The patient internet portal is a recent technological development which provides individuals with access to medically-related information and also clinical care [34]. Several portals enable patients to access their personal EMR encompassing doctor’s notes, test results and the ability to electronically message their doctors [34]. This creates an avenue for many benefits not only for clinicians but also their patients. For example, patients can take advantage of their access to a significant amount of legitimate health information and data to manage their diseases and improve their health [35].

In the U.A.E for example, the Ministry of Health and Prevention (MOHAP) has revealed the launch of its new Smart Patient Portal Direct Booking system. Under the new implementation, appointments made through direct booking are now available for Smart Patient Portal users who visit some health centres. The user receives a short text message (SMS) to confirm the booking, as a part of an e-services package that provides a comprehensive medical record that includes laboratory tests, medical reports and list of medications taken. This aids in facilitating access to health data from smart devices [36].

The portal in the U.A.E allows patients to directly see their health records anytime, anywhere. Results of their medical consultations are directly posted to the portal as soon as they become available. This is made possible through the “Wareed” system, which is implemented in virtually all of the Ministry’s healthcare facilities and hospitals. The system offers a safe and cost-friendly network in agreement with the highest quality of standards. Under the system, medical reports can be downloaded and saved to the patients’ personal computers. Persons can also easily print their records and look through details of their future appointments for scheduling in their `own calendars [36].

Other advantages include a decline in errors of medical nature, improving the standard of care provided as well as various enhancements regarding patient-related matters that encompass the appropriateness of care [37]. Interestingly, however, growing enthusiasm regarding the access and use of a portal is related to displeasure with the doctor-patient relationship, including dissatisfaction with communication skills, failure to build rapport, and the inability to obtain important and relevant medical information [38].

A critical benefit of EMRs is that they create an ongoing link between doctor and patient, which transforms the dynamics of communication from episodic to continuous, hence significantly reducing the time to address problems that may arise [35]. One study carried out in Chicago, USA found that 90% of their participants (95/106) were satisfied with their physician using EMR whereby 59% (63/107) admitted that the digital programme have an affirmative effect on their relationship in a positive way while only 7% (8/108) believed that the EMR served as a hindrance to the communication with their doctors [39]. Hence, with such a system in place, it would allow patient preference to take precedence. Using the EMR will help standardise the collection of medical history, allowing linkage of records across hospitals, aid insurance companies to expedite approval of finance for medical purposes and improve the management of national epidemiologic records to mitigate health issues as a whole for research focus and budgetary planning.

When it comes to the general accessibility of these portals and medical records, there are a few issues that act as limitations. Among them are organisational resources (lack of computers, internet provision, computer training), nurses’ individual characteristics (lack of time for patients, low motivation to use computers), patient-related factors (limited literacy and e-health literacy, inadequate social support) and portal-related factors (demands better navigation skills than most patients have) [40, 41].

One study in the United States found that there was a lower probability for older patients with poor educational backgrounds to use the patient portal in order to access their EMR when compared to younger, more educated patients [37]. This suggests that differing levels of acceptance and adaptability as well as issues with accessing the internet play a part in the social disparity of EMR usage [41]. Interestingly, however, when comparing groups who had sufficient internet and computer access, older patients had a higher chance of using their EMR and this may be because of issues related to their health and well-being [41]. A study concluded that EMRs have the unique ability to improve the self-management of patients with multiple chronic conditions and enhance patient engagement [42]. However, additional measures are needed to make certain that the EMR is accessible to these group of patients [42].

Recently, studies have found good early adoption rates and usage of EMR during the initial years of its deployment amongst a population of primarily low-income, especially among those with chronic diseases [33]. The discrepancy in access to and usage of the portal were present, therefore a more concentrated attempt is required to ensure that portals are usable for and used by minority groups so that all patients benefit equally from these advancements [33].

