My Log (DK0057)

What is the public problem that the commitment will address?: Over the past 10 years, the regional governments have invested in getting digital solutions implemented throughout the healthcare system. Today, workflows at hospitals, general practitioners and healthcare in local governments are to a great extent digitized, and paper-based medical charts have been replaced by electronic health records and digital communication. To strengthen transparency and commination between health professionals, certain health data are available on a joint health record. These data are i.e. data from medical charts from hospi- tals, medication records and lab results. It is compulsory to log all access to health data in Denmark. The log serves as an important tool to ensure lawful access to health data. As workflows are digitized, it is important to ensure citizens’ privacy and that health data is only accessed in accordance with current legislation. Only health care professionals who are giving treatment to a patient are allowed to gain access to information about the particular patient. Due to the joint health records, it is possible for healthcare professionals to share selected information about patients across the health sector, regardless of geog-raphy. All access is logged, and some of these logs are available for citizens in the shared registry solution called Min Log (My Log). This registry allows patients to examine lookups in their joint health record and check whether there has been any incorrect or suspicious lookups. This public logging registration of the health record applies to lookups in the health record via hospitals, the shared medica-tion record, laboratory results, appointments and vaccinations via the webpage sundhed.dk. However, logs from the hospital’s own information systems are not available to citizens yet.; What is the commit-ment?: In the annual budget agreement between the government and the regional governments for 2018 it was agreed that data and information security-work should be of high priority and should be strengthened further to ensure confiden-tiality (and thereby security) of personal sensitive information and a high level of security in the digital infrastructure. This includes ensuring increased transparen-cy of access to the citizens’ health data. On that basis it was agreed that the regional governments in the future adjust-ments of the hospital information systems would be obligated to make sure that is it possible for the citizens to review digital log-information, even when data is processed/accessed through internal systems in hospitals. In addition, it was agreed to analyze how a user-friendly joint public solution could be made acces-sible for citizens via the webpage Sundhed.dk. One of the purposes of Sundhed.dk is to gather all health-related information in one place, where pa-tients can access information about e.g. health record, health related treatments on hospitals, lab results, vaccinations and prescriptions. In addition to access to own health data, sundhed.dk contains information about health services, hospi-tals, health-apps, diseases, etc. Danish Regions is responsible for the analysis, and the analysis itself is ex-pected to be carried out in collaboration with the Danish Health Data Authority. Content, timeline and the organization of the analysis will be completed by the end of 2017.; How will the com-mitment contribute to solve the public problem?: By giving citizens access to log information via Min Log, the individual citizen will be able to see who from the hospitals that have accessed his electronic medical chart and report suspicions of unlawful access of data. This digital registration log helps create transparency and openness about the use of sensitive infor-mation, which is a crucial element in ensuring the balance between increased digitalization and privacy. By implementing the citizen-oriented log-solution, it is the hope that citizens will continue to trust that health data is lawfully accessed.; Why is this com-mitment relevant to OGP values?: The logging registration is relevant to OGP values on transparency and open-ness. The logging-interface ensures that citizens have access to a list with health professionals who have accessed their electronic medical chart as well as what types of information that they have accessed. The purpose is to use transparen-cy to balance privacy and digitisation.; Additional infor-mation: https://www.regeringen.dk/media/3496/aftale-om-regionernes-oekonomi-for-2018.pdf https://www.sundhed.dk/borger/min-side/min-log/min-log/ https://www.sundhed.dk/borger/service/om-sundheddk/om-portalen/datasikkerhed/andres-dataadgang/egenkontrol-min-log/

Commitment 8: My Log

Language of the commitment as it appears in the action plan:

In the annual budget agreement between the government and the regional governments for 2018 it was agreed that data and information security-work should be of high priority and should be strengthened further to ensure confidentiality (and thereby security) of personal sensitive information and a high level of security in the digital infrastructure. This includes ensuring increased transparency of access to the citizens' health data.

On that basis it was agreed that the regional governments in the future adjustments of the hospital information systems would be obligated to make sure that it is possible for the citizens to review digital log-information, even when data is processed/accessed through internal systems in hospitals. In addition, it was agreed to analyse how a user-friendly joint public solution could be made accessible for citizens via the webpage Sundhed.dk. One of the purposes of Sundhed.dk is to gather all health-related information in one place, where patients can access information about e.g. health record, health related treatments on hospitals, lab results, vaccinations and prescriptions. In addition to access to own health data, sundhed.dk contains information about health services, hospitals, health-apps, diseases, etc.

Danish Regions is responsible for the analysis, and the analysis itself is expected to be carried out in collaboration with the Danish Health Data Authority. Content, time and the organisation of the analysis will be completed by the end of 2017.

Milestones:

8.1 Presentation and clarification of analysis

8.2 Execution of analysis

Start Date: September 2017

End Date: November 2018

Editorial note: For the full text of this commitment, see "The Danish OGP National Action Plan 2017–2019," Danish Agency for Digitisation, https://en.digst.dk/policy-and-strategy/open-government/open-government-partnership-ogp-action-plan/, pp. 19–21.

Context and objectives

Regional governments in Denmark have invested in digital solutions for health care systems over the past decade. By law, all access to health data must be logged, and some of these logs are visible for citizens in a shared registry solution called Min Log (My Log). Through My Log, citizens can see which people at hospitals have handled their electronic patient journal. My Log also makes it feasible to report illegal data use.

