Anne van Dalen

40 I Chapter 1 by voice alteration and image blurring), so that it cannot be linked back to the person. 56 The Health Insurance Portability and Accountability Act (HIPAA) in the USA, the Personal Information Protection and Electronic Documents Act in Canada and the GDPR in theEUrequiredataprotectionwithconfidentiality and integrity. 57 Furthermore, they require that identifiable personal health information in any form, either electronic, written or oral, should be made available to patients. 3 As Henken and colleagues 43 state in their review, the distinction between information included in a patient record and information excluded from a patient record is therefore not as pronounced as in the EU. However, as in the GDPR, the HIPAA allows for the use of limited data sets (deidentified) for the purposes of research and quality improvement initiatives. 57 In laparoscopic surgery, the patient’s consent to themaking of an intra-abdominal video could be included in the informed consent for the complete treatment, as it is used to perform the surgical procedure. 58–62 Consequently, only the laparoscopically generated video stream, but not the operating room overview video stream in which the theatre staff is visible, becomes part of the patient’s medical record. 63 The GDPR data retention rule of thumb is ‘as long as necessary, as short as possible’. 48 Data included in the patient’s medical record must be accessible to the patient and stored for at least 5 years, depending on the country and state the patient is treated in. 64,65 Medicolegal perspective Data collected by MDR for the sole purpose of quality improvement and training of the operating team is not intended to be used for patient diagnosis, evaluation or treatment. The patient’s medical record should only include information relevant to the patient’s health and healthcare. 7,51,66 Thus, such data should not be added to patient’s medical record nor handed over to the patient or their legal representatives. 3,7 This does not preclude the healthcare professional from reporting a calamity or a ‘near miss’ just as in an unrecorded surgical procedure. In the face of such an event, it is common for hospital protocols in North America and most European countries to require that the patient is informed of the situation as early as possible, and the incident clearly noted in the patient’s medical record. 37,40,61,67