醫院病歷資訊隱私保護現況及態度調查

A Survey on Hospitals' Present Status and Attitudes Toward Medical Information Privacy Protection

莊秋華(Chiou-Hwa Chuang)

指導教授 ： 楊銘欽 博士

國立臺灣大學/公共衛生學院/醫療機構管理研究所/碩士(2007年)

https://doi.org/10.6342/NTU.2007.10552

摘要

本研究之目的在探討影響醫院病歷管理主管對病歷資訊隱私保護之認知、態度及相關之因素，並藉此瞭解醫院相關管理規定之現況及了解病歷資訊隱私保護之有效落實的方法。本研究屬橫斷面研究設計，以自填結構式問卷為研究工具，採普查方式對國內地區級以上醫院之病歷管理主管調查，共發出496份問卷，回收有效問卷共276份(55.65% )。本研究主要發現為：
1.填答者醫院在病歷隱私之管理規定上，大都已對申請、影印、保存病歷資料大都訂有規範；但僅約四成醫院對電腦列印、查詢有追查機制、利用網路傳送病歷資訊訂有加密機制。
2.對於「病歷資訊隱私相關法律規範」之認知，整體的總平均得分為1.94分（滿分為3分），顯示填答者對於「病歷資訊隱私相關法律規範」的認知仍有待加強。填答者對於醫療法第72條和醫師法第23條的平均得分最高(2.4分)；電腦個人資料保護法第34條及傳染病防治法第63條平均得分最低(1.74分)。另外，由研究結果得知，不同醫院的填答者對「病歷資訊隱私相關法律規範」的認知有顯著差異，醫學中心填答者的認知顯著高於地區醫院填答者。公立醫院填答者的認知顯著高於私立醫院填答者，大於1000床醫院填答者對，顯著高於201-500床，再顯著高於醫院床數小於100床的認知，醫院病歷管理層級為一級單位的填答者對之認知，亦顯著高於其他層級單位。另外，填答者以學歷碩士以上或曾經參加課程者對相關法律的認知最高。因此，政府當局欲先期試行推動病歷資訊隱私時，可考慮先從醫學中心做示範。
3.在填答者對於「制定病歷資訊隱私保護相關規範」構面，填答者大都認同應由中央主管機關訂定統一的規範；但對設立隱私委員會和專責人員，則看法呈現兩極化。另外，醫學中心與區域醫院填答者對於「制定病歷資訊隱私保護相關規範」的認同度高於地區醫院，且公立醫院填答者顯著高於私立醫院。大於1000床醫院填答者顯著高於500-1000床，並顯著高於201-500床，再顯著高於101-200床的填答者。另外，填答者以學歷碩士以上或曾經參加課程者的認同度最高。
4.對於「醫院現行做法」的看法，受訪醫院大都相當重視病歷資訊隱私的推動，包括病歷的傳送過程、研究人員使用病歷資訊的過程等；但大部份的醫院仍認為自己的努力不夠，且現有的規範/規定有缺憾，尚待努力加強。另外，碩士以上學歷的填答者對「醫院現行作法」的看法較正面，顯著高於專科(含以下)學歷的填答者，並顯著高於學士學歷填答者。
5.填答者大都認為(1)推動隱私保護活動，主要的動機是「提昇醫院管理品質」及「增進醫病互信」。(2)可能的好處是「保障病人權益」及「提昇醫院服務品質」。(3)最主要的成功關鍵是「醫院管理高層重視」。(4)最主要的權責單位是「病歷管理單位」。(5)最主要的人力配置方式是「由人員兼職」。(6)最需要外界協助的項目是「其他醫院的經驗指導」、「其他醫院推行的相關資料」及「其他醫院推行方法」。另外，填答者醫院不論在醫院評鑑層級、權屬別還是醫院床數的大小，其對於推動方式的看法均非常一致。僅有在人力配置方式上，大型醫院是「由人員兼職」，而區域醫院則是勾選「沒有專責人力」。
6.填答者對「病歷資訊隱私相關法律規範之認知」與其對「制定病歷資訊隱私保護相關規範」、「醫院現行做法之看法」之間均呈現正相關。
經由本研究之結果，期能提供醫院管理者及衛生主管機關推動病歷資訊隱私保護人員參考，俾利設計出更合乎實際執行的病歷資訊隱私保護規範，以增進實施之效益並減少推動之阻力。

