New Ways To Manage Health Data
Giants Join the Push To Put Records Online

By Michael S. Gerber
Special to The Washington Post
Tuesday, March 11, 2008

You already bank online and use computer software to do your taxes. So why don't you trust technology to help you manage your health? Microsoft, Google and more than 100 Web sites offering personal health records know the answer, but they're betting they can quell your fears about posting your most private information online and get you to sign on soon.

Online personal health records, or PHRs, began years ago as password-protected templates for storing basic medical information, accessible from any computer connected to the Web. Some still function that way, making them a convenience for patients with chronic conditions, life-threatening allergies and long medication lists. Many experts also recommend PHRs for adult caregivers of elderly family members or parents of children with chronic health problems.

"I think [they] can be very valuable for people who want to keep close track and have portable -- available for them when they need it -- detailed medical records," said Peter Basch, a Washington physician and medical director of MedStar's e-health initiative.

Many PHRs automatically link to hospital Web sites; some upload data from lab tests and medical devices; and others allow emergency rooms to access your medical history even if you're unconscious and far from home.

Lately, Internet giants Microsoft and Google have upped the ante, developing sites that combine PHRs with search engines and other services. (See sidebar.) The new capabilities raise the value of PHRs -- as well as the risk from breaches of privacy. And as the records sites grow in number and sophistication, privacy advocates are stepping up their warnings, especially about PHRs offered by health insurers.

"There are many, many pitfalls about personal health records," said Texas psychiatrist Deborah Peel, founder of Patient Privacy Rights, a nonprofit that wants Americans to retain exclusive control over their medical records. "Giving more information about yourself to your health insurer is probably the worst possible thing to do." Many online PHR firms share information with data-mining companies, which then sell it to insurers and other interested parties, Peel said.

Still, some feel the value of PHRs outweighs the risks. Andy De became a PHR user after doctors in India delayed his father's heart surgery for days last August while De tried to track down records of treatment the older man had received for a related condition during a recent U.S. visit. (De, a marketing executive for a software firm, lives in Dallas; his father lives in India.)

"My father ran the risk of losing his life . . . because of our lack of access to his previous health info," De explained by e-mail. "I promised myself that this [kind of thing] would never happen again," De wrote on his Web site.

Most online PHR systems allow you and others you designate (family members or doctors) to access the record. Patients who see many doctors and keep their PHR up-to-date can log in at a doctor's office and see what medications and tests were ordered by other physicians. In an emergency, a family member or physician could access the PHR and provide the information to emergency room staff.

A more sophisticated option, launched last year, is Microsoft's HealthVault, which is partnering with hospitals to allow patients' lab results or EKGs to be automatically uploaded to their PHR. Other sites have launched ventures to incorporate readings from, say, home blood pressure monitors and glucometers into a patient's online record.

Microsoft has also partnered with ActiveHealth Management, whose software combines personal health information with medical research it regularly updates by scouring peer-reviewed journals. The program looks at information entered by the patient and at other data, such as the patient's insurance claims; it can then alert the patient and his doctor to risks such as possibly dangerous interactions between medications the patient is taking.

ActiveHealth Management, which was purchased in 2005 by Aetna, contracts with employers and insurance companies.

Online PHRs are not covered by the Health Insurance Portability and Accountability Act, which protects the privacy of an individual's medical information. And courts have yet to settle many legal issues surrounding the Internet and privacy. So most experts advise online PHR users to read Web site privacy policies carefully. But they differ on just how much trust consumers should place in them.

"I think it is unrealistic to be comfortable or feel secure about the privacy of things that are on the Internet," said Sidney Wolfe, director of Public Citizen's Health Research Group. Even if an Internet-based PHR has a strong privacy policy and secure technology, an employee of the company could still steal information and sell it to insurers or employers, who could potentially use it to discontinue health coverage or fire a worker, Wolfe warns.

But other experts say the benefits of online PHRs far outweigh the risks. University of North Carolina researcher Gary Marchioni, who has studied online PHRs, says fears about the risks on secure sites are overblown.

"I think [people's assessment] depends on their level of paranoia," he said. "It still sort of boils down to how much trust you have in the world."

Patient Privacy Rights plans to rate the privacy and security policies of a number of PHR systems later this year.

Among experts, Microsoft earns generally high marks for its promise not to divulge information without a user's say-so. HealthVault lets patients search for health information without leaving the site -- so other sites cannot access users' Internet protocol addresses and other identifying data, Peel says. And before connecting a patient to a partner's or an advertiser's site, it posts that site's privacy policy.

"We think that's pretty cool," Peel said. "There's nothing else like it, as far as we know."

Experts familiar with Google's new PHR say the company has also set a stringent privacy policy. Google Health (now undergoing a trial by patients at the Cleveland Clinic) will not be linked to advertising, unlike Google's e-mail and search engines.

"I'm pretty confident that at least these big, well-known sponsors will be responsible," John Rother, director of policy and strategy for AARP said of Microsoft and Google.

Besides security, "data liquidity" may be a key new test of a PHR's value. The most important thing to look at is whether "I can get the information from the health plan and from the laboratory and from the other doctors, and can I assemble it" in a way that is useful and easy to access, says David Kibbe, a North Carolina family practice doctor and expert on medicine and technology. "We think there's a lot of good that can come from this data liquidity," Kibbe says.

For users who don't trust even the most secure and private online personal health records, there are options. CapMed, for example, offers a PHR on CD or on an encrypted, password-protected USB thumb drive. Users can store information digitally but can access the record only on their home computer or via the thumb drive. Patients can take the CD or thumb drive to their physician's office or print out the record at home and carry a paper copy. But, just as with your old paper records, if you forget and leave them at home, you're out of luck.

Michael S. Gerber is a Washington area freelance writer.

View all comments that have been posted about this article.

© 2008 The Washington Post Company