[Med-privacy] MS/Google

[peter marshall]

The New York Times
April 17, 2008
Warning on Storage of Health Records
By STEVE LOHR

In an article in The New England Journal of Medicine, two leading=20
researchers warn that the entry of big companies like Microsoft and=20
Google into the field of personal health records could drastically=20
alter the practice of clinical research and raise new challenges to the=20=

privacy of patient records.

The authors, Dr. Kenneth D. Mandl and Dr. Isaac S. Kohane, are longtime=20=

proponents of the benefits of electronic patient records to improve=20
care and help individuals make smarter health decisions.

But their concern, stated in the article published Wednesday and in an=20=

interview, is that the medical profession and policy makers have not=20
begun to grapple with the implications of companies like Microsoft and=20=

Google becoming the hosts for vast stores of patient information.

The arrival of these new corporate entrants, the authors write,=20
promises to bring =93a seismic change=94 in the control and stewardship =
of=20
patient information.

Today, most patient records remain within the health system =97 in=20
doctors=92 offices, hospitals, clinics, health maintenance organizations=20=

and pharmacy networks. Federal regulations govern how personal=20
information can be shared among health institutions and insurers, and=20
the rules restrict how such information can be mined for medical=20
research. One requirement is that researchers have no access to=20
individual patients=92 identities.

Under the current system, individuals can request their own health=20
records, but it is often a cumbersome process because information is=20
scattered across several institutions.

As part of a push toward greater individual control of health=20
information, Microsoft and Google have recently begun offering=20
Web-based personal health records. The journal article=92s authors=20
describe a new =93personalized, health information economy=94 in which=20=

consumers tell physicians, hospitals and other providers what=20
information to send into their personal records, stored by Microsoft or=20=

Google. It is the individual who decides with whom to share that=20
information and under what terms.

But Microsoft and Google, the authors note, are not bound by the=20
privacy restrictions of the Health Insurance Portability and=20
Accountability Act, or Hipaa, the main law that regulates personal data=20=

handling and patient privacy. Hipaa, enacted in 1996, did not=20
anticipate Web-based health records systems like the ones Microsoft and=20=

Google now offer.

The authors say that consumer control of personal data under the new,=20
unregulated Web systems could open the door to all kinds of marketing=20
and false advertising from parties eager for valuable patient=20
information.

Despite their warnings, Dr. Mandl and Dr. Kohane are enthusiastic about=20=

the potential benefits of Web-based personal health records, including=20=

a patient population of better-informed, more personally responsible=20
health consumers.

=93In very short order, a few large companies could hold larger patient=20=

databases than any clinical research center anywhere,=94 Dr. Mandl said=20=

in an interview.

But the authors see a need for safeguards, suggesting a mixture of=20
federal regulation =97 perhaps extending Hipaa to online patient record=20=

hosts =97 contract relationships, certification standards and consumer=20=

education programs.

=93I=92m a great believer in patient autonomy in general, but there is=20=

going to have to be some measure of limited paternalism,=94 Dr. Kohane=20=

said in an interview.

Peter Neupert, the vice president in charge of Microsoft=92s health=20
group, said that he admired the authors and that they raised some=20
important issues. But he resisted the suggestion of extending Hipaa to=20=

newcomers like Microsoft and Google.

=93Philosophically and politically, I am skeptical of the concept of=20
paternalism,=94 Mr. Neupert said in an e-mail response to the article,=20=

which he was sent, and to the authors=92 comments. =93It never turns out =
to=20
be =91limited.=92 =94

Designing a health records system that clearly informs consumers and=20
requires their consent for data use is the better approach, Mr. Neupert=20=

said.

=93We have to earn the consumer=92s trust for our brand,=94 he said. =93So=
 I=20
can imagine a scenario where we have a third party verify that our=20
system works the way we assert it does,=94 much as an auditor reviews a=20=

company=92s financial reporting.

Dr. Mandl and Dr. Kohane are physicians and researchers at Children=92s=20=

Hospital Boston, the primary pediatric teaching hospital of the Harvard=20=

Medical School.


Copyright 2008 The New York Times Company

 =20
   =20=