Medical Records and PHRs


So the question does arise as the news arrives that Wal-Mart and five other large companies are collaborating on the development of "Web-based employee personal health records": how can the employees know their records will be secure and private?

According to the Government Computer News (CGN.com) story referenced above:


Individuals will be able to maintain comprehensive and up-to-date health histories of themselves and their families, said J.D. Kleinke, CEO of the Omnimedix Institute, the nonprofit group in Portland Ore., that is developing the system.

Dossia gathers health information on behalf of the individual from various sources and stores it within secured databases. Dossia’s open architecture will support multiple personal health applications, which lets users organize and summarize their information in ways that are most useful to them.

Health records will be secure and private, accessible only by the individual or by others to whom they have granted permission. Records also will be portable, so individuals can use the records even if they change employers, health plans or doctors.

That’s all nifty and swell, but privacy rights advocates are a tad worried.

Or, as the article continues:


The Patient Privacy Rights Foundation in Austin, Texas, however, denounced the plan to store their employees’ records in a centralized data warehouse linking hospitals, doctors and pharmacies.

"This is a prescription for disaster. Will these companies guarantee that employees’ personal health information will never be used against them or disclosed without informed consent?" said Deborah Peel, founder and chairwoman of Patient Privacy Rights. . Wal-Mart Stores plans to apply market pressure and incentives to get hospitals and doctors on board and will insist that health care providers adopt electronic records and prescribing as a condition of future business, she said. . "Electronic health records are essentially a good idea. But American health consumers have said repeatedly that they do not want their employers or their insurers to have access to their records," Peel said.

I have to agree with Peel, who the article says, recommends that a "neutral third party, such as a health banking repository, should house patient data."

In other words, to have my employer store my health and medical records in a system that would allow that employer access to my record? IF I were an employee of one of the companies colloborating on Dossia, I sure would want to know who could access my files, when that person could see my files, why that person should see my files at all and how much power I have to give or take that power away.

I’ve been tooling around Google looking for articles and blogs on personal health records. Doing so, I came across this at Harvard University’s Program for Health System Improvement e-newsletter, an interview with David Lansky, Ph.D., senior director for health programs at the Markle Foundation.

Dr. Lansky is a vocal advocate for all things that will make the country’s health care system "more responsive and accountable" and he’s a big proponent of personal health records. In fact, he states in the Q&A article at the PHSI’s e-newsletter that it’s "inevitable" that PHRs "will become mainstream."

He also has a terrific definition of the differences between a personal health record and an electronic health record. He says it better than I ever could, so I quote his definition in full below:

Q: How does a personal health record differ from the electronic health record?

DL: With a PHR, the individual accesses and controls their personal health information and they decide who sees it and what is in it – including information from all sources of care as well as the patient. The EHR is a medical legal document that is under the control of and is the responsibility of a particular clinical care setting.

While PHRs are a terrific thing for patients, Dr. Lansky laments that consumers don’t yet use PHRs as they do online banking and other electronic tools that improve our lives today. Naturally, he has an opinion about what needs to happen:

Q: What are some of the barriers to PHR adoption then?

DL: Patients are more likely to use a PHR if it is recommended by their doctor – and few doctors are convinced that PHRs add value, rather than risk and burden - to the care process. And there are few standards for PHR data that would enable the patient to easily take her information to a new doctor or health plan.

Q: What will encourage uptake?

DL: The short answer is that most people, most of the time don’t want responsibility for managing all of their health information. Their information becomes much more important when they get sick and need to make complex decisions. We expect that PHRs will be more highly valued when they are able to deliver specific value to people with specific needs – like managing diabetes or caring for a parent with Alzheimer’s disease – and they will do that best when there is a national information network that allows critical information to be easily and appropriately shared wherever it’s needed.

So why should you and I care? Again, I’ll let Dr. Lansky speak for himself:

A PHR may have value even if your doctor does not use an EHR. A lot of your medical data is already available electronically and can be brought to your home computer – your medications, lab test results, diagnostic images, procedures and diagnoses. We shouldn’t delay using PHRs until all health professionals are using interoperable, connected EMRs – we’ll be waiting a long time.

 

 

 

I posted recently about my worries regarding having medical records online. My main concern: do online health records mean all the better for computer hackers to steal my personal information and run rampant with my identity and send themselves to Tahiti with my credit cards (and will they at the least send me a postcard)?

Turns out some folks in the know – folks who are privacy activists – think having an online personal health record could actually go a long way to protecting you.