Public debate around the balance between digitisation and access to sensitive information continues.^{[Note : Jakob Sorgenfri Kjær, "Danmark Får en Hær af It-Eksperter, der Skal Beskytte dit Privatliv," Politiken, 13 June 2017, https://politiken.dk/indland/art5992124/Danmark-f%C3%A5r-en-h%C3%A6r-af-it-eksperter-der-skal-beskytte-dit-privatliv. ]} The 2018 annual budget between the national government and regional governments emphasised data and information security work as priorities to ensure the confidentiality of personal information. The budget also called for the government to analyse how to make a user-friendly joint public solution available to citizens through the public health page sundhed.dk. (Sundhed.dk gathers all health-related information on one page.) The process began in May 2016, and it is expected to be implemented across all regions by 2020.^{[Note : Kristoffer Kjærgaard Christensen and Nanna Skovgaard (Ministry of Health), interview by IRM researcher, 29 October 2018.]}

This commitment's solution would allow citizens to know which health care professionals have accessed their electronic charts. Thus, it would provide transparency and give citizens increased access to their files, promoting trust in the overall health system.

This initiative is intended to promote transparency and open government. The relevance of this commitment to the OGP values is mainly related to access to information, given its goal of allowing citizens to access their own health data. As a data initiative, the commitment also relates to the technology and innovation for transparency and accountability value. While the commitment seeks to bolster citizen access to information, it does not describe a mechanism to hold authorities accountable through My Log. Therefore, it does not directly support public accountability. However, it does indirectly promote public accountability, as it provides a way for citizens to monitor authorities' use of their health information.

This commitment is, as written, not specific enough to enable verification of its implementation. The text refers to a "study," and the milestones refer to "analysis"— neither of which are clearly defined. The IRM researcher considers the potential impact of this commitment, as described by the milestones, to be minor because it deals with analysis that is not sufficiently explained. Introduction of a log system for citizens to track access to their health files could potentially be transformative. However, it would have to be presented in a clearer way in the next action plan to be considered as such.

The IRM researcher recommends that a future iteration of this commitment refer to implementation of the initiative across the Danish regions, measured by whether they can display log information.

Next steps

The IRM researcher proposes the following recommendations for this commitment:

· Carry the commitment forward to the next action plan, since it has not been implemented fully and reflects the social priority of access to health information at the regional level.

· Reformulate the commitment description and milestones in the next action plan to ensure verifiability, further specifying the various elements of the analysis.

· Building on extensive engagement across Danish regions, share lessons learned at the next multi-stakeholder forum to allow future action plan commitments to be locally anchored.

8. MyLog

Language of the commitment as it appears in the action plan:

“In the annual budget agreement between the government and the regional governments for 2018 it was agreed that data and information security-work should be of high priority and should be strengthened further to ensure confidentiality (and thereby security) of personal sensitive information and a high level of security in the digital infrastructure. This includes ensuring increased transparency of access to the citizens’ health data.

On that basis it was agreed that the regional governments in the future adjustments of the hospital information systems would be obligated to make sure that it is possible for the citizens to review digital log-information, even when data is processed/accessed through internal systems in hospitals. In addition, it was agreed to analyse how a user-friendly joint public solution could be made accessible for citizens via the webpage Sundhed.dk. One of the purposes of Sundhed.dk is to gather all health-related information in one place, where patients can access information about e.g. health record, health related treatments on hospitals, lab results, vaccinations and prescriptions. In addition to access to own health data, sundhed.dk contains information about health services, hospitals, health-apps, diseases, etc.

Danish Regions is responsible for the analysis, and the analysis itself is expected to be carried out in collaboration with the Danish Health Data Authority. Content, time and the organisation of the analysis will be completed by the end of 2017.”

Milestones:

• Presentation and clarification of analysis
• Execution of analysis

Start Date: September 2017

End Date: November 2018

Editorial note: For the full text of this commitment, see “The Danish OGP National Action Plan 2017–2019,” Danish Agency for Digitisation, pp. 19–21, https://en.digst.dk/policy-and-strategy/open-government/open-government-partnership-ogp-action-plan/.

This commitment aimed to improve and enhance citizens’ overview of their healthcare journals via a shared registry solution called MyLog. This would give citizens increased access to their health files, promoting trust in the overall health system. [30]

The commitment’s milestones covered the preparatory work for the eventual implementation that is to be undertaken in 2020. Analysis for the solution was carried out by the Danish Regions in collaboration with the Danish Health Data Authority and the Ministry of Health. The Ministry of Health stipulates, through ministerial orders, the legal framework for the obligation of the regions to render log displays accessible to citizens. [31]

Given that this commitment did not entail full implementation of the solution, but rather the preparatory work, there are no immediate results or changes in government practice. However, the eventual implementation could enhance transparency of health care institutions as well as citizens’ abilities to address mishandling of their electronical patient records through MyLog.

[30] “Denmark Design Report 2017–2019”, Independent Reporting Mechanism (IRM), https://www.opengovpartnership.org/wp-content/uploads/2019/06/Denmark_Design-Report_2017-2019_EN.pdf.

[31] Written feedback on mail, the Ministry of Health, 12 June 2020. and“End-of-term report on Denmark’s OGP Action Plan 2017–2019”, Danish Agency for Digitisation, forthcoming.