'What am I supposed to do with these CD-ROMs?': The benefits and challenges of implementing electronic medical records in Canada

Electronic medical record system (EMR) medical technology concept with doctor using tablet to record patient information and personal health history (Getty Images / Aree Sarak)

Primary and acute care providers, highly trained professionals who are adept at using up-to-date technology to help look after patients, still rely heavily on a distinctly 20th-century device: the fax machine.

“It’s 2024. We’re digitally connected in pretty much all other aspects of our lives. Why not for something as important as our health and wellness?” said Dr. Rashaad Bhyat, a Brampton, Ont.-based family physician and clinical leader with Canada Health Infoway, a digital health non-profit organization.

While 93 per cent of primary care physicians across Canada use electronic medical records (EMR), less than 40 per cent of those providers are able to digitally share clinical updates, according to the Commonwealth Fund’s 2022 International Health Policy Survey of Primary Care Physicians.

The lack of interoperability — the ability to share information securely across different systems — is one of the biggest factors that has kept the fax machine humming well into the smartphone age, said Bhyat. For the most part, even email is off the table, because many general practitioners have not integrated secure messaging into their clinic management systems.

With overburdened health-care systems across the country, there is an urgent need to provide doctors and patients with the ability to digitally access and share data, he said. According to a report published by Infoway last year, a modernized system of connected care has the potential to eliminate more than two million unnecessary primary care visits and 500,000 trips to the emergency room, saving nearly $700 million per year. Enhanced connectivity will also lead to more hassle-free referrals, faster test results and more comprehensive consultations, the report states.

But to widely implement digital access will require improving infrastructure across the board to ensure patients’ data remains in their own hands — and not in the clutches of cybercriminals.

Piecing together the puzzle of digital health care

When it comes to digitally connected health-care systems, Canada is playing catch-up. Denmark established its national patient portal in 2003, while more than 40 per cent of those living in Sweden had signed up to access their electronic health records by 2017, a level of buy-in that Canada has not yet achieved.

In the U.K., the National Health Service (NHS) app grants patients access to general practitioner records, and while the United States does not yet have a national portal, the country implemented the 21st Century Cures Act in 2016, federal legislation that established standards for data collection and sharing. For its part, Canada’s federal government has only just taken initial steps to improve connected care, tabling Bill C-72, which would ensure common approved standards this past June.

Abhi Kalra, executive vice-president of Infoway’s connected care program, said seamless nationwide connectivity is lagging, in part, because of the complexity of Canada’s federal and provincial systems. Each province and territory runs its own unique health system, and each of those 13 systems reflects the issues that seem most urgent to that region.

Interoperability isn’t always at the top of the list of priorities, he said. “Each jurisdiction knows its own pain points, so there are bound to be different priorities,” Kalra said. “One province might want to focus its resources on reducing wait times or hiring more specialists, and then come back to digital access and data infrastructure modernization two years later.” Change is slowly coming, he said, adding that provinces are now recognizing interoperability “is needed to advance an effective, connected care health system.”

Some provinces, such as Quebec, Nova Scotia and Prince Edward Island, have established portals that allow patients to check lab results, track hospital visits, and keep up with prescriptions and appointments. Other provinces, however, are still working to develop similar tools. ConnectingOntario, for example, provides patient summaries that can only be accessed by health-care providers. Additionally, networks of linked hospitals, such as the University Health Network (UHN) and Unity Health, allow patients to access information from clinics that are part of their self-contained systems.

Kalra said Infoway has been working with federal, provincial and territorial governments to develop a 10-year plan for a national EMR platform. Not quite two years in, Infoway’s pan-Canadian roadmap has established standards for data collection and exchange between different health-care providers, to ensure medical records are kept safe while allowing patients to access this data more easily.

Bill C-72, once passed, would require that these standards are upheld by all IT companies that provide health-care delivery systems in Canada if a province or territory does not have its own similar requirement.

Innovation to access information

The shift toward giving patients access to their own information is as much cultural as it is technological, said Rishi Nayyar, co-founder and CEO of PocketHealth, a startup that has developed a cloud-based medical image–sharing system.

“I think the industry used to feel it was in patients’ best interests to be left in the dark,” said Nayyar. “The worry was that they’d learn they had a diagnosis without a doctor to comfort them, or they’d take it the wrong way and do something dramatic.”

The startup began with a minor injury. In 2013, Nayyar’s brother, Harsh, who was a Google software engineer in the San Francisco Bay Area at the time, twisted his ankle playing tennis. After X-rays and an MRI, the radiologist gave him two CD-ROMs.

