  In present technological era, healthcare providers generate huge amount of
clinical data on daily basis. Generated clinical data is stored digitally in
the form of Electronic Health Records (EHR) as a central data repository of
hospitals. Data contained in EHR is not only used for the patients' primary
care but also for various secondary purposes such as clinical research,
automated disease surveillance and clinical audits for quality enhancement.
Using EHR data for secondary purposes without consent or in some cases even
with consent creates privacy issues for individuals. Secondly, EHR data is also
made accessible to various stake holders including different government
agencies at various geographical sites through wired or wireless networks.
Sharing of EHR across multiples agencies makes it vulnerable to cyber attacks
and also makes it difficult to implement strict privacy laws as in some cases
data is shared with organization that is governed by specific regional law.
Privacy of an individual could be severely affected when their sensitive
private information contained in EHR is leaked or exposed to public. Data leak
can cause financial losses or an individuals may encounter social boycott if
their medical condition is exposed in public. To protect patients personal data
from such threats, there exists different privacy regulations such as GDPR,
HIPAA and MHR. However, continually evolving state-of-the-art techniques in
machine learning, data analytics and hacking are making it even more difficult
to completely protect individual's / patient's privacy. In this article, we
have systematically examined various secondary uses of EHR with the aim to
highlight how these secondary uses effect patients' privacy. Secondly, we have
critically analyzed GDPR and highlighted possible areas of improvement,
considering escalating use of technology and different secondary uses of EHR.