Another important aspect of EMR accessibility that needs to be discussed is patients’ views on who, what and how much other people can access and use. One article states that the fundamental threat of such access is not the excessive information for the patient or the danger to medical hegemony but rather to vulnerable people that might not be able to control record access [43]. For example, would a victim of domestic abuse really be able to prevent the perpetrator from accessing their records to find out their history or what they may have said to the doctor about them [43]? However despite this, patients are generally positive towards the idea of data from their records (anonymous and identifiable) being used in research for the 'greater good' [44].

One study showed that a patient would support the notion of sharing their de-identified EMR if the sole purpose was for research, though they admitted to being unclear regarding data usage, rendering it challenging to obtain trust [37]. Despite being worried about their data being misused by the wrong parties (e.g. insurance agencies), 98% of respondents believed that the benefits of sharing healthcare information outweighed the uncertainty [37].

Another study found that patients have a desire to share their electronic health information but they would want complete control over the kind of information and level of access that is shared with specified people [45]. Respondents were more inclined to share access to medication lists and prescription refill activities rather than their communications with care providers [45]. Also, a research carried out in the UK on patients attitudes towards informed consent models of EMR reported that 91% of their respondents deemed it compulsory for consent to be explicitly taken before their identifiable health records were accessed by healthcare professionals at any level and/or researchers [46]. Interestingly, only 49% of respondents in this study expected to be asked for consent prior to accessing their de-identifiable medical records [46].

All of this indicates that patients want the ability to selectively share access to their EMR, so that they can grant access to 1 or more persons while being specific as to what information said person can view and what kinds of activities he/she can perform on behalf of the patient [17]. The most important aspect of accessing a patient’s EMR is to explain clearly the purpose of use and document that consent was obtained.

Since the implementation of Health Information System (HIS) in some hospitals in Malaysia, EMR has improved accessibility to medical records, making healthcare delivery more efficient. It has removed the need for physical storage, search and retrieval of patient chart, as the patient’s information can be accessed using the computers available at all workstations [47-49]. The storage of patient information electronically also eliminates issues regarding losing of charts [49]. With the benefits of convenient access to patient information, HCPs are able to act immediately and provide prompt healthcare to a patient. This is especially useful in emergency situations where the patient is unable to provide necessary information due to extreme injury/illness [16]

However, the lack of access to the system is ironically one of the barriers to the adoption of EMR by HCPs. Technological barriers have arisen following the transition of paper-based records to electronic ones. The most commonly reported limitations associated with access are inadequate computer literacy/skills, lack of computer/hardware, computer crashes and power failure [50, 51]. Computer literacy is a major factor in the acceptance of EMR and it is correlated with user satisfaction [52, 53]. Those with inadequate computer skills found the system time consuming to use and believed that it would disrupt clinical encounters [52]. The EMR contains a range of functions that require computer skills such as good typing proficiency and the ability to navigate around the system in order to provide smooth workflow [54]. But, EMR providers seem to underestimate the level of skills needed from the users to use the system [50]. Two studies have found that by providing a mandatory computer-training programme to the HCPs, computer literacy was significantly improved and further increased the overall users’ satisfaction with EMR [55, 56]. Computer training helps HCPs to gain a better understanding of the system by introducing features and functions with which they may not be familiar with [57].

Despite quick access to electronic data via the EMR, access needs to be limited to protect patient’s privacy and to maintain trust between healthcare providers and patients. Therefore, confidentiality of medical records is actively being maintained by two mechanisms, audit trails and access control. Audit trails record the user information, such as the person, date, time and circumstance when data is accessed [58]. It serves to detect security violations, recreate security incidents and prevent future reoccurrence [58]. In December 2011, the Ministry of Health of Malaysia published a user access control policy and guidelines for EMR to ensure the protection of patient’s confidentiality and to guide the design, custody and use of the clinical information system. It serves as a yardstick for all healthcare facilities in Malaysia to create the operational policy and procedures for access control [58].

