Thousands of healthcare workers caught viewing their own patient records

Thousands of social and healthcare workers are caught viewing their own patient records each year, Yle reports. Accessing personal information through a patient information system is illegal because an employee cannot have a care relationship with themselves.

Joni Komulainen, a senior government adviser at Finland’s Ministry of Social Affairs and Health, said the same rules apply in both public and private healthcare.

Under the Act on the Processing of Client Data in Social and Healthcare Services, client information must remain confidential. Healthcare workers may access only the essential information they need for their duties.

Komulainen said the issue is often misunderstood because the law does not specifically address viewing one’s own records.

Yle asked Finland’s wellbeing services counties how common the practice is. The figures range from hundreds of views to only occasional instances.

In the Satakunta wellbeing services county, employees accessed their own records 863 times last year. During the first six months of this year, the figure was 555. In the South Savo wellbeing services county, the records were viewed 587 times last year.

Silja Iltanen, the data protection officer for Satakunta, said the wellbeing services counties are difficult to compare because they vary in size and not all of them have figures on the practice.

Satakunta has begun monitoring the issue more closely this year. The county reviewed the figures early in the year and issued an internal reminder that employees are not allowed to view their own records. According to Iltanen, the reminder has not yet had an effect, as the figures increased during the spring.

Jukka Mielonen, digital director of the South Savo wellbeing services county, said regional differences may partly be explained by differences in the systems used to detect and report access to administrators.

Every access to patient or wellbeing information leaves a record. The law requires healthcare and social services providers to collect log data to monitor and supervise the use of client information.

Iltanen said the ease of accessing the information may encourage employees to view their own records.

“You do not even think that you are doing something unlawful,” she said.

All the wellbeing services counties that responded to Yle said they remind their staff about the rules every year. Some do so several times a year, and the issue is generally included in the induction of new employees.

Despite the illegality, the punishment is usually minor. In many counties, employees receive only a verbal warning.

People can most easily view their health information through Omakanta. Another option is to submit a request for their own patient records to the unit that treated them. This can provide considerably more information than Omakanta.

Antti Ohvanainen, chief medical officer for administration at the North Karelia wellbeing services county Siun sote, said Omakanta is not intended to display all available information.

“The patient information system is intended as a tool for healthcare professionals. It contains, for example, information related to the treatment process and internal workplace practices that may not directly concern the patient’s state of health,” he said.

In North Karelia, the problem was addressed with a technical restriction. A few years ago, employees frequently viewed their own records through Siun sote’s system. Now, anyone who tries to access their own information receives a message saying: “You cannot view your own information.”

According to Yle’s review, North Karelia is the only wellbeing services county to have introduced such a direct measure.

In most counties, monitoring is still carried out manually through spot checks of access logs. Several counties are planning to improve monitoring with technology. The Kanta-Häme wellbeing services county, for example, already uses artificial intelligence trained to identify access to an employee’s own records.