determine whetheror not the NP gave care that complied withreasonable standards of practice. The followingsection summarizes one such case.

EHRs AND NPs: CASE EXAMPLEAs most NPs will recall, the majority of cases filedagainst NPs are based on malpractice. Malpracticeis classified as a tort, or a civil wrong. To prevail ina malpractice case, an injured patient or his/herrepresentative (the plaintiff) must establish the pres-ence of 4 elements: duty; breach of duty; causation;and damages. Duty is a legal relationship between theplaintiff and the NP, who is usually a defendant in the

Volume 10, Issue 9, October 2014

malpractice case. Breach of duty considers whetherthe NP complied with reasonable standards of careunder a given set of circumstances. Evidence,including information in an EMR or EHR, is usedto determine whether the care the NP gave wasreasonable, thereby complying with reasonable stan-dards of care. Other types of evidence, such as expertopinion, scholarly publications, and the like, may alsobe employed to determine if the NP’s care compliedwith accepted standards of care. The causationelement refers to whether the actions or inactionof the NP led to the injury of the patient as wellas whether the injury was reasonably foreseeable.Finally, the damages element considers whether thepatient suffered some type of compensable harmbecause of the NP’s breach of the standards ofreasonable care.16

The case of Joey Wright ex rel. K.B. v United Statesof America17 provides a useful example of how anEMR was used to determine whether an NP andother providers should be liable for malpractice.K.B. was born at the Choctaw Nation HealthCenter on December 28, 2008 with undiagnosedhydrocephalus. Over the course of 20 monthsfollowing her birth, K.B. was seen on 27 occasions by8 different health care providers, both for well-childcare and for a variety of complaints, includingfrequent vomiting, nasal congestion, bronchiolitis,gastroesophageal reflux disease, fifth’s disease, anupper respiratory infection, and in turning of herright foot. During most of these visits, her headcircumference was written, but not plotted on theelectronic height/weight/head circumference chart.After discontinuing treatment at the Choctaw NationHealth Center, she was evaluated by 2 other pro-viders before her hydrocephalus was diagnosed. K.B.subsequently underwent a successful shunt placementand at the time of trial she was exhibiting normalgrowth and development. K.B.’s EMR was intro-duced into evidence, and it was noted that theheight/weight/head circumference chart had notbeen completed. When her head circumferencemeasurements were plotted, it was apparent that herhead circumference had grown disproportionately.The court found that failure to recognize thisdisparity was a breach of the standard of care.However, the case was dismissed because the plaintiff

www.npjournal.org

failed to establish that K.B. suffered permanentdamage as a consequence of this breach.17

RECOMMENDATIONSCurrent trends and laws support the predictionthat the availability and everyday use of EHRs andEMRs will increase significantly over the next10 years.18 It will become increasingly important thatNPs and other health care providers consider thefollowing recommendations when delivering patientcare that is supported by computerized healthinformation systems:

1. Patient information that is of a sensitive natureshould never be transferred by e-mail or text,unless it can be guaranteed that the intendedreceiver is the only one with access to theaccount.19

2. Before disclosing patient information of anykind where the recipient’s identity cannot beguaranteed, use predetermined passwords oridentifiers.19

3. Get informed consent to use patient data foraudit and management purposes.19

4. Use an “opt-in system” rather than an “opt-out system” and get informed consent frompatients to convert their paper records intodigital files.19 This system should include theimpact on payment, where EHRs are requiredfor third-party payment.

5. Inform patients of the level of risk involved inusing EHRs and that their privacy cannot beguaranteed.20

6. Provide mandatory ongoing professionaldevelopment for all health care workers onmaintaining patient privacy in an electronicenvironment.21

7. Follow-up with the reporting agency in theevent any information is deemed incomplete orin error.19

8. Ask questions and verify the accuracy of anyinformation that can identify individualpatients, including the 18 personal identifiers inHIPPA’s Privacy Rules, unless it is mandated.19

9. Avoid transmitting any information that canidentify individual patients, including the 18personal identifiers in HIPAA’s Privacy Rules,unless it is required.22

The Journal for Nurse Practitioners - JNP 663

RECOMMENDATIONS TO PATIENTS TO DECREASEPRIVACY CONCERNS

1. Inquire about whether your practice uses anEHRand, if so,whether theEHRis coveredby ahealth care provider or health plan that is boundby HIPAA. Reassure the patient that their per-sonal information will be carefully guarded.20

2. Federal and state laws are in place to safeguardpatient privacy, but patient confidentialitycannot be completely guaranteed when EHRsare used. Reassure all patients that providersmust strictly adhere to current HIPPA SecurityRules to help safeguard all electronic healthinformation.19,23

