Technically, the Joint Commission on Accreditation of Healthcare Organizations (JCAHO) is a voluntary organization, and JCAHO accreditation is voluntary. JCAHO accreditation standards, however, are incorporated in some state hospital licensure laws, at least in part,²⁸ and a hospital is deemed to meet certain Medicare conditions of participation if it holds JCAHO accreditation.²⁹

Although JCAHO accreditation standards do not explicitly address required media for record keeping and storage, they assume that a hospital may participate in an automated medical record data processing system. JCAHO standards permit authentication of medical records by computer key.

The JCAHO requires that all medical records be accurate, accessible, authenticated, organized, confidential, secure, current, legible, and complete.³⁰ A computer-based medical record system can meet JCAHO standards if the system is properly designed and maintained and if medical records are otherwise properly completed.

The Federal Privacy Act and similar acts in many states provide assurance that patient records held by the federal government and governments of states that have enacted privacy legislation will not be disclosed to third parties without the patient's consent, except under defined circumstances.³¹ However, privacy of patient records in other states and in the private sector is governed by a crazy quilt of statutory, regulatory, and common-law rules and is often inadequately protected. ³²

Growing demands for information contained in patient records pose an ever-increasing threat to patient privacy. Such demands come not only