How to cite:

Anthony Anugrah Jeshua, Anak Agung Ngurah Gede Anggra Pramana (2024) Legal Responsibility

of Hospitals in Maintaining the Security and Confidentiality of Patients' Electronic Medical Record

Data, (06) 06, https://doi.org/10.36418/syntax-idea.v3i6.1227

E-ISSN:

2684-883X

Published by:

Ridwan Institute

AND CONFIDENTIALITY OF PATIENTS' ELECTRONIC MEDICAL RECORD

DATA

Anthony Anugrah Jeshua, Anak Agung Ngurah Gede Anggra Pramana

Universitas Hang Tuah, Indonesia

Email: [email protected], [email protected]

Abstract

The very rapid development in health services today requires that every health service

provider organize medical records electronically with the principles of security and

approach and conceptual approach. The results still found some legal wins, ambiguities and

some shortcomings in implementing this EMR in full

Keywords: Elecronic Medical Record, Hospital, Security, Confidentiality

INTRODUCTION

The rapid development in health services today requires every health service provider to

immediately be able to meet the wishes of its customers. In order to support these health

services, health data must be stored neatly in an archive called Medical Records (hereinafter

referred to as RM). RM is one of the most important pillars in hospital administration. With

the development of medical science, health law and technological developments coupled with

concerning Consumer Protection (hereinafter referred to as UUPK). Consumer Protection is

any effort that ensures legal certainty to provide protection to consumers. In Article 4 number

1 of the UUPK which states that consumer rights are the right to comfort, security, and safety

in consuming goods and/or services. So that consumers, in this case patients in the hospital,

concerning RM/ Medical Records. With the issuance of this PERMENKES, the procurement

of RM has become a must or has become a law that must be obeyed for every health service

facility, but the regulation still revolves around paper-based (conventional) RM. Furthermore,

PERMENKES No. 24 of 2022 concerning RM was issued, which specifically explains RME

that "Every Health Service Facility is obliged to carry out Electronic Medical Records”

(Hapsari, 2014)

However, in practice, RME still experiences many legal issues that are detrimental to

both the hospital and especially the patients themselves. One of the legal issues in January

reported on the tekno.kompas.com news page, it was reported that there had been a data leak

of 6 million patient RME data from various major hospitals in Indonesia. The data is known

In principle, the contents of the Medical Record belong to the patient, while the Medical

Record file (physically) belongs to the Hospital or health institution. This is in accordance

with Article 26 paragraph (1) of the Regulation of the Minister of Health of the Republic of

Indonesia Number 24 of 2022 concerning Medical Records. Maintaining security, in storing

data/information and ease of access is the obligation of the 3rd party to the authority.

Meanwhile, those who need data/information must always respect the privacy of patients.

Ensuring the quality of security, privacy, confidentiality, and safety of devices that fortify RM

data/information has been regulated in Article 23 of the Regulation of the Minister of Health

of the Republic of Indonesia Number 24 of 2022 concerning Medical Records. Therefore, all

authorities who need more detailed data/information in accordance with their duties are

obliged to maintain the four elements above (Gemala, 2008; Purba & Yulita, 2018).

The type of research used in examining this problem is normative juridical research,

where the law is conceptualized as what is written in laws and regulations (law in books) or

the law is conceptualized as a rule or norm which is a benchmark for human behavior that is

considered appropriate (Kelsen, 2019). The research methods used are a statute approach and

a conceptual approach. The statute approach is a research that prioritizes legal materials in the

Anthony Anugrah Jeshua, Anak Agung Ngurah Gede Anggra Pramana

relation to the concepts used (Rifa’i, 2023). The activity that will be carried out in the

Collection of Legal Materials in this study is a Literature Study by means of content

identification. The collection tool by identifying the content is obtained by reading, studying,

and studying literature materials in the form of laws and regulations, articles from the internet,

national seminar papers, journals, documents, and other data that are related to the legal

materials of this research.

The method of analysis of legal materials used in this study is a descriptive normative

method because this study does not use concepts that are measured/expressed by numbers or

statistical formulations, so the analysis of legal materials is carried out in a guided way or

based on legal norms/rules (in a broad sense, namely those consisting of legal values, legal

The concept of responsibility was first proposed by the originator of pure legal theory,

namely Hans Kelsen. According to Hans, responsibility is closely related to obligations, but

they are not identical. This obligation arises because of the existence of legal rules that

regulate and provide obligations to legal subjects. Legal subjects who are burdened with

obligations must carry out these obligations as an order from the rule of law. As a result of

non-implementation of obligations, sanctions will be imposed. This sanction is a forced action

of the rule of law so that obligations can be carried out properly by legal subjects. According

to Hans, the subject of the law who is subject to the sanction is said to be "responsible" or

legally responsible for the violation (Kelsen, 2019).