關鍵字

病人隱私 ； 病歷管理 ； 病歷資訊隱私 ； 醫療資訊隱私和安全 ； 美國健康保險流通暨責任法案

並列摘要

The purposes of this study were to explore the knowledge, attitude, and related factors of medical information privacy protection which would affect hospital medical information administrators, and to understand the related management rules and methods to effectively implement those rules. This study was a cross sectional survey, using a self-administered structured questionnaires as the research tool. Survey objectives were medical information management officers of all regional or above hospitals. Totally, 276 (55.65%) of 496 questionnaires were received. Important findings are as follow:
1.Most respondents’hospitals had standard guidelines of medical information privacy management for applying, copying, and keeping medical information.However,only 40% of hospitals had tracing control on computer printing, inquiring, and internet transferring.
2.The overall average score was 1.94 (the highest being 3) on knowledge of medical information privacy related regulations and standards. The result indicated respondents have to increase their knowledge on related regulations and standards. Respondents got the highest average score (2.4) on “ the Medical Care Act”article 72 and“the Physician Act”article 23; the lowest score (1.74) on“the Computerized Personal Information Protective Act”article 34 and“Infectious Disease Prevention Act” article 63.In addition, respondents working in medical centers had a higher score than that of regional hospitals.Public hospitals’respondents had higher score than privates’. Respondents of hospitals with more than 1,000 beds had significant higher score than those with 201 to 500 beds, and much higher than those with less 100 beds. Respondents who were high position level on medical information management officers had significantly higher score than those at lower position levels’. And respondents have masters and above degree or have taken related regulations and standards training courses had the highest score on related laws. So if the government wants to launch a trial on medical information privacy protection, it could choose medical centers for demonstration.
3.Regarding establishing related standards of medical information privacy protecting perspective, most respondents agreed with that the central government should set up unified standards. But they had different opinions on whether to set up privacy board and full time officers for management. Respondents of medical centers and regional hospitals had significantly higher degree of agreement on establishing related standards of medical information privacy protection than district hospitals’. Public hospitals’ were significantly higher than private hospitals’. Hospitals with more 1,000 beds were far higher than those with 500 to 1000 beds, 201 to 500 beds, and 101 to 200 beds on this issue.
4.Regarding the opinion on current implemented methods of hospitals, most hospitals pay attention to the implementation of medical information privacy which included transporting process of information, using medical information process of research people, etc. But the majority thought their efforts still not enough, and there is some weakness on current standards or rules that need to be improved. Respondents with master and above degree had more positive opinion than others on current implemented methods.
5.Most respondents thought that (1)The main incentive to implement privacy protection is to improve hospital management quality and increase trust between doctors and patients. (2)Possible benefits are protecting patients’ rights and improving hospital service quality. (3)The key factor of success is the “concern” degree by top management. (4)The main responsible department is medical information management department. (5)The best manpower arrangement is a part time job by existing staffs. (6)The most needed assistance from outside are experienced directing by other hospitals, related data of implementation by other hospitals, and promotion methods used by other hospitals. Furthermore,no matter different background of accreditation level,ownership type, and sizes of the hospitals,the respondents had consistent attitude on implemented methods. However,large hospitals responded that they use part time staffs on manpower arrangement, while regional hospitals’respondents selected the answer that “ they don’t have full-time staff in charge of this matter.
6.There were positive correlation among the score of knowledge in medical information privacy related regulations and standards, attitudes toward the establishment of medical information privacy protecting related standards and the opinion of current implemented methods.
As the results of this study, we hope to provide hospital management and health authorities the reference when designing more feasible regulations and standards of medical information privacy protection. This may increase the effectiveness and decrease the obstruction of implementation.

並列關鍵字

Patient Privacy ； Medical Records Management ； Medical Records Privacy ； Medical Information Privacy and Security ； Health Insurance Portability and Accountability Act (HIPAA)

參考文獻

17.周慧蓮(2005)。英國個人資料保護最新案例發展及其對我國法制之啟示。科技法律透析。財團法人資訊策進委員會科技法律中心。台北，台灣。

16.周天泰(2003)。加拿大醫療資訊電子化與隱私保護的新發展。科技法律透析。財團法人資訊策進委員會科技法律中心2003年05月出版。台北，台灣。

11.李友專(2003)。醫療資訊白皮書。行政院衛生署資訊中心出版。台北，台灣。

46.戴正德(2006)。醫院醫學倫理委員會之推廣與運作。醫學教育，10: 77-84。

37.蔡甫昌、謝博生(2003)。醫師專業精神與醫療組織倫理。台灣醫學 7(4)：587-601。