3. Encourage all patients to express any concernsthey have regarding the protection of theirpersonal information.

POLICY RECOMMENDATIONS1. Expand the authority and resources of the

Office of Civil Rights to manage HIPAAinfractions and penalize the offending healthcare entities who violate HIPPA.21

2. Patients should be able to continue to maintaintheir ability to limit medical disclosures. How-ever, health care providers should have elec-tronic alerts that inform them that the patienthas elected to withhold information that couldpotentially impact the patient’s care.24

3. In emergency situations, if the patient is unableor unwilling to provide sensitive information,an EHR should have a 1-time access featurebuilt in to allow the provider access to thecomplete record, which will no longer beavailable after the emergency is resolved.24

CONCLUSIONAvailable literature indicates that EMR systems havethe potential to improve the quality of care deliveredto patients in a given health care system. Contem-porary research indicates that the utilization of EMRsand EHRs will lead to improvements in the healthcare organization’s patient workflow efficiency,provider satisfaction, comprehensiveness of care, aswell as the overall quality of care provided.25-27

Studies focusing on the content of EHRs areneeded, particularly in the areas of NP practice and

The Journal for Nurse Practitioners - JNP664

patient self-documentation. One future researcharea is to compare the documentation of differenthealth care professionals in terms of core infor-mation solicited by research or public healthauthorities. A challenge for both communicationamong caregivers in the same city and for healthrecord projects worldwide is to take into accountall the different types of EHRs and the needsand requirements of different health care pro-fessionals and consumers during the developmentof EHRs to encourage optimal interoperability.A further challenge is the use of internationalterminologies to achieve semantic interoperabilityso that EMRs and EHR information can be uti-lized regardless of where critical health informationin needed.

References

1. Garrett D, Seidman J. EMR vs HER—what is the difference? Office of the

National Coordinator for Health Information Technology (ONC). http://www.

healthit.gov/buzz-blog/electronic-health-and-medical-records/emr-vs-ehr-

difference. Updated January 4, 2011. Accessed May 12, 2014.

2. Menachemi N, Collum TH. Benefits and drawbacks of electronic health record

systems. Risk Manag Healthc Policy. 2011;4:47-55.

3. Institute of Medicine. To Err is Human. Washington, DC: National Academy

Press; 1999. http://www.iom.edu/w/media/Files/Report%20Files/1999/To-

Err-is-Human/ To%20Err%20is%20Human%201999%20%20report%20brief.

pdf. Accessed August 1, 2014.

4. Institute of Medicine. Key Capabilities of an Electronic Health Record System:

Letter Report. Washington, DC: National Academy Press; 2003. http://www.

iom.edu/Reports/2003/Key-Capabilities-of-an-Electronic-Health-Record-

System.aspx. Accessed August 1, 2014.

5. Reed M, Huang J, Graetz I, et al. Outpatient electronic health records and the

clinical care and outcomes of patients with diabetes mellitus. Ann Intern Med.

2012;157(7):482-489.

6. Amatayabul MK. Electronic Health Records: A Practical Guide for Professionals

& Organizations. 5th ed. Chicago, IL: American Health Information Association;

2011.

7. Public Law 104-191. The Health Insurance Portability and Accountability Act

of 1996. August 21, 1996. http://aspe.hhs.gov/admnsimp/pl104191.htm.

Accessed August 1, 2014.

8. Public Law 111-5. The Health Information for Economic and Clinical Health

(HITECH) Act. February 17, 2009. http://www.hhs.gov/ocr/privacy/hipaa/

understanding/coveredentities/hitechact.pdf. Accessed August 1, 2014.

9. Public Law 111-141. The Patient Protection and Affordable Care Act. March 23,

2010. http://www.gpo.gov/fdsys/pkg/PLAW-111publ148/pdf/PLAW-

111publ148.pdf. Accessed August 1, 2014.

10. HIPAA101.com. HIPAA 101 Guide to Compliance Rules and Laws. http://www.

hipaa-101.com. Accessed August 1, 2014.

11. Office for Civil Rights. The HIPAA Privacy Rule and Electronic Health

Information Exchange in a Networked Environment. http://www.hhs.gov/ocr/

privacy/hipaa/understanding/special/healthit/safeguards.pdf. Accessed

August 1, 2014.

12. U.S. Department of Health and Human Services, Centers for Medicare &

Medicaid Services, Medicare and Medicaid Programs. Electronic Health

Record Incentive Program. http://www.dhcs.ca.gov/Documents/OHIT/EHR%

20FINAL%20RULE.pdf. Accessed August 1, 2014.