The Privacy Rights Clearinghouse (PRC) has a nifty little primer on the Health Insurance Portability and Accountability Act (HIPAA), with a subfocus on HIPAA’s Privacy Rule. HIPAA was enacted by Congress in 1996 to set a national standard for the electronic transfer of health data. The Clearinghouse is none too hopeful that HIPAA will "restore your confidence that sensitive medical data is a matter between you and your doctor." Instead, according to the Clearinghouse folks:

HIPAA sets the standard for privacy in the electronic age where health industry, government, and public interests often prevail over the patient’s desire for confidentiality.

So what’s a person to do? The Clearinghouse lists several tips for ensuring your medical records remain private, including this:

Keep a personal health record. This may include copies of your medical files and other information related to your health such as diet and exercise programs. For more on keeping a personal health file, see the PRC’s Alert www.privacyrights.org/ar/keepmedfile.htm and the American Health Information Association resources on personal health files: www.myphy.com/what/index,asp.

This may include copies of your medical files and other information related to your health such as diet and exercise programs. For more on keeping a personal health file, see the PRC’s Alert  

 

 

 

Follow the first link and you’ll see that they issue a caveat:

Commercial products sold to organize and store your medical data vary from vendor to vendor. Just like paper records, data stored on your computer or a distant web site can be lost, stolen, or damaged. Electronic data — whether on your computer, a distant web site, or a data storage device — is also vulnerable to unauthorized access. If you consider purchasing one of these products, be sure to read the fine print, especially the company’s posted privacy policy. When shopping for technology, encryption is a must.

That first link includes even more tips regarding your medical privacy with a personal health record, either one paper-based or online. The list is long, so I won’t post it in its entirety here. But I will leave you with one that I never would have thought of, yet when I read it, I immediately saw how important it is and it’s something I’ll do the next time I visit my health care provider:

Exercise your HIPAA rights by ordering copies of your medical records as soon after your visit as possible.

They even provide a link to a sample letter you can use to request your medical record: http://www.privacyrights.org/Letters/medical2.htm.

I’ve mentioned in a previous post how having an online medical record would have helped my husband take care of our daughter’s school inoculations as we make the move from California to Pennsylvania. That is, IF her medical records had been online.

But we recently had a real-life experience with online medical records and, I have to say, I’m sold!

My 79-year-old mother-in-law recently had a minor stroke. Very minor. So minor that she shows no bad aftereffects of it. None. No muscle weakness. No slurring of words. No droopy mouth. No mental impairment. It’s as if she never had it.

She spent two nights in the hospital while the health care professionals there gave her several tests — an MRI, cholesterol, blood pressure, checked her carotid artery and several others, so many that I don’t remember all of them.

Her regular physician is a member of the hospital’s staff and as she entered the ER, both her physician and the emergency room staff were able to call up her records — her personal doc from his off-site clinic, and the ER workers at the ER itself.

They were able to write notes about her care, which her regular physician read a few minutes or hours later. He also made comments, which the nurses and staff at the hospital could access at their convenience.

No waiting on the phone for the doc to come so that he could be read the results. No phoning back and forth. No driving to the clinic or hospital to get notes. It was all there, online.

 What a convenience. What a help. What a Godsend.

Don’t get me wrong, I’ve really taken a shine to my online personal health record. It’s convenient. It’s easy. There’s little I can say bad about it. In fact, there’s really nothing bad I can say about it.

Except……

I must admit, I am worried. I hear more and more about how our health care system is going to go online and electronic with our medical records. Even our government has plans to go with online records, and is planning on having a Nationwide Health Information Network, a system that will connect all patients’ records to health care providers, insurance companies, pharmacies and laboratories electronically. The goal is to have it up and running by 2014.

But that worries me. As we’ve gone electronic and online with so much of personal information – our banking, our shopping, our Netflix preferences – I also hear more and more of breaches of online security systems.

As  one example, just this past May the records of as many as 26.5 million veterans had their names, birthdates, social security numbers, and their disability records stolen from the home of a Department of Veteran Affairs employee.

This makes me very nervous. Oh, so nervous.

The solution, of course, is better systems with better security. And the folks who provide this security will have to upgrade their systems constantly, always trying to stay ahead of the hackers and thieves who seemingly have little better to do than work to overide security and "get in."

Three gentleman in Massachusetts – two of them from Children’s Hospital in Boston and the other from the Massachusetts Institute of Technology – have a nice report in the BMJ online and they say this:

Computerized medical information systems are at the start of what promises to be a rapid evolution. We are still in a position to look ahead and consider the promise and pitfalls of such systems as we design and deploy them. We need not feel wedded to the structure and processes of current systems. …

In order for electronic medical records to eliminate the fragmentation of health information, be universally accessible, and guard patients’ privacy, systems must be built according to public standards and controlled by patients. 