Based on this concept, it can be said that responsibility arises from the existence of a

legal rule that gives obligations to legal subjects with the threat of sanctions if these

health services based on the principles of safety, comprehensiveness, non-discrimination,

participation and provide protection for the community as health service users (health

receivers), as well as for health service providers in order to realize the highest degree of

health (Prasada & Mudana, 2014).

data/information and ease of access are the demands of the 3rd party authorities. Meanwhile,

those who need data/information must always respect the privacy of patients. Security,

privacy, confidentiality, and safety of devices that fortify data/information in health records.

That way, various authorities who need more detailed data/information in accordance with

their duties must always maintain the four elements above.

A hospital is a public service organization that has responsibility for every health public

service it provides, including the maintenance of medical records, especially electronic. This

responsibility is to provide affordable quality health services based on the principles of safety,

comprehensiveness, non-discrimination, participatory and provide protection for the

community as health service users (health receivers), as well as for health service providers in

concerns promotive, preventive, curative and rehabilitative activities of education and training

of medical personnel research and development of medical science. Based on these

provisions, there are basically four parts related to the responsibility of hospitals as medical

services, namely :

1. Responsibility for personnel;

2. Professional responsibility for quality;

3. Responsibility for facilities/equipment; and

4. Responsibility for building safety and maintenance.

According to Law Number 44 of 2009 concerning Hospitals Article 46, hospitals are

legally responsible for all losses caused by negligence committed by health workers in

hospitals. The legal responsibility of hospitals in the implementation of health services to

to health services, especially the implementation of medical records, are contained in several

laws that are sectoral. In article 29 paragraph (1) letter h of Law of the Republic of Indonesia

Number 44 of 2009 concerning Hospitals, it is stated that in providing health services,

hospitals are obliged to organize Medical Records. Then in article 3 paragraph (2) letter d of

the Minister of Health Regulation Number 24 of 2022 concerning Medical Records states that

Anthony Anugrah Jeshua, Anak Agung Ngurah Gede Anggra Pramana

Administrative sanctions can be imposed on health workers and health service facilities

that are suspected of violating the provisions of Law No. 36 of 2009 concerning Health,

especially in article 57 paragraph (1) where everyone has the right to the confidentiality of

their personal health conditions that have been submitted to health service providers, but this

does not apply in article 57 paragraph (2) where the provisions regarding the right to

confidentiality of personal health conditions as referred to in paragraph (1) does not apply in

the event of: a legal order; court order; the permit concerned; community interests; or the

interests of the person.

The above administrative sanctions are written in the same Law in article 188 paragraph

(3) in the form of a written warning, revocation of temporary permits and/or permanent

medicine after meeting the requirements.

In addition to medical practice, nursing practice also has an administrative legal aspect.

Article 19 of Law No. 38 of 2014 concerning Nursing states that nurses who practice nursing

are required to have a permit. This permit is given in the form of SIPP or called the nurse

practice license. The administrative sanctions are the same, listed in article 58 of Law no.38

of 2014 concerning nursing in the form of verbal reprimands, written warnings, administrative

fines and/or revocation of permits.

The legal aspects of administration to health services carried out by hospitals are

recorded in article 13 paragraph (1) of Law No. 44 of 2009 concerning Hospitals. The article

states that medical personnel who practice medicine in hospitals are required to have a

Practice License. Then for the hospital permit itself, it is stated in article 25 of Law No.44 of

decisions on complaints related to the discipline of doctors and dentists, followed by article

68; If a disciplinary violation is found in the examination, the Indonesian Medical Discipline

Honorary Council forwards the complaint to a professional organization, where in article 69 it

is explained that the sanctions given can be in the form of:

1. Giving written warnings;

requirements in the qualification of health workers' ability to organize medical records,

especially electronic and point c if it is proven that there is an act of misuse of electronic

medical record data. In Article 57 of Law Number 27 of 2022 concerning Personal Data

Protection, administrative sanctions are explained in the second to fifth paragraphs in the form

of;

a. Paragraph (2): Administrative sanctions as intended in paragraph (l) in the form of:

1) Written warning;

2) Temporary suspension of Personal Data processing activities;

3) Deletion or destruction of Personal Data; and/or

4) Administrative denda.

d. Paragraph (5): Further provisions regarding the procedures for the imposition of

administrative sanctions as referred to in paragraph (3) are regulated in the Government

Regulation.

