In a virtual environment, in which physical contact is often replaced by an intelligent software intermediary among the parties and explicit boundaries are transformed into blurred and fluid ones, would somewhat be unrealistic the notion of total, intact autonomy. The very nature of the new environment poses ethical challenges to the protection of the privacy of personal space.

While security breaches are relatively uncommon, their potential for damage is enormous, especially when the security of socially stigmatizing health information has been compromised that could directly or indirectly affect the socioeconomic status of patients and their families, denigrating their reputation, subjecting them to social ostracism, discrimination at work, extortion, etc. In such situations, where the health information being protected carries social stigma and penalties, it is the ethical importance of privacy protection that stands out the most.

Not only in this concrete case but also in overall telemedicine reality, an adequate approach would not be seeking universality in the new conditions but instead elaborating procedural criteria to determine what must remain private and confidential by permitting individual patients and their family caregivers to decide for themselves what they would like to keep private and confidential. This manifestation of flexible thinking should be reflected in the design and practice of informed consent, with the latter not perceived within the conventional narrow framework of a single act but viewed as an ongoing process with options for revision, if necessary.

Traditional informed consent, conceived as a single event, is the preferred option in cases of single clinical encounters or in periods of initiation, termination or modification of therapy. In this context, the consent shall be deemed a discrete/isolated event as contrasted to an ongoing process.

In the new realities associated with NCDs, however, the traditional model is not applicable and must be replaced with the concept of informed consent of an ongoing process as far as caring for a patient presumes an extended period of time characterized by a multiplicity of procedures, therapies and technologies. An advantage of this second model is the recognition of the fact that patients may not always be able to fully and immediately understand information regarding their diagnoses and treatment modalities. Furthermore, the procedural approach provides patients with the opportunity to reflect on treatment options in light of their own values, allowing them enough time for rethinking and judging on the selected treatment. In addition, a procedural approach is also useful in that it gives both patients and physicians more time and opportunities to reach an agreement, especially in the case of different opinions on the optimal course of action. Particularly in remote medical practice, that flexibility of the informed consent can be illustrated by a revision of the informed consent in accordance with the dynamic nature of the condition. Additionally, with a view to the rapid technological development, further clarifications to the patient and his/her training in the course of therapy may be required.

These are just a few of a number of proposals that the community of ethicists, lawyers, physicians, IT specialists, politicians, etc. need to focus on in order to articulate them into further measures, ensuring users’ autonomy and privacy, while broadly speaking – help  increase public confidence in the health institutions and telemedicine practice.

The remaining measures are directly related to information protection and generally refer to establishing control over the collection, transmission, storage and use of personally identifiable data in an uncertain electronic environment:

1. Health information may be disclosed for health purposes with only limited exceptions. However, using health information for purposes not related to health, such as hiring or dismissal, shall be prohibited;
2. Disclosure of patient information to outside parties only with the permission of the patient or if enshrined in law. Necessity to regulate the cases, in which information may be disclosed: for treatment, payment or administrative purposes, etc. Guarantees for its protection by the recipients through measures against accidental or intentional disclosure as well as informing patients about the purposes, for which the information is being used or disclosed to third parties;
3. Need for strict allocation of responsibilities for all persons involved (equipment manufacturers, system installers, operators, clinicians), each with a concretely assigned task, for example: who is in charge of permanent care, of consultations, of laboratory tests, etc.;
4. Limiting information access to only a narrow range of authorized persons by defining different access levels in the chain in order to avoid potential threat of blurring/overlapping of responsibilities among the individuals monitoring the patient’s condition by precisely defining the roles of each of them (for example: a nurse, a clinician, a patient, etc.). In the case of medical practice, its administrator must allocate usernames and passwords with the requirement to change passwords at regular intervals, containing a minimum number of characters as well as add biometric scanners, allowing palm, finger, retina or facial recognition, etc., if necessary. Likewise, a patient should be entitled to view, possess a copy of and alter information in his/her records but only in a reproducible way – it has to be seen that a change was made and what was the content before;
5. An awareness of responsibility for improper or illegal viewing and changing data. Criminalization of the act and/or, when necessary, subjecting it to civil penalties/penalty payments;
6. Usage of specific technical means to prevent unauthorized or accidental access and disclosure of confidential health information – universal technological approaches in this relation may be electronic passwords, “firewalls”, an antivirus software and a software detecting outsider’s intrusion (digital signatures and time stamps as well as data encryption permitting encoding and decoding of information). Need to provide an additional protection when sharing clinical information through mobile phones. This is especially necessary with regard to cell phones since they do not normally run encrypted data and can easily be lost, stolen, damaged. Another good approach would be the use of the still unpopular tool, known as “audit trails”, borrowed from the financial accounting field. Audit trails allow precise tracking of all activity by generating a date and time stamps on each entry with a list of what, how long and by whom has been viewed as well as what pieces of information have been printed and the exact location and a computer, from which a request has been sent, flagging any  suspicious activity;
7. Identifying weaknesses in the security system as well as assessment of the threats and risks that are to be articulated in the development of measures, concrete policies and privacy and information security procedures.

The ICT introduction in the intimate home sphere may be seen both ways – on the one hand, new technologies contribute to the enhancement of patient autonomy and well-being, while on the other hand, may produce just the opposite effect on this same autonomy. The adoption of telemedicine should therefore not be an end in itself but a product of a clear public vision of providing really good care.