 

Still, I’m nervous. Online systems are built by humans and can never be perfectly secure. Someone, somewhere will take it upon himself to hack in.

Or as one women, commenting on that same BMJ article, put it so well regarding the conundrum between the ease and efficacy of online records and their inherent risk to patient privacy::

Here is my dilemma. I want my notes to be strictly confidential but readily accessible to those who will need them. Electronic notes….set alarm bells ringing…. I am not a technophobe, but I am wary of giving out personal financial information over the internet, and the thought of my entire medical history floating somewhere in cyberspace doesn’t fill me with confidence. Perhaps I have seen too many films about ingenious hackers.

I’ve seen those films too. Nervous I am. Nervous.

 

So I was Google-ing some other blogs to see if anyone else writes about personal health records and I came across this one by Aniruddha Malpani, MD, an IVF specialist who happens to practice in India. He’s described on the blog – where he’s actually a guest blogger; the blog where this post is located is not his – as an “ardent patient advocate.”

That’s putting it mildly.

Dr. Malpani believes patients should be the one to own and control who has access to their medical records. Period.

What’s more, he’s passionate that patients should own and control their medical records via interactive (or online) personal health records.

He writes:

The reason the healthcare system today is sick is because it is so doctor-centric. The best way to heal the system is by putting patients at the center of it; and the most efficient way of doing this is by allowing patients to own their PHR - personal health records. The web allows us to provide everyone with a free PHR; and this is a major business opportunity, as healthcare undergoes a dramatic change over the next few years. PHRs are likely to be a major catalyst , because they will allow patients more control over the healthcare they receive. Patients are the largest untapped healthcare resource and armed with a PHR, they won’t feel so powerless any more !

Can you hear my heartbeat pick up its pace? I’m falling for this guy. He continues.

For example, let’s see how much better a visit to your doctor could be if you had an online PHR.

One day before your appointment, you receive an automatic email reminder. You review your personal health records on the internet, and take a printout which summarizes your past medical history and your medications. An intelligent program on the site asks you questions related to your headaches, which you can review and answer. It also guides you about what questions you need to ask your doctor, and you can print these out to take with you to your doctor. It also provides you with more information about headaches and self-management options.

 

I’m going to the get the vapors in a minute! Speak to me the words I long to hear, Dr. Malpani!

And so he does:

…. [I}deally the health record should be the patient’s story – from the patient’s point of view ! A patient-owned health record (which includes the patient’s personal views and social background as well) can enable a true partnership and collaboration between patient and doctor.  

 

 

I tell you, I’m swooning:

How can we get enough patients to keep a PHR? We need to provide them clever incentives to do so ! We can use either a top-down approach ( for example, health insurance plans can require their subscribers to keep PHRs ; and provide a discount for those who do so faithfully ); or a bottom-up approach – by creating communities of empowered patients.

There’s a lot more to this post, a lot that makes a ton of sense. I hope he’s sent this letter to ’s legislators. To CEOs of HMOs. To the deans at Harvard and Stanford medical schools, et al.

There’s a , a lot that makes a ton of sense. I hope he’s sent this letter to ’s legislators. To CEOs of HMOs. To the deans at Harvard and Stanford medical schools, et al.

 

 Sending you tons of blog love, Dr. Malpani. Ooodles of love.

Kisses,
Jean

There’s a , a lot that makes a ton of sense. I hope he’s sent this letter to ’s legislators. To CEOs of HMOs. To the deans at Harvard and Stanford medical schools, et al.

 

There’s a , a lot that makes a ton of sense. I hope he’s sent this letter to ’s legislators. To CEOs of HMOs. To the deans at Harvard and Stanford medical schools, et al.

 

Christmas IS coming. As I write this, it’s late September and I’m telling myself I should start a list of ideas for Christmas gifts for my family and friends.


Meanwhile, my parents are in their late 70s, their health is declining and my sister and I have stepped up our visits and questions and overall concern for them. We’re also getting more involved in their care and, as they tell me of their numerous visits to doctors and clinics (“Our new hobby,” my mother quips), I’ve come to the decision I need to get all the names of all their care providers, all the drugs they are taking and their dosing schedule. In other words, I should start a Personal Health Record for both of them.

Each time they visit a doctor, I can update the online PHR I create for them. I can then keep this for myself, of course, but I could also print it out regularly and mail it to my sister and to them. That way, everyone will be up to date. Everyone will know the last time my mother went to her dermatologist, my father’s last dental check up and his visits to his neurologist. And it will be in a form neat and tidy, legible and organized.

