Purpose of this report

This report confirms the commitment of the G7 countries to deliver on the rights of patients to have access to their health information. This commitment will:

help empower patients to take an active part in managing their health and care
support improvements in individuals' health outcomes
enable patients to ensure that clinicians have key relevant information about them before they start their treatment

Summary

The G7 Health Ministers' Meeting communiqué makes commitments on collaboration on several health initiatives, including a commitment to develop internationally shared principles for enabling patient access to health data, based on the principle of informed explicit consent or patient permission.

The G7 countries agreed 5 principles and ambitions that describe the desired direction of travel for increasing patient access to records as a means of patients taking more responsibility for and control of their own health and care:

Online access to records.
Use of own information to manage their health.
Patients contributing to their health record.
Offer online access to health information by healthcare providers.
Audit trail of who accessed the patient's record.

The implementation of these principles in individual G7 countries will depend on local laws, healthcare structures and culture, but there is a genuine desire to make progress in this area for the benefit of patients, and to learn and get support from one other.

G7 commitment on digital health

The health ministers of the G7 countries met on 3 to 4 June in Oxford and signed a communiqué agreeing to collaborate on 4 Health Track themes. Ministers made the following commitments on digital health:

recognition of the importance of digital health solutions in transforming healthcare, and of the need for appropriate data governance, system security, regulatory and data protection standards in order to benefit from advances in digital health
commitment to working towards:

adopting a standardised minimum health data set for patients' health information, including through the International Patient Summary (IPS) standard
developing internationally shared principles for enabling patient access to health data
promoting the use of open standards for health data

recognition of the need for multilateral collaboration on a standards-based, minimum data set for coronavirus (COVID-19) testing and vaccination verification, and commitment to work within existing World Health Organization processes to develop this and to work as G7 countries towards a process of mutual acceptance of COVID-19 certificates
recognition that governance of artificial intelligence (AI) systems in the health sector must be strengthened in order to keep pace with technological development
commitment to working together to define and develop a shared understanding of phases for how we clinically evaluate health AI algorithms, and develop and share best practices for benchmarking the suitability of a health AI algorithm developed in one G7 country for potential deployment in another

Patient access to health data

The following paragraph shows the full wording of the commitment as stated in the G7 Health Ministers' Meeting communique, 4 June 2021:

We commit to work towards adopting a standardised minimum health data set for patients' health information, including through the IPS standard, with the shared objectives of facilitating health interoperability within and between countries, developing internationally shared principles for enabling patient access to health data, based on the principle of informed explicit consent or patient permission and in keeping with countries' and regional existing legislative frameworks; and facilitating and promoting the use of open standards for international health data to encourage the widest possible adoption of standards and greater interoperability.

To achieve this goal, we will work with the Global Digital Health Partnership as they are already advancing IPS efforts.

Citizen online access to information – principles and ambitions

Patients who are actively involved in their own health and care report a more positive experience of the services they access. Their involvement and engagement is supported by access to accurate and up-to-date information about their health, alongside increasing their knowledge of health and wellbeing generally.

In many countries, a patient's right of access to their health information is enshrined in law, and active patient access and use of this information is becoming a reality. To make this more universally available and accelerate implementation, the G7 countries are looking to adopt the following principles:

patients have a right to view online, download, print and share their health information for the purpose of healthcare treatment (subject to legal limitations – for example, third-party information or information that would be harmful to the patient and so on, and age restrictions governed by the countries' local legislation)
patients are encouraged to use their health information to manage their health
patients can contribute information to their health record
providers will offer online access to health information via appropriate patient-facing services (apps, website portal, and so on)
an audit trail of who accessed the patient's IPS record will be available

Within EU countries and the UK, these principles are building on the rights enshrined in the General Data Protection Regulation (GDPR), specifically the right to access one's own personal data.

The roles and responsibilities are described as those of:

data subject (the patient)
data controller
data processor

Some countries also use the term 'data owner', however this definition is not universal and is not interpreted the same way across countries.

Appendix A contains individual G7 countries' status and plans or ambitions against the agreed principles of patient access to data.

