Patients ’ Access to Medical Records : Is It a Privilege or a Substantive Right ?

The common law on Patient’s access to medical records in Ghana was articulated in a High Court case: Vaah vs. Lister, 2010. The case established that patient’s right to medical records was protected by the constitution like the right to informed consent, equity and social justice. It was therefore part of the fundamental human rights and freedoms. We disagree with the position of the court. We investigated whether the constitution guarantees patient’s access to medical records and whether the right of access to medical records is a fundamental human right? What is the responsibility of the patients to the hospitals or physicians who maintain and protect the records? In the more recent Data Protection Act of 2012, access to personal data appears as a privilege and therefore not the same as the substantive right of privacy. This investigative study consisted of literature and documentary review of cases, the 1992 Constitution, selected medico-legal writings from Ghana and other Common-law jurisdictions on production of patient records. An electronic Internet search was conducted with carefully designed phrases like, “patient medical records”, “patient access to medical records”, and “hospital’s refusal to release medical records” and the result analyzed. The study revealed there was no substantive right of access to medical records. Issues of equity imbedded in the Physician-Patient relationship are skewed in favor of the patient. The lack of national legislation on Health Records complicates matters. Depending on the jurisdiction, patient’s access to medical records may be characterized as substantive right or a privilege. This is often supported by statute law. The interpretation of case law should take into consideration the relative and competing rights of the patient and the physician in terms of patients’ access to medical records since both contributed to the creation of that record. The national law on Health Information should be developed to assign roles and responsibilities to both the patient and the hospital/physician. Care needs to be paid to what exactly the (Constitution of Ghana, 1992) Corresponding author.


