Electronic medical records and secondary use

Overview

An EMR vendor providing a treatment platform may be a processor for that service but a controller when it decides to use patient data for its own research or statistics. The NPC emphasized patient information, a lawful basis for secondary processing, security measures and genuine anonymization before unrestricted sharing.

Practice implications

Parao Law practice guidance

For physicians

Ask vendors what happens to information entered in the EMR beyond care delivery. Check how access, encryption, backups and data exports work. Do not assume a physician’s agreement permits a vendor to reuse patients’ identifiable information for research.

For lawyers

Map the vendor’s role separately for treatment hosting and any independent analytics. Address secondary use, patient-facing information, lawful basis, retention and security in the contracts and assessment. Data remain regulated before anonymization and whenever individuals can still be identified.