Don't bet on knowing your records' whereabouts

Do you know where your electronic health information is tonight?

Here's a reader challenge: I'll pay $10 to the first adult who has had at least five encounters with the private-sector healthcare system in the past 10 years to come up with a complete map of where all his or her electronic health records have traveled, who has seen them and where they are now.

I feel my money is safe in my pocket, and here's why:

First, I've been covering health IT for nearly 11 years, and there is no system I know in this country that can completely track the whereabouts of someone's electronic health information.

Second, there are no laws or incentives to induce complete tracking of a patient's records.

And yet, patients ought to have access to just such a record map, according to health IT and privacy experts participating in the first Health Privacy Summit Monday in Washington. The daylong conference was put together by Patient Privacy Rights and the Lyndon B. Johnson School of Public Affairs at the University of Texas, Austin.

Steve Steppensen of the Telemedicine and Advanced Technology Research Center, a U.S. Defense Department medical informatics research center, moderated a session at the privacy summit. Steppensen said his group's consensus was that a so-called individual "data map" should be available on request. Such a map is "foundational . . . for us to even know what's needed" in terms of policy and technology to protect patient privacy, Steppensen said.

Another data map advocate was Michelle De Mooy, senior associate for national priorities at Consumer Action, a San Francisco-based consumer rights organization.

"Any eyes on the record should be noted," De Mooy said. "We hear a lot from people who have suffered medical identity theft and discrimination. These are not things that are in the far-off future. They are happening right now."

Fellow panelist Joy Pritts, chief privacy officer with HHS' Office of the National Coordinator for Health Information Technology, suggested that the proposed rule HHS' Office for Civil Rights released last month on an accounting for disclosures is a good place to start.

And she's right, as far as it goes, but that rule specifically exempts from the disclosure requirement transfers of data for research as well as a host of other purposes.

In other words, the proposed new disclosures rule closes some loopholes and opens others.

It also provides no technical mechanism for monitoring and reporting back data locations as a person's medical records flit about the electronic-records ecosystem.

And although the President's Council of Advisors on Science and Technology, or PCAST, suggested a possible method of tagging and tracking data, we're a long way from even adopting the PCAST recommendations as public policy, much less implementing the technology.

Still, I predict this idea of data mapping isn't going to go away.

For now, though, I think my money is safe in my pocket.

Follow Joseph Conn on Twitter: @MHJConn.



Loading Comments Loading comments...