Introduction
Until 2012 when the Data Protection Act, (Act 843) was promulgated, Ghana had no statute or an act of parliament on patients' right of access to medical records.The Data Protection Act relates to Article 18 of the (Constitution of Ghana, 1992), which has been promoted as a convenient substitute for the right to privacy.Yet Article 18 simply provides the substantive right of freedom from unreasonable search and seizure and not the specific right to privacy per se thus: 1) Every person has the right to own property either alone or in association with others.
2) No person shall be subjected to interference with the privacy of his home, property, correspondence or communication except in accordance with law and as may be necessary in a free and democratic society for public safety or the economic well-being of the country, for the protection of health or morals, for the prevention of disorder or crime or for the protection of the rights or freedoms of others.
Does the above quoted article of the 1992 Constitution offer the right to privacy as a substantive right?We think not.What appears to be the fair reading of the above about the right from unreasonable search and seizure by law enforcement?This is particularly so in trying to prove that a crime has been or would soon be perpetrated by the owner of the home, property or correspondence.The right to privacy is present in the penumbras and emanations of other substantive constitutional grants but does not exist alone by itself without a specific legislation (Roe vs. Wade, 410 U. S. 113 (1973).
Moving on, the precedential case in Ghana on the production of medical records is (Elizabeth Vaah vs. Lister Hospital and Fertility Centre, 2010) Lister Hospital and Fertility Centre.It is a High Court case, which contains important judge-made-law on patient's access to medical records.Judge-made law is used to refer to cases where the judge goes beyond existing law and makes new law, which in this case made sense since there was no legislation on the capture, storage and treatment of patient health records.The facts of the case were that: On or about 23-01-2010, Elizabeth Vaah who was an expectant mother began receiving antenatal services from Lister Hospital (LH) with a view to delivery at LH. On 08-03-2010 at about 10 p.m., her membranes ruptured and she was rushed to Lister.The next day, Tuesday, 09-03-2010 at about 3:30 p.m., she gave birth to a fresh still-birth baby.A post mortem examination revealed that her baby died of "multiple organ hemorrhages most probably due to bleeding diathesis/coagulation defect with bleeding precipitated by 'trauma' of labor (child birth)."From the post-mortem report, the pathologist is not completely sure what caused the multiple organ hemorrhages.Vaah wished to have access to her medical records so as to have complete information on her health to give to a future doctor, in case of another pregnancy.Lister agreed that although ordinarily, Lister would have given Vaah her records, Lister would refuse on the grounds that Vaah had spoken to the media about the nature of her treatment at Lister.Lister said it would give the records if the Ghana and Dental Council were to direct them to do so or if a Court ordered it.The suit was commenced for the court to compel Lister to produce Vaah's records.
The Applicant, Elizabeth Vaah filed her case pursuant to Articles 21 (1) (f) and 33 (1) of the 1992 Constitution together with Order 67 of the High court (Civil Procedure) Rules 2001 (C.I.47).Article 21 (1) (f) states that: All persons shall have the right to-information, subject to such qualifications and laws as are necessary in a democratic society.
Since then, the Data Protection Act of 2012 was passed.Its passage is a great development in the protection of civil liberties in Ghana.It provides the legal pathway for the exploitation and mining of data not only in public health and epidemiologic research, but in many facets of data mining.The DPA of 2012 and the ruling in Vaah of 2010 contain many inconsistencies and juxtapositions which need to be rationalized to a legal certainty for the operationalization of the law by the healthcare professional and other researchers and users of personal data.In addition, due to the reliance on precedence from other jurisdictions employed in Vaah, other cases have also entered the national jurisprudence.Such cases are namely: Emmet v. Eastern Dispensary and Casualty Hospital (1967) and Julian E. Cannel v. the Medical and Surgical Clinic and its progeny of cases (1972).These cases hold the position that there is a substantive right of patients to their medical records as well as the following published works (Ross & Lin, 2003;Tucker, 1978;Shenkin & Warner, 1973).
There are also apposite cases from other common-law jurisdictions that hold the opposite position of the views expressed in Vaah v. Lister, namely, R v. Mid Glamorgan Family Health Services Authority, ex parte Martin and Breen v. Williams.Mid Glamorgan holds the view that "there is no common-law right of access to medical records and this includes any claims to rights of access in equity".Breen (1996), held that "access to medical records could be denied where that would be in the best interests of the patient".
Ghana is a common-law nation and therefore can rely on precedents from other jurisdictions as persuasive.The common-law allows for the interpretation of laws, where gaps need to be filled through case law.The decisions contained in cases whether decided on the strength of a judge-made-law or on established precedent is binding on the parties to the case and on any other person subsequently and similarly situated and may be followed by other judges and government officials in the drafting of policy and other rules.The Constitution of Ghana is the supreme law of the land.It describes what powers government has, as well as the rights, privileges and duties of the citizens and those of the three branches of government.All other laws, rules and regulations work in consonance with the constitution, for example, the Ghana Health Service's, (GHS) "Patient Charter", which is meant to protect the rights of patients within the GHS chain of hospitals and health facilities.GHS is the predominant healthcare provider in Ghana and under the Ministry of Health.Standards created by the GHS may be generally applicable to other operators within the industry, or, at least, GHS standards may be considered as the bench mark.
Patient medical records, whether captured on paper or electronically might be made available to the patient when asked.By the standard held by R. v. Dyment (1988), the patient's medical record is the work-product of the attending physician who did the recording.The Ghana Health Service code takes a non-committal position on the issue of patient records and does not make it obligatory to the hospital or physician that the captured patient medical records are to be shared with the patient.Although the record is also about the patient, he cannot assume to be a co-owner of that work-product as articulated in a Supreme Court of Canada case McInerney & MacDonald (1992).In that case, a patient made a request to her doctor for copies of her complete medical file.The doctor delivered copies of all notes, memoranda and reports she had prepared herself but refused to produce copies of consultants' reports and records she had received from other physicians who had previously treated the patient, stating that they were the property of those physicians and that it would be unethical for her to release them.She however, suggested to her patient that she contact the other physicians for release of their records.The patient refused and filed the suit.The Canadian Supreme Court held that the patient did not have a right to the record themselves but rather a right to the information contained in the records since the dossier was the property of the physician who created it.Though some researchers say the hospital or clinic holds such a record in trust and, therefore, has a fiduciary obligation to give to the patient that which the hospital holds in trust.If the information is about a patient, then that patient has a right to that information.
A third aspect of the legal conundrum is about privacy.Whether the record is made available to the patient or kept by the hospital or physician, the patient's health record is protected health information.It may not be disclosed with identifiable features such as demographic information where there is a reasonable basis to believe that such information would be utilized.Even if the record is aggregated with other data, that particular patient's records would have to be disaggregated and presented to him as a unique piece of record.In this study, we would show that the dichotomous positions on the matter are dependent on jurisdiction.This has muddied the playing field.Therefore, caution may be required in co-opting other common-law precedents into the national jurisprudence, particularly in view of the re-statement of the law in the current Data Protection Act of 2012.