This truly would be a great gift for all of us. Yes, it’s not shiny nor is it cuddly. It doesn’t tell time, play a favorite movie on DVD or keep feet warm at night in slippers made of fleece.

But it would give all of us peace of mind. My parents live near San Diego, California . My sister lives in Arizona and while I now live two hours away from my parents via a crowded freeway, my husband and I are moving to Pennsylvania soon. It’s already hard to keep track of all their appointments and physicians, not to mention their drug therapies.

While I could print out a copy for my parents – neither of them is computer-savvy – I could give my sister access to the online personal health record I create and update. She also could update information. When my sister and I chat on the phone, we could access the records online as we speak to look them over and discuss as needed.

I’m going to start doing this very soon – creating personal health records for my mother and father – and will post here as I do so to let you know of the challenges and opportunities inherent in creating PHRs for elderly family members.

 

 

 

 

 

 

 

 

 

 

So let’s say I’ve decided I really, truly do need to take control of my health care and as a first step I’m going to start my own personal health record. I really DO want to become a partner with my health care provider in taking care of myself. No more letting my doc look over a chart – one I can’t see while she’s reading it; for all I know she’s looking at photos of Brad Pitt, that’s why she smiling – while I sit patiently in my paper gown on the examining table waiting for her all-knowing pronouncement. Nope, next time I will look with her at my health record on a small computer screen perched on the little table or counter that’s always by the sink across from the examining table. I’ll see the notes I made two days before regarding my attempt to get my overall cholesterol down and I’ll see the notes the nurse just put there after she took my blood pressure, heart rate and weight before she ushered me into the examining room. I’ll be able to see that because I’ll have a PHR, one tied to my written medical record. But I didn’t necessarily start that PHR. Nope. When I wrote this post’s first paragraph “So let’s say I’ve decided …” I didn’t mean I was going to start a PHR from scratch. I meant I was going to access one my doctor started for me – it’s my medical record online, with a section I can access and to which I can add information. If, as several PHR pundits have noted, the main “problem” with getting consumers hip to the idea of starting a PHR is the very fact that we in the U.S. abhor doing anything that smacks of tedium (Known allergies? Penicillin. Have you ever been diagnosed with… Ooo, look, I need to do the dishes!), why not have my doc or someone else do it? That is, my health record already exists – I had to fill out a few forms at my doc’s office when I first visited and she and her staff have been adding to it each time I stop by – why not meld that record into one I can access and add to, as well? Surely this is doable? Perhaps not now, but soon? Online medical records are a big thing for people whose job it is to manage these things. Already some physicians have their patients’ records online (I had a doc once walk into the examining room carrying a laptop instead of a clipboard). Can we take it a step further and allow consumers access to that record? Of course, I can already hear the treble cries rise from those who worry about security issues, as well they should. But surely we can create a secure online medical record that’s accessible to both health care professionals and the very patient whose medical history is written in that record? I’m sure others have already thought of this idea; I’m certainly no genius. But it seems to me if a huge challenge in getting people to start a PHR is just that — getting people to start a PHR – why not have one already started for them?

On Saturday, I wrote about how having a personal health record for my daughter would have made just one small aspect of our pending move across the country easier as my husband worked to get our daughter’s inoculations up to date:

….had we had an online PHR for our daughter, and had that PHR been accessible to both our HMO and the new pediatrician, this wouldn’t have been a problem. Once we’d given permission for the new doctor to look at our daughter’s records, she could have done so – possibly as soon as that very day. The primary phrase above is "had that PHR been accessible to both our HMO and the new pediatrician…" Having an online personal health record would have done us no good if our new pediatrician didn’t look at our PHR as she would a traditional medical record. That is, if she knew the PHR was our creation and the information in it was NOT placed there by our HMO’s physician, it might not be "legit" in her eyes and she could still have insisted on seeing the "real" medical record sent via the U.S. Postal Service from our current HMO.So what’s the solution? An online PHR created by me or by my physician, with access available to both of us and where entries we each make are identified to each of our selves. My daughter’s physician(s) and I would update the PHR throughout the course of my daughter’s life, noting any treatments, diagnoses, surgeries and other care she receives. If I were a physician, perhaps I’d take a patient’s own PHR more seriously if I could tell which parts of it were put there by another doctor and which were written by someone else — a concerned parent, spouse or the patient herself. I’m new to the world of personal health records, so I don’t know how far along such PHRs or interactive online medical records might be. I’m going to research this topic more – after all, such an online document/tool could revolutionize health care as we know it. Instead of coming to a physician’s office and sitting passively by as he or she reads my records and makes notes, we could instead both read my record on a laptop or other computer portal as we discuss past and future treatment options.