Implementing citizen online access to information – putting principles into practice

G7 countries are committed to expanding citizens' online access to their health records. There are a number of dependencies: legal, technical, social and cultural, among others. Implementation journeys are not straightforward and need to reflect individual countries' circumstances, taking into account the digital and health literacy of the populations, and local customs and culture. The strength of international collaboration in this area is in sharing and learning from each other.

There are a number of examples of successful implementation of patients' online access to their health records. However, the speed of implementation and uptake vary. Access via central portals is being implemented in a number of EU countries and individual healthcare providers may offer access directly via their own websites or apps. The UK has implemented a contractual requirement for patient access to general practice data, which is gathering momentum.

Despite these successes, universal availability of patients' online access to their healthcare data is some way away. Some of the challenges that will need to be overcome are:

professional resistance in some countries
lack of patient interest
policy challenges
slow implementation of the appropriate technology

G7 countries recognise that a public promotion campaign, and work to support health and digital literacy is crucial to patients' active engagement in their healthcare. Patient access to their health records is a key element on this journey.

[back to top]

Appendix A: G7 countries mapping against patient access principles


G7 country	Citizens have a right to view online, download, print and share their health information	Citizens are encouraged to use their health information to manage their health	Citizens can contribute their information to their health record	Providers will offer online access to health information via appropriate patient-facing services (apps, portal, and so on)	Audit trail of who accessed the patient's IPS record will be available

Canada	While citizens have a legal right to access their health information and can request it through their healthcare providers, currently there is no comprehensive right to view online, download, print and share their health information. Health data and information law is determined at a provincial and territorial level.	There is strong support for this principle. Most provinces and territories have active programmes in pursuit of this goal. The federal government, through Canada Health Infoway, supports provinces and territories. Infoway has provided funding and assistance resulting in multiple provincial and regional portals in operation.	This varies by province and territory. In general, the ability for patients to contribute to their health record is limited.	Patient portals and other mechanisms for electronic access exist at the province or territory level – there isn't a national patient portal or app. Some provinces offer central portals but not all. Some hospitals and providers also offer local portals. Data content and functionality varies by province and territory. Medication history, laboratory and other results, and appointment booking are generally available.	Electronic access by patients to this information varies by province and territory.

France	This will be fully implemented from January 2022 with MonEspaceSanté.	MonEspaceSanté (MyHealthSpace) provides direct access to health data. It also integrates a medical agenda, a secure messaging system, with health professionals. These last 3 elements will also have the potential to have a proactive role.	This forms a part of the new modalities included with MonEspaceSanté.	The state is providing this access and providers of solutions need to comply with it. For instance, apps are referenced against criteria including ethics, security and purpose compliance.	IPS is not yet implemented in France. This is an objective and ambition of the eHealth roadmap acceleration plan in 2022 with the European Recovery and Resilience Facility plan. This is actually true for the principle of having all health records being digitised and accessible by the patient from 2022.

Germany	Citizens have the right to ask their statutory health insurance provider to provide a digital health record. They can also ask their general practitioner. The content of the German health record can be accessed and viewed via an app, and it can be shared with healthcare professionals. The system is patient-managed and, as of 2023, patients may share their data for research purposes.	German health insurance providers are offering every citizen their own health record. Healthcare professionals are encouraged to promote the health record to their patients.	Patients can upload, manage and delete information to their digital health record. Patients can grant granularly managed access rights to their digital health record. This information is marked as uploaded by the patient, so it can be differentiated from the information that health professionals upload.	Health insurance providers have been offering apps for the patients to access and manage their digital health records since 1 January 2021. Further access methods such as access via a personal computer will be added from the beginning of 2022.	An audit trail of who accessed patient records is available for the respective owner and can be viewed via an app.

Italy	All adult citizens (over 18 years old) have the right to access their health data in an electronic health record (EHR). In some cases, legally nominated guardians and authorised next of kin can have access on behalf of the citizen, including minors or persons unable to access the EHR. The patient, as a data subject, has legal rights to access the data. Their guardian, or delegated next of kin, needs specific legal authorisation.	It significantly varies from region to region. In 4 regions, over 70% of citizens are registered for access. There are plans being developed for active patient engagement including allowing access to additional online services such as booking appointments, choosing general practitioners, vaccinations, and so on.	Clear separation must be kept between patient's provided data (both subjective and objective data) and data provided by health professionals. This separation distinguishes between the EHR from a patient's personal health record (PHR). In addition, a patient record is either managed by a hospital (health service provider) or by healthcare professionals (such as GPs). Patients don't have direct access to hospital patient records.	Access to the EHR is provided both via internet portal and mobile apps. According to the level of citizen identification or authentication, different services are made available. Access to appointed guardians and authorised next of kin can be provided.	An audit trail of who accessed the records is available.