i) Internet search of databases
We searched databases such as Pubmed, Medline, Hunari and Google Scholar as well as the Ghana Law Reports between 2000 and 2014 for reported cases on patients' records.Editorials and published papers in the English Language were also assessed virtually from the Balme Library and others accessible to the authors.Hand searching of selected printed journals many of which were cited in this paper and the Ghana Health Service Regional Annual Reports were conducted to find reported cases arising out of patients requests for records.
During the documentary and the internet searches, we used carefully designed phrases like, "protecting the rights of patients, physician-patient confidentiality, constitutional provision for the right to privacy, is the right to privacy substantive or procedural?"Access to patients' medical records in Ghana," "medical mal-practice cases involving refusal to release medical records," and "patient request of medical records resulting in law court case." ii) Legislative and documentary review We obtained copies of the important national legislations, such as the Data Protection Act, 2012 (Act 843), the Ghana Public Health Act, 2012, (Act 851) which were available at the Government of Ghana Printers and reviewed them together with case law, policy and other grey literature. iii

) Criteria for inclusion
The inclusion criteria of the national legislation on patients' records and other published papers or regulations were: pertinent ethical issues arising out of the physician-patient confidentiality, contested cases on this topical issue, scholarly papers on ethics and patients' rights, opinions, book chapters on patients' rights, and even newspaper articles dealing with the issue.The legislation, paper or document should have had any combination or grouping of any; or all of the following keywords in its establishment sections and subsections, or as part of its topical focus, or be a major theme in the paper or book or report: patients, rights of patients, patients' charter, informed consent, confidentiality, privacy, and autonomy.
All in all, 30 cases from different common law jurisdictions were analyzed and the findings summarized and reported as part of the results.We found a few pertinent grey and published literature on Ghana in relation to the right to privacy and patients rights such as the Data Protection Act and the Ghana Public Health Act, and the case of Vaah vs. Lister (2010).For case law, we cited precedents from other common law jurisdictions to support our findings as reported.For this reason, we did not develop an inclusion criterion but used all the materials we could access.
Each of the specific legislation, legislative or executive instrument was read and briefed after a step-by-step and page-by-page investigation to assess how it impacted or affected the national legislation on privacy and patient rights.We segregated the dossier, read them again and selected the ones that dealt with the topic.After that we grouped them into their respective units, summarized the findings into their respective units, and interpreted them based upon our education, skills, knowledge in law, biomedical ethics, and in public health.

