The document discusses several key ethical and legal issues related to health information technology (IT) implementation in Thailand. It outlines principles of ethics like beneficence, non-maleficence, justice, and respect for autonomy. It also discusses privacy and security safeguards needed like access controls, encryption, and user awareness training. Legal issues covered include Thailand's Computer Crime Act and Electronic Transactions Acts, as well as privacy provisions in the National Health Act. The document advocates that health IT systems should be evaluated for efficacy and used to augment rather than replace clinical judgment.

1. Ethical & Legal
Issues for Health IT
in Thailand’s Context
Nawanan Theera‐Ampornpunt, MD, PhD
September 13, 2013
Except where
citing other works

2.  Leads to patient outcomes, including deaths
 Provider‐patient relationship threatened by IT?
 “Rationing” of health care through CDSS
 Information risks
 Research ethics
 Informatics practitioners as “professionals”
with specific skills, training, & competencies?
 Most common question “Who owns the data?”
Why Important in Informatics?
Goodman & Miller. Chapter 10: Ethics and Health Informatics: Users, Standards, and Outcomes. In Shortliffe (3rd Edition).

3.  Non‐maleficence
 “Do no harm”
 Beneficence
 Provide benefits to patients
 Justice
 Fair distribution of benefits, risks & costs
 Respect for Autonomy
 Respect decisions made and rights to make
decisions by individual persons
Relevant Ethical Principles

4. Standard view
 With uncertainties around new technology,
“scientific evidence counsels caution and
prudence.”
 Evidence & reason determine appropriate level
of caution
 If such systems improve care at acceptable cost
in time & money, there’s an obligation to use it
 Follows evolving evidence and standards of
care
Appropriate Use of Health IT
Goodman & Miller. Chapter 10: Ethics and Health Informatics: Users, Standards, and Outcomes. In Shortliffe (3rd Edition).

5. Standard view
 For computer‐assisted clinical diagnosis CDS,
human cognitive processes are more suited to
complex task of diagnosis than machine, and
should not be overridden or trumped by
computers.
 When adequate CDS tools are developed, they
should be viewed and used as supplementary
and subservient to human clinical judgment
Appropriate Use of Health IT
Goodman & Miller. Chapter 10: Ethics and Health Informatics: Users, Standards, and Outcomes. In Shortliffe (3rd Edition).

6. Fundamental Theorem of Informatics
(Friedman, 2009)

7. Standard view
 Practitioners have obligation to use tools
responsibly, through adequate training &
understanding the system’s abilities &
limitations
 Practitioners must not ignore their clinical
judgment reflexively when using CDS.
Appropriate Use of Health IT
Goodman & Miller. Chapter 10: Ethics and Health Informatics: Users, Standards, and Outcomes. In Shortliffe (3rd Edition).

8.  Health IT “should be used in clinical practice
only after appropriate evaluation of its efficacy
and the documentation that it performs its
intended task at an acceptable cost in time &
money”
 Qualified (licensed, trained & experienced)
health professionals as users
 Systems should be used to
augment/supplement, rather than replace or
supplant individuals’ decision making
 Adequate training
Appropriate Use of Health IT
Goodman & Miller. Chapter 10: Ethics and Health Informatics: Users, Standards, and Outcomes. In Shortliffe (3rd Edition).

9.  Follow standard of care & scientific progress
(evidence‐based)
 System evaluation is ethically imperative
Ethics for Developers
Goodman & Miller. Chapter 10: Ethics and Health Informatics: Users, Standards, and Outcomes. In Shortliffe (3rd Edition).

10.  Privacy: “The ability of an individual or group
to seclude themselves or information about
themselves and thereby reveal themselves
selectively.” (Wikipedia)
 Security: “The degree of protection to safeguard
... person against danger, damage, loss, and
crime.” (Wikipedia)
 Information Security: “Protecting information
and information systems from unauthorized
access, use, disclosure, disruption, modification,
perusal, inspection, recording or destruction”
(Wikipedia)
Privacy & Security

11. Information Security
 Confidentiality
 Integrity
 Availability

12.  Physical Security
 System Security
 Antivirus, Firewall, Intrusion Detection/Prevention
System, Log files, Monitoring
 Software Security
 Network Security
 Database Security
 User Security
 User account management
 Education against phishing/social engineering
 Encryption
Security Safeguards

13. Dear mail.mahidol.ac.th Email Account User,
We wrote to you on 11th January 2010 advising that you change the password on
your account in order to prevent any unauthorised account access following
the network instruction we previously communicated.
all Mailhub systems will undergo regularly scheduled maintenance. Access
to your e‐mail via the Webmail client will be unavailable for some time
during this maintenance period. We are currently upgrading our data base
and e‐mail account center i.e homepage view. We shall be deleting old
[https://mail.mahidol.ac.th/l accounts which are no longer active to create
more space for new accountsusers. we have also investigated a system wide
security audit to improve and enhance
our current security.
In order to continue using our services you are require to update and
re‐comfirmed your email account details as requested below. To complete
your account re‐comfirmation,you must reply to this email immediately and
enter your account
details as requested below.
Username :
Password :
Date of Birth:
Future Password :
Social Engineering Examples
Real social‐engineering e‐mail received by Speaker

