Privacy group sounds alarms over personal health records systems
Medical data stored online may fall outside of HIPAA's privacy protections, report claimsFebruary 20, 2008 (Computerworld) In some cases, people whose health care information is stored in online personal health records (PHR) systems may be exposed to serious data privacy risks, according to a warning issued by a privacy advocacy group.
That's because not all PHR systems are covered by the federal Health Insurance Portability and Accountability Act, the World Privacy Forum said in a 16-page report released today (download PDF). The WPF contended that as a result, many of the privacy protections offered under the HIPAA statute don't apply to the personal health care data being maintained in such systems.
PHR systems typically store medical records gathered from a variety of sources, including health care providers, insurers and patients themselves. The information is made accessible via the Web to individuals and to others who they have authorized to view the data. "As a new type of convenience technology for consumers, PHRs are promoted as giving consumers more knowledge and an opportunity to be more actively engaged in their own health care," the San Diego-based WPF noted in its report.
But people need to be aware that the systems may fall outside of HIPAA's protective umbrella, said Pam Dixon, the group's executive director. The HIPAA privacy rules cover health plans, doctors, hospitals, clinics, nursing homes and even researchers working with medical data collected from those entities, she said. But commercial PHR systems maintained by IT vendors or services providers and supported by means such as advertising may not come under HIPAA's purview, according to Dixon.
http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9063718&intsrc=hm_list
Printer-friendly format
Email this thread to a friend
Bookmark this thread
(1000+ posts)
Send PM |
Profile |
Ignore