Result a) Access to patient's medical records, the right to privacy and Constitutional protections
The study revealed that there is no legislation regulating patient's access to information contained in medical records, save the Ghana Health Service's Patient Charter.The lack of a national legislation on Health Information and how it should be captured, stored and mined, present very complicated adjudicatory framework for the preservation of patient privacy and the physician-patient relationship.
The right to privacy is neither guaranteed in the (Constitution of Ghana, 1992) nor even in a nation like the USA.In the case of the USA, federal law provides a basis for its protection, for example the Health Insurance Portability and Accountability Act, Public Law 104-191 (Lee & Gostin, 2009;Gostin & Hodge, 1999;HIPAA, 1996).The research also found that the National Health Insurance Scheme and its Regulations are silent on the issue of patient's medical records.The National Health Insurance Regulations (L.I. 1809), contains 10 schedules covering areas as health facility attendance, prescription, diagnostic, and household information.These allow the collection of a great deal of demographic and health data.It is not clear whether there are safeguards against the untimely and unwarranted disclosure of such information.The position of the Ghana Health Service on the issue of patients' right to privacy, autonomy and informed consent is not stated in the Health Service and Teaching Hospitals Act 525 (1996) or in the Patient Charter of 2010.Today though, thanks to the Data Protection Act of 2012, there are ample provisions for the protection of patient data right from collection, mining, preservation, subsequent mining and uses.

b) Justification for the review of Vaah v. Lister as a case study
The review of the matter of Elizabeth Vaah v. Lister Hospital and Fertility Centre (2010) was done to assess whether the (Constitution of Ghana, 1992) guarantees patient's access to medical records within its right to information clause as the court in this case stated.Article 11 (1) (e) states that: the laws of Ghana shall compro-mise of the Common law.From Articles 125 through 161 the functions and mandate of the judiciary are laid out.As has been stated in the introduction, the Applicant, Elizabeth Vaah filed her case pursuant to Articles 21 (1) (f) and 33 (1) of the 1992 Constitution together with Order 67 of the High court (Civil Procedure) Rules 2001 (C.I.47).Article 21 (1) (f) states that: All persons shall have the right to information, subject to such qualifications and laws as are necessary in a democratic society.The central theme of the conflict in Vaah v. Lister is that: Vaah wanted, irrespective of the cause of death of her baby, copies of her medical records for future referencing at consultations.This request appears to come under the protection of Article 21 (1) (f).However, Article 21 (f) does not indicate the kind of information, the circumstances under which the information may be sought and the criteria for the grant.Also the broad interpretation-persuasive-approach is limited by the clawback clause thus, "subject to such qualifications and laws that are necessary in a democratic society" (Norman et al., 2012;Goodman, 2010;Francis, 2010).The High Court decided that the refusal of Lister established a prima facie case of the abuse of the human rights of Vaah, since the right to information was not a privilege but a substantive right.Article 21 (f) does not state that patient's have a right of access to their medical records.Article 18 of the 1992 guarantees the individual's right to privacy in his communications or correspondence.This right is further re-stated as being co-extensive to other personal data held in a public data centre or data retrieval system by an entity, according to clause 35 of the Data Protection Act, 2012 (Act 843).This also applies to the right of access to the data by the data subject: A data controller shall a) inform an individual who is the data subject of the processing of the individual's personal data by the data controller or another person on behalf of the data controller; b) give to the data subject, a description of i) the personal data of which that individual is the data subject; ii) the purpose for which the data is being or is to be processed; and iii) the recipient or class of recipients to whom the data may be disclosed; c) communicate in an intelligible form to the data subject i) information which constitutes personal data of which that individual is the subject; ii) information which is available to the data controller as to the source of the data; and d) inform the individual who is the data subject of the logic or rationale behind the decision that was made based on the processing where the processing constitutes the sole basis for the taking of a decision which significantly affects that individual.
It appears the Data Protection Act of 2012 does not disturb the rationale and ruling in Vaal because it states under "Demand for Health Records", Clause 83 thus: A person shall not be required to provide records which a) consist of information related to the physical, mental health or mental condition of an individual, or b) has been made by or on behalf of a health professional in connection with the care of that individual.That is to say, before a disclosure of information may occur even to the data subject, the mere ownership interest would not be enough basis and that a formal request consistent with the law has to be followed a prior.This basically means that the data subject may have a right of access but the access is not guaranteed.However, in the present case, the research also found that the court erred by applying Article 21 (f) to a mundane request for the production of documents.The right of information addressed in Article 21 (f) concerns public access to information generally within the stream of the normal course of commerce and trade, but not to restricted information such as patient medical records or state secrets.This is supported by Article 21 (a).Article 33 (1) negates the position of the High Court.Article 33 (1) offers that: "where a person alleges that a provision of this Constitution on the fundamental human rights and freedoms has been, or is being or is likely to be contravened in relation to him, then, without prejudice to any other action that is lawfully available, that person may apply to the High Court for redress".The fundamental human rights implicated in the Vaah case arose out of Lister's position against Vaah's media utterances and not because of Lister's refusal to produce her medical records without more.On the other hand, Lister's defense that because the patient had spoken to the media about the nature of the treatment she received from the hospital, they would not give her the medical records, was contradictory to Article 21 (1) (a).It states that: "All persons shall have the right to freedom of speech and expression, which shall include freedom of the press and other media".Therefore, the caution against Lister should have focused on the fact that Lister as an entity under the constitution of Ghana cannot restrict another individual to the freedom of speech or of association.