14. Phishing
Real phishing e‐mail received by Speaker

15. Privacy Safeguards
Image: http://www.nurseweek.com/news/images/privacy.jpg
 Security safeguards
 Informed consent
 Privacy culture
 User awareness building & education
 Organizational policy & regulations
 Enforcement
 Ongoing privacy & security assessments, monitoring,
and protection

16.  Authentication & Authorization
 Role‐based access control
 Two‐factor authentication
 Audit trails
HIPAA
 Personal Health Information (PHI)
 Any individually identifiable health information about a
patient that is created, received, processed, or stored by a
health plan, clearinghouse, or provider
 Deidentified
Other Security Concepts & Techniques

17.  Health Insurance Portability and Accountability Act of 1996
 More stringent state privacy laws apply
 HIPAA Privacy Rule
 Regulates use & disclosure of protected health information held by
covered entities
 Covered Entities: Health plans, providers, clearing houses, and their
business associates
 Protected Health Information (PHI): Any individually identifiable
health information about a patient
 HIPAA Security Rule
 Lays out security safeguards required for compliance
 Administrative safeguards, Physical safeguards, Technical safeguards
 New in HITECH Act of 2009
 Breach notification
HIPAA (U.S.)

18.  Name
 Address
 Phone number
 Fax number
 E‐mail address
 SSN
 Birthdate
 Medical Record No.
 Health Plan ID
 Treatment date
 Account No.
 Certificate/License No.
 Device ID No.
 Vehicle ID No.
 Drivers license No.
 URL
 IP Address
 Biometric identifier
including fingerprints
 Full face photo
Protected Health Information –
Personal Identifiers in PHI
From a slide by David S. Pieczkiewicz for a Health Informatics II class (2006) at the University of Minnesota

19.  Some permitted uses and disclosures
 Treatment, payment, health care operations
 Quality improvement
 Competency assurance
 Medical reviews & audits
 Insurance functions
 Business planning & administration
 General administrative activities
Under HIPAA Privacy Rule

20.  Conflicts between federal vs. state laws
 Variations among state laws of different
states
 HIPAA only covers “covered entities”
 No general privacy laws in place, only a few
sectoral privacy laws e.g. HIPAA
Health Information Privacy Law:
U.S. Challenges

21.  Canada ‐ The Privacy Act (1983), Personal
Information Protection and Electronic Data
Act of 2000
 EU Countries ‐ EU Data Protection Directive
 UK ‐ Data Protection Act 1998
 Austria ‐ Data Protection Act 2000
 Australia ‐ Privacy Act of 1988
 Germany ‐ Federal Data Protection Act of
2001
Health Information Privacy Law:
Other Western Countries

22. Hippocratic Oath
...
What I may see or hear in the course of
treatment or even outside of the
treatment in regard to the life of men,
which on no account one must spread
abroad, I will keep myself holding such
things shameful to be spoken about.
...
http://en.wikipedia.org/wiki/Hippocratic_Oath

23.  Copyright Act, B.E. 2537
 พรบ.ลิขสิทธิ์พ.ศ. 2537
 And other IP laws (e.g. Patent Act)
 Important for intellectual property
considerations (e.g. who owns the
software source code of an in‐house
or outsourced system?)
Thai ICT Laws
Not considered professional legal opinion

24.  Computer‐Related Crimes Act, B.E. 2550
 พรบ.การกระทําความผิดเกี่ยวกับคอมพิวเตอร์ พ.ศ. 2550
 Focuses on prosecuting computer
crimes & computer‐related crimes
 Responsibility of organizations as IT
service provider: Logging &
provision of access data to authorities
Thai ICT Laws
Not considered professional legal opinion

25.  Electronic Transactions Acts, B.E. 2544 & 2551
 พรบ.ว่าด้วยธุรกรรมทางอิเล็กทรอนิกส์ พ.ศ. 2544 และ พรบ.ว่าด้วยธุรกรรม
ทางอิเล็กทรอนิกส์ (ฉบับที่ 2) พ.ศ. 2551
 Legal binding of electronic transactions and
electronic signatures
 Security & privacy requirements for
 Determining legal validity & integrity of
electronic transactions and documents, print‐
outs, & paper‐to‐electronic conversions
 Governmental & public organizations
 Critical infrastructures
 Financial sectors
 Electronic certificate authorities
Thai ICT Laws
Not considered professional legal opinion