Civil Law Liability

The hospital is a place where professionals work who carry out their activities based on

the pronunciation of the oath and code of ethics of their profession. Therefore, the Hospital is

required to be able to manage its activities, by prioritizing the responsibility of professionals

in the health sector, especially medical personnel and nursing personnel in carrying out their

duties and authorities (Wahyudi, 2011). However, medical services provided by health

workers at hospitals are not always able to provide results as expected by all parties. There are

Based on these provisions, it can be seen that the prosecution of this compensation is either

due to mistake (intentional) or due to negligence in health services, and the prosecution is

directed at a person, health workers or the organizer (Hospital). Meanwhile, based on Law

No. 44 of 2009, the prosecution of losses is only aimed at the hospital, which is caused

specifically by the negligence of health workers in the hospital. Article 46 of Law Number 44

Anthony Anugrah Jeshua, Anak Agung Ngurah Gede Anggra Pramana

Civil Liability of Hospitals for Negligence in the Implementation of Electronic Medical Records

Article 46 of the Hospital Law has guaranteed for patients that patients can hold the

hospital accountable if they suffer losses due to negligence committed by health workers in

providing health services. This is in accordance with the provisions contained in Law Number

36 of 2009 concerning Health Article 58 which clearly states that patients can sue or demand

caused by intentionality or medical risks carried out by health workers personally in health

services at the Hospital are not the responsibility of the Hospital and are the responsibility of

the health workers concerned. So that patients cannot sue the Hospital to take responsibility

due to intentionality or medical risks in health services carried out by health workers even

though it occurs in the Hospital itself.

The employer's liability in Article 1367 paragraph (3) of the Civil Code is not only

about responsibility in the work bond, including to a person who is outside the work bond has

been ordered by another person to do a certain job, as long as the person who is ordered to do

the work does his work independently either on his own leader or has done the work on his

instructions. As referred to in Article 1601 letter a of the Civil Code, the employer's liability

of the Civil Code paragraph (3) which applies specifically to hospitals, or Article 46 of Law

Number 44 of 2009 is lex specialist.

The provisions of the above Article are also in line with the provisions of the doctrine of

superior respondeat. The doctrine of superior respondeat implies that an employer is a person

who has the right to give instructions and control the actions of his subordinates, both on the

results achieved and on the methods used. In addition, with the development of health laws

and the sophistication of medical technology, hospitals cannot escape from the responsibility

of the work done by their employees, including what is done by the medical staff (Nasution,

2005).

who causes losses due to errors or negligence in the health services he receives”.

There are two forms of compensation due to unlawful acts that are commonly used in

patient lawsuits against health workers and hospitals in some cases, namely material damages

and immaterial damages:

a. Compensation material Ganti

b. Compensation imaterial

The provisions for compensation based on a default lawsuit based on Article 1246 of the

Civil Code will provide losses in the form of costs, losses and interest. However, the liability

provision based on the default lawsuit is the existence of a breach of promise or non-

fulfillment of the content of the agreement, in this case it is a breach of promise or non-

workers must meet professional standards, medical service standards and standard operating

procedures, if these three things are met, doctors and other health workers can be free from

lawsuits and lawsuits. Based on the description above, the lawsuit is based on default, the

compensation obtained by the patient is compensation based on the content of the therapeutic

agreement that has been previously approved by the patient in obtaining health services. In the

form of compensation, compensation based on default in the form of material compensation,

namely losses that are actually suffered by the victim and the amount can be measured

mathematically. This material remedy is in accordance with the therapeutic agreement that the

patient has previously agreed.

The Civil Code does not expressly or even does not regulate in detail about certain

damages, or about any aspect of compensation, so the judge has the freedom to apply such

rude as well as the rank, position and ability of both parties and the situation". In article 1372

of the Civil Code, it is emphasized that in deciding the compensation received by the patient

in his lawsuit both to the health worker and to the hospital, the Judge pays attention to the

position, ability and circumstances of the defendant and the plaintiff while still considering

the basis of justice for both.

Anthony Anugrah Jeshua, Anak Agung Ngurah Gede Anggra Pramana

committing a criminal act, because it would be unfair if suddenly someone had to be

responsible for an action, while he himself did not commit the act. In criminal law, the

concept of criminal liability is a central concept known as the doctrine of error. In Latin,

the teaching of error is known as mens rea. In English, the doctrine is formulated as an act

does not make a person guilty, unless the mind is legally blameworthy . Based on this

principle, there are two conditions that must be met to be able to be punished by a person,

namely forbidden external acts/criminal acts (actus reus) and there is an evil inner attitude

(mens rea) (Dan & Pemidanaan, 2005).

exist in criminal acts and subjectively qualify to be punished for their actions. The basis for

the criminal act. Therefore, it is also said that the basis of the existence of a criminal act is

the principle of prohibition and is threatened with punishment whoever commits it, while

the basis of the punishment of the maker is the principle of "not being punished if there is

no wrong".

thing to punish someone. Without it, criminal liability would never exist. Therefore, in

criminal law, the principle of "no crime without guilt" is known (geen straf zonder schuld).

criminal law. The element of criminal act is located in the objective field followed by the

element of unlawfulness, while the element of criminal liability is a subjective element

the ability to determine one's will according to one's awareness of the good and bad of

the deed which is a factor of feeling or will.

c. There is a mistake of the maker, (1) Intentionality (Dolus). There are two theories

related to the meaning of "intentional", namely the theory of the will and the theory of

knowledge or imagination. It is "intentional" when an effect caused by an action is

Nasution, Bahder Johan. (2005). Hukum Kesehatan: Pertanggungjawaban Dokter. Rineka