Japan	At present, citizens have a legal right to access all their health information and can request it through their healthcare providers. This right is usually provided in the form of paper copies of health records upon request.	At the present time, a system is being built to allow people to grasp their own health and medical information through portal sites and they are not at the stage where they can freely use their own health records.	At present, there is no such system in Japan. In general, patients cannot contribute to their health record.	We are in the process of building a system that allows patients to grasp their own healthcare information through portal sites. We are also considering the development of a system that allows medical institutions and nursing care facilities to access information that can be viewed by patients themselves (health check-up information, receipt and prescription information, electronic medical record information, nursing care information, and so on).	At present, there is no such common system in Japan. In general, this varies by facility and vendor.

UK	Citizens have a legal right of access to all their health information under subject access laws enshrined in GDPR. This is usually provided as paper copies of health records, on request. This right is not used widely. In terms of online access, citizens can access their general practitioner records (primary care physician), but not yet across the whole of health and care services, although some providers are beginning to offer this.	The NHS in England ran a nationwide campaign 3 years ago. It was relaunched to support the COVID-19 vaccination programme. As a result, over 17 million people signed up for online services. There is good uptake of online appointment booking and ordering of repeat prescriptions. Access to full patient records still lags behind and not all general practices are actively promoting the service. A new drive is being prepared that would provide access to all information in general practice records by default when the citizen activates the NHS App. A target date of April 2022 is currently being considered.	One of the proprietary general practice apps enables patients to contribute to their general practice records. This is also available within some secondary care providers' systems and specialist departments. We are looking to make it an early priority item for a portable patient summary, the G7-IPS record.	The NHS App enables access to general practice health records. The clinical systems also offer proprietary apps with similar functionality. There are also other specialist apps that citizens can use, but no universal app or website that would enable seamless access across multiple providers.	An audit trail of who accessed general practice records is available, but not displayed as default. It is expected that it will be routinely available as part of future functionality in all patient records systems.

United States	Patient rights to information access are regulated through the Health Insurance Portability and Accountability Act 1996 (HIPAA). Information may be found at Individuals' Right under HIPAA to Access their Health Information 45 CFR. More information on patient access to health information is available at Patient Access Information for Individuals: Get it, Check it, Use it.	Some US patients are using their health information to manage their health. A 2020 survey provides some major uses by patients with their health information, such as viewing test results, viewing notes, downloading records, suggesting corrections and messaging with providers. More information is available at Individuals' Access and Use of Patient Portals and Smartphone Health Apps 2020.	Citizens are encouraged to contribute to their health record. As it relates to medical health records (and not personal health records), providers are not required by federal regulations to accept data generated by patients into their health record. Since health records also serve legal and administrative purposes in the US, contributions to health records often require clinician review before becoming part of health records.	The majority of providers, both in ambulatory and hospital settings, currently provide online access to health information since regulations over the past decade have strongly encouraged patient-facing services for data. Patient portals have been highly prevalent for the past decade. In addition, recent regulations (21st Century Cures Act) have promoted wider data download and access through adoption of Fast Healthcare Interoperability Resources v4 by providers and health insurers. Adoption has already begun for these programmes and is anticipated to grow in the coming years. More information is available at the ONC's Cures Act Final Rule.	The security and privacy rules of HIPAA regulate audit logging. More information is available at Summary of the HIPAA Security Rule. Certified health IT products need to support auditable events and audit reports (enable a user to create an audit report for a specific time period and to sort entries in the audit log).

[back to top]

Source: UK Government, Department of Health and Social Care

—	This Information System is provided by the University of Toronto Libraries and the G7 Research Group at the University of Toronto.
	Please send comments to: g7@utoronto.ca This page was last updated December 31, 2021.