26.  No universal personal data privacy law
(Draft law has been proposed)
 National Health Act, B.E. 2550
 พรบ.สุขภาพแห่งชาติ พ.ศ. 2550
 “มาตรา 7 ข้อมูลด้านสุขภาพของบุคคล เป็นความลับส่วนบุคคล
ผู้ใดจะนําไปเปิดเผยในประการที่น่าจะทําให้บุคคลนั้นเสียหายไม่ได้
เว้นแต่การเปิดเผยนั้นเป็นไปตามความประสงค์ของบุคคลนั้น
โดยตรง หรือมีกฎหมายเฉพาะบัญญัติให้ต้องเปิดเผย แต่ไม่ว่าใน
กรณีใด ๆ ผู้ใดจะอาศัยอํานาจหรือสิทธิตามกฎหมายว่าด้วยข้อมูล
ข่าวสารของราชการหรือกฎหมายอื่นเพื่อขอเอกสารเกี่ยวกับข้อมูล
ด้านสุขภาพของบุคคลที่ไม่ใช่ของตนไม่ได้”
Thai Privacy Laws
Not considered professional legal opinion

27.  The Sanatorium Acts, B.E. 2541 &
2547
 พรบ.สถานพยาบาล พ.ศ. 2541 และ พรบ.สถานพยาบาล
(ฉบับที่ 2) พ.ศ. 2547
 ประกาศกระทรวงสาธารณสุข ฉบับที่ 3 (พ.ศ. 2542) เรื่อง
ชนิดหรือประเภทของการรักษาพยาบาล การบริการอื่นของ
สถานพยาบาลและสิทธิของผู้ป่วยซึ่งผู้รับอนุญาตจะต้องแสดง
ตามมาตรา 32 (3)
Thai Privacy Laws
Not considered professional legal opinion

28. คําประกาศสิทธิของผู้ป่วย
“...
7. ผู้ป่วยมีสิทธิที่จะได้รับการปกปิดข้อมูลเกี่ยวกับตนเอง จากผู้
ประกอบวิชาชีพโดยเคร่งครัด เว้นแต่จะได้รับความยินยอมจากผู้ป่วย
หรือการปฏิบัติหน้าที่ตามกฎหมาย
...
9. ผู้ป่วยมีสิทธิที่จะได้รับทราบข้อมูลเกี่ยวกับรักษาพยาบาลเฉพาะ
ของตนที่ปรากฏในเวชระเบียนเมื่อร้องขอ ทั้งนี้ ข้อมูลดังกล่าวต้องไม่
เป็นการละเมิดสิทธิส่วนตัวของบุคคลอื่น
...”
Thai Privacy Laws
Not considered professional legal opinion

29.  The Official Information Act, B.E. 2540
 พรบ.ข้อมูลข่าวสารของราชการ พ.ศ. 2540
 “เปิดเผยเป็นหลัก ปกปิดเป็นข้อยกเว้น”
“มาตรา 15 ข้อมูลข่าวสารของราชการที่มีลักษณะอย่างหนึ่งอย่างใดดังต่อไปนี้
หน่วยงานของรัฐหรือเจ้าหน้าที่ของรัฐอาจมีคําสั่งมิให้เปิดเผยก็ได้ โดยคํานึงถึง
การปฏิบัติหน้าที่ตามกฎหมาย...ประกอบกัน
...
(5) รายงานการแพทย์หรือข้อมูลข่าวสารส่วนบุคคลซึ่งการเปิดเผยจะเป็นการรุก
ลํ้าสิทธิส่วนบุคคลโดยไม่สมควร
(6) ข้อมูลข่าวสารของราชการที่มีกฎหมายคุ้มครองมิให้เปิดเผย...
...”
Thai Privacy Laws
Not considered professional legal opinion

30.  Official Information Act only covers
governmental organizations
 “Disclose as a rule, protect as an exception”
not appropriate mindset for health
information
 National Health Act: One blanket provision
with minimal exceptions: raising concerns
about enforceability (in exceptional
circumstances, e.g. disasters)
Health Information Privacy Law:
Thailand’s Challenges
Not considered professional legal opinion

31.  No general data privacy law in place
 Unclear implications from ICT laws (e.g.
Electronic Transactions Act)
 Governance: No governmental authority
responsible for oversight, enforcement &
regulation of health information privacy
protections
 Policy: No systematic national policy to
promote privacy protections
Health Information Privacy Law:
Thailand’s Challenges
Not considered professional legal opinion

32. We Need A Better Information
Privacy Law That Takes Into
Account the Unique Nature of
Health Information and the
Various Use Cases &
Contingencies in Use & Disclosure
of Health Information in
Thailand’s Context
Nawanan Theera‐Ampornpunt
Not considered professional legal opinion

33. From Flickr by Bikoy (Victor Villanueva)
Privacy: The Cultural Aspect

34. From Flickr by Saikofish
Privacy: The Cultural Aspect