13. U.S. Department of Health and Human Services. Key Features of the

Affordable Care Act by Year. http://www.hhs.gov/healthcare/facts/timeline/

timeline-text.html. Accessed August 1, 2014.

14. U.S. Department of Health and Human Services, Centers for Medicare &

Medicaid Services. Regulations and Guidance: Eligibility. http://www.cms.

gov/Medicare/Quality-Initiatives-Patient-Assessment-Instruments/pqrs/index.

html. Accessed August 1, 2014.

15. Victoroff MS, Drury BM, Campagna EJ, Morrato EH. Impact of electronic

health records on malpractice claims in a sample of physician offices in

Colorado: a retrospective cohort study. J Gen Intern Med. 2012;28(5):637-644.

Volume 10, Issue 9, October 2014

16. Schwartz VE, Prosser WL, Kelly K, et al. Prosser, Wade and Schwartz’s Torts,

Cases and Materials. 12th ed. St. Paul, MN: Foundation Press; 2010.

17. Joey Wright, as next of kin for K.B., a minor, Plaintiff, v United States of

America, Defendant. Case No. 12-CIV-320-RAW. 2014 U.S. Dist. Lexis 44523

(U.S. Dist. Ct. Ed. OK, 31 March 2014).

18. Lobach DF, Detmer DE. Research challenges for electronic health records. Am

J Prev Med. 2007;32(5 Suppl):S104-S111.

19. Lowth M. Confidentiality in the modern NHS: Part 2. Practice Nurse.

2013;43(11):49-52.

20. National Health Service of Great Britain. Confidentiality: NHS Code of Practice.

http://www.connectingforhealth.nhs.uk/systemsandservices/infogov/codes/

confcode.pdf. Accessed August 1, 2014.

21. Jacques LB. Electronic health records and respect for patient privacy: a

prescription for compatibility. Vanderbilt J Entertainment Technol Law.

2011;13(2):441-462.

22. U.S. Department of Health and Human Services. Office of Civil Rights.

Guidance Regarding Methods for the De-identification of Personal Health

Information in Accordance with the Health Insurance Portability and

Accountability Act (HIPAA) Privacy Rule. http://www.hhs.gov/ocr/privacy/

hipaa/understanding/coveredentities/De-identification/guidance.html.

Accessed August 1, 2014.

23. Polito J. Ethical considerations in internet use of electronic protected health

information. Neurodiagnostic J. 2012;52(1):34-41.

24. Grady A. Electronic health records: how the United States can learn

from the French dossier medical personnel. Wisc Int Law J. 2012;30(2):

374-400.

25. Wang SJ, Middleton B, Prosser LA, et al. A cost-benefit analysis of electronic

medical records in primary care. Am J Med. 2003;114(5):397-403.

26. Shepard J. Using electronic medical records to increase the efficiency

of catheter-associated urinary tract infection surveillance for National

Health and Safety Network reporting. Am J Infection Control.

2014;42(3):e33-e36.

27. ZhengNT, Rokoske FS, KirkMA, Lyda-McDonald B, BernardSL. Hospices’ use of

electronic medical refords for quality assessment performance improvement

programs [published online ahead of print March 15, 2014]. J Pain Symptom

Manage. http://dx.doi.org/10.1016/j.jpainsymman.2013.11.010.

www.npjournal.org

Patricia C. McMullen, PhD, JD, CRNP, FAANP, is deanand ordinary professor at the Catholic University of America inWashington, DC. William O. Howie, DNP, CRNA, is anurse anesthetist at the R. Adams Cowley Shock Trauma Centerin Baltimore, MD, and can be reached at bhowie@anes.ummm.edu. The remaining authors are employed at CoppinState University in Baltimore, MD. Nayna Philipsen, JD,PhD, RN, LCCE, FACCE, is a professor at the Helene FuldSchool of Nursing; Virletta C. Bryant, PhD, LICSW, is anassistant professor of social work at the College of ProfessionalStudies; Patricia D. Setlow, DNP, FNP-BC, is an assistant ofprofessor at the Helene Fuld School of Nursing; Mona Calhoun,MS, MEd, RHIA, FAHIMA, is chairperson of the HealthInformation Management Program; and Zakevia D. Green,PhD, MSHA, LHRM, RHIA, is an assistant professor at theCollege of Health Professions School of Allied Health and HealthInformation Management. In compliance with the national ethicalguidelines, the authors report no relationships with business orindustry that would pose a conflict of interest.

1555-4155/14/$ see front matter

© 2014 Elsevier, Inc. All rights reserved.

http://dx.doi.org/10.1016/j.nurpra.2014.07.013

The Journal for Nurse Practitioners - JNP 665