Protecting Personal Health RecordsHHS Weighs Privacy Issues, Asks for Recommendations
A survey earlier this year found that only about 7 percent of Americans have used a personal health record. And of those who don't have one, "worry about the privacy of my information," was the biggest barrier, cited by 75 percent.
So it's good to finally see some action in this arena as the Department of Health and Human Services takes initial steps toward preparing a report to Congress on PHR privacy and security issues, as mandated under the HITECH Act. The Act required that the report from HHS, in collaboration with the Federal Trade Commission, be submitted by last February. But the HHS Office of the National Coordinator for Health IT says the report won't be ready until early next year.
HHS should take a close look at the Markle Foundation's framework as a potential foundation for a PHR privacy and security policy.
Unlike an electronic health record, which is a provider organization's official record of treatment, a personal health record is controlled by an individual and can include information from a number of sources, including hospitals, clinics and pharmacies, as well as information the individual enters.
Google, Microsoft and many other firms offer various flavors of PHRs and PHR platforms. These vendors do not have to comply with the HIPAA privacy and security rules, which apply to organizations using electronic health records. But should PHR vendors be required to comply with HIPAA?
In written testimony prepared for a Congressional hearing held Sept. 30, Deven McGraw, director of the health privacy project at the Center for Democracy & Technology, called for stronger protection of personal health records, but not through HIPAA. She argued that HIPAA, which permits disclosure of personal health information without patient consent for a number of circumstances, wouldn't provide adequate protection for PHRs, which are controlled by the patient.
Instead, she said that the Markle Foundation's Common Framework for Networked Personal Health Information would provide a good starting point. She notes that it outlines "a uniform and comprehensive set of meaningful privacy and security policies for PHRs."
As HHS tries to make up for lost time, it certainly should take a close look at the Markle Foundation's framework as a potential foundation for a PHR privacy and security policy.
Also, HHS is hosting a day-long event focused on PHR privacy and security on Dec. 3, when it will hear from panels of experts addressing the issues. That live event in Washington is completely booked, but you can still sign up to listen online.