A healthcare setting usually consists of multi-disciplinary teams, thus, it is important to set clear definitions as to who shall have access to patient information and the restrictions on the use of patient’s information. Patient data use is not limited to HCP; it is also used for purposes other than direct patient care. Hence, users are categorised into primary and secondary. Primary users are those who use patient information for the management of patient’s health. Secondary users are those who use patient information for other purposes, such as, audits, quality management, research, education etc [58]. Secondary use of medical records is also subjected to user access control policy [58]. The rules and restrictions to secondary use of patient information are listed below:

1. Access to data extractions shall be given with restrictions and cautions.
2. Patient data can only be given to a third party with patient’s consent.
3. Discharge summaries shall be given in the case where patient agrees to seek treatments from other practitioners.
4. Patient data shall be depersonalized for the purpose of audits, quality management etc.
5. For the purpose of research, the relevant head of departments, medical research/ facility research ethics committee, shall decide the amount of data that can be accessed.
6. For the purpose of education, consent shall be obtained from patients.

The user control matrix defines specific user roles and their level of accessibility to the medical records in a standard operating environment. For example, doctors that are responsible for patient care are allowed to read demographic data, read and edit clinical data but have no access to financial bills of the patient that he/she is treating within the department. Some roles are allowed to override the access control in cases like emergency situations, on call or referred patient to his/her department. But, they will be required to fill in the reasons and the system will automatically send an alert to the director of facility regarding the override of access [58].

Access control may also be able to prevent unauthorized access to certain extent, but this alone is seldom enough to ensure information security [59]. Evidence has shown that the number of incidents related to information security is increasing, despite the investments in technology-based solutions [59]. These incidents are closely related to the level of competence and conscience of the people using the technology. Data breach due to human can happen in 2 ways, one is by unintentional negligence as a result of oblivion to the security guidelines and the consequences of their work; another is by an intentional human violation of information security [60]. Hence, staff’s compliance with the policy and their upholding of ethical values are also essential in maintaining the confidentiality of patient’s information [61]. In a study carried out in Malaysia, healthcare professionals were interviewed about their views’ on the current privacy mechanisms. Many have expressed their needs for a clear policy guideline, which indicate that most HCPs are unaware or have very little knowledge of the access control policy [62]. Without the proper knowledge of the operation procedures, human misconduct/malpractice could easily happen, attributing to data breaches unintentionally.

This calls for healthcare institutions to prioritise setting clear information on security policies, to ensure compliance from all healthcare staffs in addition to raising awareness on the importance of maintaining patient’s confidentiality.

Healthcare professionals, especially doctors’ view on whether the patient should have access to their own medical records have been expressed in several studies. Although doctors’ opinions on patient access vary across different studies, they are generally positive on the idea of patient reading their medical records [63-65] Firstly, doctors found that by allowing the patient to access their notes, it promotes transparency that strengthened the doctor-patient relationship, enhanced mutual trust and encourage communication during consultations [64]. Patients reportedly seemed more empowered and satisfied [64]. Secondly, doctors noticed a change in approach to documenting sensitive information like substance abuse, mental health issues, weight issues etc. This is to avoid evoking negative feelings in patients with overtly direct words [64]. Thirdly, medical records could serve as a tool to educate patients on their health and conditions, encouraging them to engage in their own care [64, 66]. Two studies found that more than half of their patients who had access to doctors’ notes has reported improved adherence to medical regimens as the notes act as a reminder for the patient to take their medicine [64, 67]. However, doctors are concerned that uncensored honesty to patients may cause unnecessary alarm and anxiety [65]. Moreover, doctors are often self-conscious about the possible errors and typos in their notes, especially on busy days, and the potential repercussions of these mistakes [65]. There are benefits and drawbacks on granting patient access to their medical records. Nevertheless, it is HCPs’ professional and ethical onus to act in the patient’s best interest and choose how to inform his/her patient and decide on the appropriate amount of information disclosure [68].