World Privacy Forum Analysis of Personal Health Records
Nonprofit think tank World Privacy Forum published a paper this week analyzing the privacy implications of consumers using personal health records (PHRs) to access their medical information.
PHRs are designed to offer consumers greater convenience by collecting information in one place and allowing them to easily retrieve and share that data. These records can contain a variety of data related to the patient's medical history and current condition, including details on prescriptions, allergies, lab results, family history and drug interactions.
While some individuals may maintain their PHRs on paper only, it's increasingly common for vendors to offer PC and Web-based systems so consumers can share their information electronically.
The World Privacy Forum's analysis focuses specifically on use of PHRs that are not protected under the privacy rule of the Health Insurance Portability and Accountability Act (HIPAA), which regulates how healthcare providers and insurers handle personal medical information.
According to World Privacy Forum, many commercial PHR vendors are not covered by HIPAA and so those consumers face "significant privacy consequences" such as:
- Consumers could have their PHR data used for marketing and advertising purposes because HIPAA rules against marketing don't apply.
- In the event of a legal proceeding, a patient's PHR can be more easily subpoenaed by a third party than health records covered under HIPAA.
- Combining medical info from a variety of sources into a single PHR may backfire on consumers who don't want all of the details of their health history shared with their healthcare providers or insurers.
- On the other hand, some PHRs may be missing healthcare data because a physician refuses to authorize its release.
- Consumers may think they have more control over the disclosure of PHR records than they actually do.
- Privacy protections offered by PHR vendors may be weaker than consumers expect and may be subject to change without notice or consumer consent.
World Privacy Forum concludes with this statement:
Whether the benefits of PHRs are sufficient to overcome the real dangers to privacy remains to be seen. It is something that each potential user of a PHR must consider before enrolling. Any consumer worried about the privacy of personal health information should proceed with great caution before agreeing to sign up for a PHR, particularly those operating outside of HIPAA.
A PDF of the World Privacy Forum's paper is available here. Published: February 20, 2008.
For a different perspective, visit myPHR.com, a site operated by the American Health Information Management Association.
TrackBack URL for this entry: http://www.techpolicycentral.com/cgi-bin/mt/mt-tb.cgi/960
