Intellectual Property Law

Internet Medical Records Project Not Protected by Federal Privacy Act

By IBLS Editor

Google and Microsoft's idea of taking personal medical records and posting them in a special repository on the 'Net has garnered much interest. In fact, 70% of those polled would like their medical history available online, according to a survey by the Deloitte Center for Health Solutions, and a quarter would be willing to pay for such a service. It goes without saying that this same majority believes their records will be safeguarded. But according to the San Diego-based World Privacy Forum (WPF), there are many dangers inherent in online medical data caching. Further, as the Federal law is currently written, it would not cover patient privacy in this setting.

The World Privacy Forum has urged consumers to think carefully before jumping into creating an online personal health record, which would amount to a master source of private medical information normally kept in files stored in doctors' offices and hospitals. Said the WPF, "Any consumer worried about the privacy of personal health information should proceed with great caution before agreeing to sign up for a (personal health record)."

According to Pam Dixon, the WPF's executive director, one of the main issues for concern is that most health care Web sites aren't covered by the Health Insurance Portability and Accountability Act, the federal law mandating safeguards and making health care providers liable if they do not protect the privacy of personal medical files. Dixon said, "This is a brave new world. I'm deeply concerned that consumers aren't going to understand the harm before their information is out there." Dixon points out that after a person posts their sensitive medical history, insurance companies could then use this as justification to turn down applicants based upon risk.

Dixon rates Medical Identity Theft as the biggest risk, which the WPF describes: "When someone uses a person's name and sometimes other parts of their identity -- such as insurance information -- without the person's knowledge or consent to obtain medical services or goods, or uses the person's identity information to make false claims for medical services or goods. Medical identity theft frequently results in erroneous entries being put into existing medical records, and can involve the creation of fictitious medical records in the victim's name."

This phenomena is also not well studied, as the WPF says, "Medical identity theft is a crime that can cause great harm to its victims. Yet despite the profound risk it carries, it is the least studied and most poorly documented of the cluster of identity theft crimes. It is also the most difficult to fix after the fact, because victims have limited rights and recourses. Medical identity theft typically leaves a trail of falsified information in medical records that can plague victims' medical and financial lives for years."

Other dangers present themselves in addition to theft and security. For example, any companies running health care sites can amend or change their privacy policies at any time, without consent. And at the rapid rate of website turnover, these sites can be sold and courts could issue subpoenas that would reveal information intended to remain confidential.

The topic of online medical record archiving achieved front page status last year when Google and Microsoft indicated their interest. Google is creating a personal health record system they named "Google Health," which will be up on the Net in a few months. Microsoft, in turn is establishing its "HealthVault," which is a software system allowing users to store medical information on the Web and also transfer data from their health devices.

One method for driving revenue into the project will be to sell ads, which some analysts have called an extremely lucrative endeavor. Linked to keywords related to diseases, major pharmaceutical companies will market their marquis medications to persons suffering from maladies treated by the drugs. Much money could be made, but if the pharmaceuticals have easy access to the records, wouldn't hackers be able to find their way in, as well?

While the desire to have one's medical records is understandable, especially in the event that a person needs immediate emergency care, other options should be investigated given the inherent danger of breaches of online security. For instance, with the incredible gains in data storage in terms of small size and low price, why not create a system for persons to carry with them a copy of their medical files at all times on a keychain or around the neck?

Full post as published by IBLS Internet Law Blog on March 05, 2008 (boomark / email).