c) The ownership of medical records: the patient or the hospital/doctor
The research further found that the High Court erred by elevating a simple patient's access to medical record to the same height as fundamental human rights and freedoms, particularly because of the competing equity and contractual issues implicated in the request.On the issue of who owned the medical records of patients, the Court relied also on a Washington, DC, Appellate case from the United States of America in reaching its decision, Emmet & Eastern v. Dispensary and Casualty Hospital (1967).Emmet was a suit for damages under the Survival Wrongful Death Act of the District of Columbia, Washington.The facts of the case were that Joseph N. Emmet had died while a patient in Eastern.His son, who was the administrator of his estate, claimed that his father, Mr. Emmet, had died due to the negligence of the hospital and the attending physician, which fact the hospital had allegedly concealed.After several demands by the son of his father's medical records, which were futile, the son sued for disclosure, but lost at the lower court.On appeal, the Appeals court ruled that hospitals and doctors had a duty of care to protect patient records but should disclose such records to the patient or legal representative and thus reversed the lower court decision.The second case was Julian E. Cannel v. the Medical and Surgical Clinic (1972) was also a medical malpractice case involving a surgeon leaving a piece of broken metal in the leg of the Plaintiff, Steve Nelson, and concealing the facts of it as well as refusing to give medical records to Nelson.The facts of both (Emmet & Eastern, 1967) and (Julian, 1972) cases were not analogous to Vaah since the two cases entailed medical mal-practice suits and not a straight forward request for the production of medical records.Vaah was a simple case for the production or disclosure of patient records.Even if Vaah would have brought a wrongful death case against Lister at a future date, the facts pled by Vaah did not support such an assumption.Even though in both (Emmet, 1967) and(Julian, 1972) cases, the courts ruled that the hospital/physicians had a duty to release the patient's medical records or provide access to them, a more analogous cases involving restriction on free speech and access to a potential property right would have been more appropriate such as (R. v. Dyment, 1988) and (McInerney & MacDonald, 1992).

d) Patient's responsibilities to the keeper of medical records
We conjectured that if there was no constitutional guarantee for patient's access to medical records, what is the responsibility of the patients to the hospitals or physicians, who maintain and protect the records?(McInerney & MacDonald, 1992) held that a doctor has "a fiduciary duty which is ultimately grounded in the nature of the patient's interests in the records…" "The trust-like beneficial interests of the patient in the information indicate that, as a general rule, she should have a right of access to the information and that the physician should have a corresponding duty to provide it."That is to say, "MacDonald's contract for treatment included an implied contract for information relating to the treatment".R v. Mid Glamorgan Family Health Services Authority, ex parte Martin (1995) an English case, held the view that "access to medical records could be denied where that would be in the best interests of the patient".Also, in (Breen v. Williams, 1996), an Australian Supreme Court of New South Wales' case held that, "there was no common-law right of access to medical records and this included any claims to rights of access in equity".If there is a continuing contractual relationship between the physician and the patient after treatment, there ought to be a continuing retainer or consideration for the maintenance and protection of the medical records.

