Doctors cited concerns about implementation costs and return on investment, system downtime preventing them from seeing patients and that their systems would not prove either scalable or flexible enough to meet future technology needs.

Despite those concerns, however, physicians who do have electronic health records systems in place are "very satisfied with them", the report finds.

The study comes as The Centre For Democracy & Technology issues A Briefing On Public Policy Issues Affecting Health Information Technology calling for the adoption of a comprehensive privacy and security framework for Health IT.

CDT says the increased use of IT to support exchange of medical records and other health information has created a need to adopt a comprehensive privacy and security framework for protection of health data. It says privacy and security protections will build public trust, which is crucial if the benefits of health information technology (health IT) are to be realized.

"In CDT's view, implementation of a comprehensive privacy and security framework will require a mix of legislative action, regulation and industry commitment and must take into account the complexity of the evolving health exchange environment," the report says.

"Privacy and security are paramount concerns for any health IT system and must be addressed at the outset. With a comprehensive, thoughtful, and flexible approach, we can ensure that the enhanced privacy and security built into health IT systems will bolster consumer trust and confidence, spur faster adoption of health IT, and bring the realization of health IT's potential benefits.

"Without a comprehensive health IT privacy and security framework, patients will engage in 'privacy-protective' behaviours, which may include withholding crucial health information from providers or avoiding treatment. The consequences are significant — for individual as well as population health," it says. The centre wants health IT policies and practices to be built on three fundamental principles, as outlined by the Markle Foundation's Connecting for Health:

1. Implementation of core privacy principles,
2. Adoption of trusted network design characteristics, and
3. Establishment of oversight and accountability mechanisms.