Medical records mean the documents recording the particulars about health and disease-related information, which contain various types of examinations, treatments and result provided to patients by medical institutes. Data types include electronic materials or visual data originating in hospitals, and personal identification information such as name, address, phone number, and resident registration number (RRN). These act to support the physicians' diagnosis and treatment of patients and ensure the continuance of treatments1). It is necessary to fulfill the treatments and prepare the unexpected symptoms. To complete the medical record is a duty of medical doctors, and the hospitals should preserve medical records for a certain period of time.

Medical records are used for various purposes-public/private insurance claims, issuing health certificates, and juristic acts such as medical malpractice suits especially in case of excuses at the time of post-treatment2). Therefore, requests to issue copies of medical records have increased recently. According to the relevant regulations, medical institutes should provide copies of medical records to patients on request. If a third party requests the patient's copies of medical records, after identifying the identity and confirming the required document, it could be issued3).

The important procedures of issuing the copies are patient's consent and the required documents, no adequate guidelines exist. Regulations related to issuing the copies in other countries are as follows.

In the New York hospital in the United States, in order to read and copy the medical records, the individual should submit a written application to the Health Information Management Services or other related departments. The medical institute notifies the individual of the procedures for requesting the copies, costs related to copies and delivery and the reasons to deny a request under certain conditions4).

In the case of Illinois hospital in the United States, information on medical records about treatments, payments and operations management in health care can be issued. If "Designated data sets" that limited only into information necessary to make decisions relating to treatment are applied to be open, any violation or underlying violation should be reported to the privacy officer. The types and ranges of the provided information can be understood through the procedure. The department of health information operates the procedures of written authorization, HIPAA requirement, review records, costs, application papers and preservation of recording lists. For 30 days before copying, the records should be reviewed carefully5). An applicants must pay a cost-based fee. The basic fee to copy of a patient's medical records is $22.84 (about 29,000 won in 2009), and changes according to various state laws by periods. This includes the labor costs of searching, copying or scanning medical records, to update system for records, and delivery and preparing for copies6).

In Japan, the law for the principles of protecting personal information require to the patient's consent in case of using personal information and providing personal data to a third party7).

In Canada, when a patient requires access to his/her personal health information, the manager of health information should provide copies of medical records to the patient with an explanation about the terms used in records such as codes and abbreviations8).

This study provides supplementary and basic data to overcome the insufficiency of the previous studies on the management conditions of medical records in medical institutes in order to prepare for a system to ensure human rights of information9). In addition, it provides quantitative grounds to prepare for a detailed guideline for copies through an awareness survey of applicants about the protection and use of personal health information.

The detailed purposes of this study are as follows.

For the study, a self-administered questionnaires was administered to 781 patients who visited five University hospitals located in Seoul, Busan, Gyeong-gi, Chungnam and Jeon-nam from July to September in 2008 and asked for copies of their medical records.

The questionnaire was independently developed by researchers using the results of previous studies about protecting and using personal health information in hospitals analyzing the literatures such as domestic and overseas regulations and international standards and through the experts' evaluation10-12).

The questionnaire consisted of three parts as follows.

First, the general characteristics of people requesting copies of medical records were identified according to various categories of sex, age, experience of issuing copies (frequency: no, one time, two times, more than 3 times), relationship with patient (patient, family members, legal representative, private/public insurance party) and purpose of issuing the copies (insurance claims, other hospitals treatment, court of law submit, military administration, public institution, personal archive).

Second, to elucidate the protection and use of the personal health information, it was investigated that providing and using of health information under the condition of no required documents and unknown to patients and the range of person being able to take the copies of medical records without patients' consent or required documents.

Third, to understand the actual conditions of copy issuance and relevant awareness, we investigated the actual time of copying the medical records, appropriate time for issuing the copies, operating the subscription system and procedure to request/issue copies of medical records.

Data were analyzed by using the statistic program SPSS 13.0. Frequency analysis was used for general characteristics, and the multiple-choice analysis and t-test were used for the contents of medical records.

Of the surveyed patients, 77.5% of males and 80.7% of females did not want unauthorized access to their personal records. Unfortunately, many patients are not aware of their rights that protect their personal health information. More than 50% of respondents were particularly worried about unauthorized access. This highlights a culture not well versed in the protection of private health information.

Regarding who should be allowed to take copies of medical records without patients' consent or required documents, more than half of respondents answered 'it could be issued only personally' in all sexes and age groups. This indicated that they remained unaware of their privacy rights regarding the protection of personal health information. The awareness of their rights varied according to the age group. Respondents over 60 years of age were prepared to provide medical information to their spouses, whereas those in their twenties were prepared to provide medical information to their parents more readily than older groups. These results indicate a real gap in different age groups' preparedness to share medical information.

Compared with children and in-laws, the rate of the respondents who could provide copies to children's spouse was relatively lower, which indicated that children are more precious than children's spouses in Korean society and culture.

The extended family system with priority on the father as head of the family is prevalent in Korea. In consideration of family unity with comparison of gender, women are more closely related to their sons and daughters than their husbands, which was supported by a study finding that the lowest unity was with the parents-in- law13)14). The long waiting period to consult with a doctor in medical institutes was one of the patients' complaints. To improve the applicants' convenience, 50.5% of males and 59.7% females agreed with operating a subscription system without consultation with a doctor. While there was a small gap between agreement and opposition, more women agreed to operate a subscription system. The results differed according to the purposes of issuing copies, and in case of an individual's need such as amendment, they want to consult with doctors directly.

Regarding the ways to request copies, those in their twenties and thirties groups want to request the copies through electronic certificate on the web, which was attributed to their working activities and high accessibility to the internet.

Regarding the ways to issue copies, both males and females, and those in their twenties, thirties and forties want to choose between direct visit and via mail as occasion. The rate of receiving copies via mail as taking risks was relatively low in both sexes and all age groups. Even considering the copy issuing (reservation) system and providing via mails, the rate of visiting in person and submitting the relevant documents for issuing the copies was high.

Considering the sensitivity of personal health information, medical records should be issued under patient's consent and by confirming a designated person with required documents. Furthermore, people should be aware of the importance of the protection of personal health information, and medical institutes should inform the requirements of bringing the relevant documents.

Medical institutes play an important role in protecting personal record, which necessitates the use of generalized guidelines that can be widely accepted among hospitals.

In addition, this study is expected to be used as basic data for increasing the awareness about protecting personal health information and providing guidelines for medical institutes.