Proposed Work Item: Delete Provided & Registered Document Set Proposal Editors: Gil Levi, Bill Majurski Work item Editor: Gil Levi Date: 23 September 2013 Version: 1.0 Domain: IHE-ITI

The Problem Right now it’s not possible to “signal” the Documents Repository from distant actor by transaction to initiate Document and Metadata deletion. It might be needed (for example) that a patient will ask for a deletion of medical records which he\she founds inappropriate or erroneous. As stated here: “Patients have the right, under the Data Protection Act (DPA), to ask for factual inaccuracies in the record to be rectified or deleted.” The above quote was taken from the following link: In XDS-I environment, its difficult to keep the Document Source (e.g. DICOM archive/PACS) in sync with the Document Repository and Registry in case of deletion form the Document Source (e.g. DICOM files deletion). Also it might be possible that because of human errors wrong documents been provided and registered for a certain patient which eventually must be deleted.

The Problem (cont.) In a common scenario documents are being stored in the Document Repository and the equivalent documents metadata in the Document Registry. The document metadata allows Document Consumers query the Registry for documents which will eventually be found in the document Repository. In case that only the document metadata is deleted (existing possibility ITI-62...) from the Registry, there is no possibility to query the Repository for the equivalent documents which still exist (in the Repository), So right now there is no standardized way to fulfill Legal or patient requests for complete destruction of medical documents. The new proposal should allow requesting actors the ability to completely delete documents (from the Repository) and Document Metadata (from the Registry) in one transaction call.

Key Use Case Patient Name D. went to hospital because of an urgent medical problem, the interviewing physician wrote an impression document which was provided and registered to the document Repository and Registry in the hospital affinity domain, eventually patient D found that the document was inappropriate and backed by specialized and legal recommendations demand the document complete deletion, The hospital found the claims of the patient D as valid and agreed deleting this document from the document Registry and Repository.

Standards & Systems The main systems involved by this change are the Document Registry and Document Repository. If this proposal will be accepted the ITI-IHE will need to add a new transaction in order to support this request.

Discussion The IHE should be a good venue to solve this issue because of the real life need that eventually will rise as much as the IHE will be spread over more medical institutes. Right now the IHE XDS allows the share of documents and the deletion of metadata, in order to make the document life cycle more complete a complete deletion transaction should be supported and used by the relevant actors as needed and allowed by law.

Transactions illustrated

Additional reading: The France DMP (Dossier Médical Personnel) approach for deletion (translated from French): “Closure and destruction: what happens to the data? Your patient asks you to close its DMP: data is retained for ten years, with the possibility of reactivating the application. After 10 years without reactivation, the DMP is destroyed. Your patient wants to destroy his WMD: this irreversible action will destroy all data in its DMP. If this data were transmitted from your business software, they remain present in your business records. This destruction of the DMP will be performed by the doctor of the host. The patient who requests is offered a cooling off period of 14 days. It also has the option to request a copy of the DMP before its destruction.

Additional Reading (cont.) The previous quote was taken from the following link: savoir-plus-sur-le-dmp/securite-et-confidentialite More about the DMP (Dossier Médical Personnel): ersonnel_(France)