When should a patent be advised of the existence of computerized databases containing medical information about the patient?

Answer 1

On AMA the patient and physician should be advised about the existence of computerized data both before and information is stored.

Answer 2

HIPAA does not require the patient be advisedexcept in the event of an improper disclosure. The patient may ask or assume that patient records are kept in electronic format in a HIS/RIS, or paper format, but there is no requirement on the part of the caregiver to offer this information without the patient's inquiry unless a disclosure has occurred

While other law addresses this matter either directly or indirectly, the outcome is basically the same. The question of where all your IIHI (Individually Identifiable Health Information) is kept isn't material, as long as it's properly secure and confidential.

Under most law, and certainly under HIPAA, placing PHI (Protected Health Info) into a non-secured database requires at least the patient's express permission. And even then, this may be insufficient, in that the process that allows a patient to Authorize release of PHI is crafted so that the patient cannot fully abrogate all rights to privacy regarding their own PHI in general.

Ideally, the best course is to de-identify patient data if you're databasing for a study. HIPAA contains express instructions on what de-identification requires.