Discussion
The GHS Charter redundantly states that "the patient has the right to a second medical opinion if he or she so desires".This is the sine qua non of modern day patient behavior.In today's Goggle doctor world, patients often seek more than one medical opinion.This does not, however, imply that the patient has a right to obtain a copy of his or her medical record in order to use it to seek a second opinion.The Charter merely repeated a constitutional right of the freedom of association of patients which did not add any value to the constitutional protection that citizens and patients in Ghana already have.Lister Hospital and Fertility Centre is a private facility which does not fall under the control of GHS and may choose not to follow the GHS's Patient Charter.In theory, every health facility in Ghana must operate in accordance with the standards defined by the Ministry of Health but the reality is different.The current legal framework does not mandate any private or public institution to audit the activities and operations of private clinics and hospitals.We previously posed the question: Who owns the (Electronic) Health Records of the patient?Is it the attending physician, the facility or the patient?We articulated that if both the physician and the patient create the Health Records, its ownership ought to be shared.In the alternative, we also reported as per the rationale of (Breen & Williams, 1996) or R. v. Mid Glamorgan that access to the patient's medical records may be denied if it is not in the best interest of the patient.In this particular case, the release of the record was in the best interests of Vaah.This position had also been stated by other researchers.Critics argue that the control of patients' access to their own medical records set against the provision of relatively easy access to anonymous entities such as health insurance administrators to these same records makes the public apprehensive about their health information being stored in an electronic retrieval system.It is important to bear in mind that the right to privacy is not guaranteed in the Constitution of Ghana neither is the right to patient's medical records.Article 21 (1) (f) guarantees the right to information which is different from the right to privacy or patient access to medical records.
The argument by courts which unilaterally make the physician an unwilling fiduciary of the patient is preposterous, because it is skewed in favor of the patient and against the equity interests of the physician.None of the cases referred to in this narrative that argued in favor of the release of the patient records to the patient because the physician is supposedly the fiduciary of the patient, recommended that the physician may charge a fee for the storage and maintenance of the patient records.Is the physician supposed to maintain the records in perpetuity?And if so, who pays for the cost of storage space and the preservation of the records?The majority of the Court of Appeal in the (McInerney & MacDonald, 1992) case reported that there was an implied contractual term in the physician-patient relationship.The question is by whose authority was this contract executed?If society imposed this legal obligation on the physician, that imposition goes against the equal protection, due process and social justice of the physician.This situation has been rationalized by the Data Protection Act, 2012, (Act 843) (32) that; "a data subject who provides proof of identity may request a data controller to (a) confirm at reasonable cost to the data subject whether or not the data controller holds personal data about the data sub-ject…", the "request shall be made … (b) after the payment of the prescribed fee, if any".

Conclusion
There appears to be real confusion in the minds of jurists and researchers that the (Constitution of Ghana, 1992) guarantees a right to privacy and therefore the right to patients' medical records.This does not appear to be the case.The right to privacy is not an automatic right and does not appear to be guaranteed by the constitution.The Constitution's Article 21 (1) (f) appears to guarantee the right to information which is different from the right to privacy or patient access to medical records.

Recommendation
We recommend that: 1.The Ghanaian legislature may provide specific legislation on privacy since the Data Protection Act cannot be said to be providing the substantive right to privacy.It only protects data mining and processing, and the freedom from unreasonable searches and seizures of one's personal effects and property, including personal data.The right to privacy is broader and covers not only one's personal communications or correspondence and property alone.2. The Ghana Medical Association may propose that medical records kept beyond seven years may be destroyed, or if not destroyed may be accessed at a progressive fee: the longer the records are kept the higher the fee.Such proposal could form part of the Legislative Instrument to accompany the DPA of 2012.