“(My brother) called me and said, ‘What am I supposed to do with these? I have a MacBook Air,’” said Nayyar.

In 2016, the brothers saw their chance and founded PocketHealth. In addition to cloud-based image-hosting and sharing capabilities, the platform includes features such as Report Reader, which helps explain medical terms, and Ask My Doctor, which offers patients personalized questions to ask their physicians. PocketHealth is able to instantly upload and share medical imaging and patient results with care providers, streamlining communication between patients and doctors, Nayyar said.

Eight years later, close to 2 million people and 800 hospitals and imaging centres across North America have set up accounts with the Toronto-based startup.

Security worries and potential protections

According to experts, access is one of two buzzwords in eHealth, which involves the use of digital technology to provide health-care services — the other is security. Last fall’s ransomware attack on five southwestern Ontario hospitals, during which more than 325,000 patient files were stolen, was just one of many examples of the threats targeting health-care systems around the world.

Ransomware attacks in the global health sector nearly doubled from 2022 to 2023. Because they collect sensitive personal data and require constant access to that information, health-care facilities can be particularly lucrative targets for cybercriminals, said Jennifer Quaid, executive director of the Canadian Cyber Threat Exchange (CCTX), a cybersecurity collaboration forum with 180 private-sector members.

In May, hackers shut down Ascension, a U.S. non-profit that oversees 140 hospitals and 40 senior living facilities, and June’s attack on U.K.’s Synnovis, a provider of pathology services, delayed medical procedures in several major London hospitals.

Cybergangs such as Black Basta, the Russia-based ransomware group that debilitated Ascension, have started to practise double extortion — they demand money to decrypt the data and again to not release the data.

Some groups are also starting to demand ransom directly from patients by threatening to publicize their sensitive data on the dark web, said Quaid. “EMRs are a goldmine for cybercriminals,” she said. “These files have OHIP (Ontario Health Insurance Plan) numbers, social insurance numbers, credit card info.”

Patients are not always aware that their details are being tracked by third parties. A 2023 investigation by Toronto-based cybersecurity company Feroot Security found that as many as 86 per cent of the health-care and tele-health sites that they analyzed were transferring data to Big Tech without user consent.

Bad actors can easily exploit these details for identity fraud purposes, said Quaid, who describes EMRs as “a very tempting target.”

There are some relatively easy steps health-care organizations can take, however, to prevent attacks and safeguard patient information, she said. First, it’s important to identify what information is critical to operate and protect that accordingly, ensuring systems are up to date and that people are using multi-factor authentication, she said. As well, staff should be trained to recognize phishing attempts. And organizations should have a plan in place in case the worst happens and there is a breach.

PocketHealth’s Nayyar said he believes the benefits of data ownership can help offset the vulnerability of large health-care organizations. When Windsor Regional Hospital, one of the five southwestern Ontario health facilities hacked last fall, was forced offline, most procedures and treatments had to be delayed.

For patients who had previously signed up with PocketHealth, however, their care was able to proceed with few disruptions. That’s because those users had access to their own data and were quickly able to share it with their doctors, said Nayyar: “It shows we’re really in the era of the empowered patient.”

Healthy patients, healthy doctors

Connected care can also help reduce doctor burnout, said Bhyat. Many family physicians see up to 50 patients a day, which means every minute counts. But according to a report from the Canadian Federation of Independent Business, doctors in this country collectively spend up to 18.5 million hours per year on unnecessary administrative tasks, the equivalent of 55.6 million patient visits annually.

Bhyat said empowering patients can also be a boon to doctors’ own well-being. He sees many individuals with chronic problems, such as diabetes, chronic obstructive pulmonary disease or cancer, that require ongoing and complex care.

“Co-ordinating that care shouldn’t require filling out duplicate forms and going through multiple logins,” he said. “It’s very frustrating to have to go through a billion clicks just to write a good referral and send it.”

Bhyat said this frustration can lead to fatigue and stress, forcing some to reduce clinical hours or switch to a different specialty. A survey from the Ontario College of Family Physician last year found that two-thirds of physicians in the province are planning to make a change or leave the profession in the next five years. But with Canada in need of more family doctors, modernizing the country’s EMR system may be exactly the prescription providers need to take on the most important — and rewarding — part of their jobs, he said.

As Bhyat put it, “Ask any doctor and they’d tell you they’d rather spend more time with their patients and less time trying to track down a missing fax.”

Howard Akler writes about technology for MaRS. CTVNews.ca has partnered with MaRS to highlight Canadian innovations in health care