One size doesn't fit all

Journal of Legal Medicine

Volumn 30, Issue 2, 2009, Pages 269-287

  Rakestraw, Eric ^a  

^a SOUTHERN ILLINOIS UNIVERSITY   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

ELECTRONIC MEDICAL RECORD; HEALTH CARE ACCESS; HEALTH CARE POLICY; HEALTH CARE QUALITY; HEALTH INSURANCE; INFORMED CONSENT; INTERNET; MEDICAL INFORMATION; PRIVACY; REVIEW; SOCIAL SECURITY;

HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT; HUMANS; MEDICAL RECORDS SYSTEMS, COMPUTERIZED; UNITED STATES;

EID: 67651151322     PISSN: 01947648     EISSN: 1521057X     Source Type: Journal    
DOI: 10.1080/01947640902936597     Document Type: Review

References (121)

1. Although Mr. Johnson is fictional, his situation highlights common problems faced by patients who could benefit from an electronic PHR. See generally Google Health Tour, available at http://www. google.com/intl/en-US/health/tour/index.html (last visited Feb. 17, 2009).
2. Google Health's senior counsel summarized the issue succinctly: "Google Health is not regulated by HIPAA because Google does not provide health care services." Posting of Mike Yang to Google Public Policy Blog: Google Health, privacy and HIPAA, available at http://googlepublicpolicy. blogspot.com/2008/05/google-health-privacy-and-hipaa.html (last visited Feb. 17, 2009).
3. See Google Health and HIPAA, available at http://www.google.com/intl/en-us/health/hipaa.html (last visited Feb. 17, 2009).
4. - 87 AM. JUR. 3D Proof of Facts 259 § 4 (2008).
5. - 1 HARVEY L. MCCORMICK, MEDICARE AND MEDICAID CLAIMS AND PROC. § 1:122 (4th ed. 2008).
6. Id.
7. Id.
8. - 87 AM. JUR. 3D Proof of Facts 259 § 4 (2008).
9. -45 C.F.R. §§ 164.502(b) & 164.514(d) (2009).
10. - 45 C.F.R. § 160.103 (2009).
11. See OFFICE OF CIVIL RIGHTS, UNITED STATES DEP'T HEALTH AND HUMAN SERVICES, SUMMARY OF THE HIPAA PRIVACY RULE 4-9 (2003), available at www.hhs.gov/ocr/privacy/hipaa/ understanding/ summary/privacysummary.pdf (last visited Feb. 17, 2009).
12. - 45 C.F.R. §§ 164.502(b) & 164.514(d) (2009).
13. - 45 C.F.R. § 164.502(a) (2009).
14. The Privacy Rule applies only to disclosures by covered entities; patients are free to disclose their own personal health information without restriction. See 45 C.F.R. § 160.103 (2009).
15. About Google Health, available at http://www.google.com/intl/en- US/health/about/index.html (last visited Feb. 17, 2008).
16. Google Health Frequently Asked Questions, available at http://www.google.com/intl/en-US/health/faq.html (#2) (last visited Feb. 17, 2009) ("And remember that Google stores your information safely and securely.").
17. About Google Health, supra note 15; see also Google Health Tour, supra note 1.
18. Google Health Tour, supra note 1.
19. See Steven Levy, Web Surfer, Heal Thyself, NEWSWEEK, Mar. 3, 2008, at 16.
20. Ivor Tossell, Who's Tracking Your Health? Paging Dr. Internet, TORONTO GLOBE & MAIL, May 23, 2008, at R18.
21. Erik Goldman, Google, Microsoft Vie to Lead Health IT Change, FAM. PRAC. NEWS, July 15, 2008, at 49.
22. Id. In addition, some experts have argued that paper records are more conducive to tampering than electronic ones. See Jefferson Graham, Prognosis Is Bright for Google's Health Records Plan, USA TODAY, Feb. 29, 2008, at 1B.
23. Erik Goldman, Google, Microsoft Launch Personal Health Record Systems (Practice Trends), INTERNAL MED. NEWS, July 15, 2008, at 49.
24. See, e.g., Goldman, supra note 21;
25. Tossell, supra note 20.
26. See, e.g., Goldman, supra note 23.
27. Id.
28. See id.
29. See id.
30. See Tossell, supra note 20.
31. See Levy, supra note 19;
32. Tossell, supra note 20.
33. Walgreens Partners with Google to Provide Pharmacy Patients Access to Their Prescription History Through Google Health, DRUG WK., June 6, 2008, at 2810.
34. Levy, supra note 19 ("'When doctors have all the information related to a patient, they make better decisions,' says the Cleveland Clinic's Harris.").
35. See Tossell, supra note 20.
36. See Goldman, supra note 23.
37. See Goldman, supra note 21.
38. Goldman, supra note 23.
39. See Patrick O'Donnell & John Horton, Is Google Good for Your Health Records?, CLEV. PLAIN DEALER, June 3, 2008, at E1.
40. See, e.g., Goldman, supra note 23.
41. Michael Liedtke, Associated Press, Google Testing Storage of Medical Records Online, ST. LOUIS POST-DISPATCH, Feb. 22, 2008, at B3.
42. See Goldman, supra note 23.
43. See Walgreens Partners with Google, supra note 31.
44. Goldman, supra note 23.
45. Id.
46. Id.
47. See id.
48. Id.
49. See id.
50. See Goldman, supra note 23.
51. See Levy, supra note 19.
52. -45 C.F.R. § 160.103 (2009).
53. Id.
54. See id.
55. Id.
56. Id.; see also 87 AM. JUR. 3D Proof of Facts 259 §5 (2008).
57. -45 C.F.R. § 160.103 (2009).
58. Id. Examples of clearinghouses include billing services and "value added" networks and switches that are typically utilized by covered entities.
59. - 87 AM. JUR. 3D Proof of Facts 259 § 6 (2008).
60. See 45 C.F.R. §160.103 (2009).
61. Id.; see also 87 AM. JUR. 3D Proof of Facts 259 § 6 (2008).
62. -87 AM. JUR. 3D Proof of Facts 259 § 6 (2008).
63. -45 C.F.R. §160.103 (2009).
64. Levy, supra note 19.
65. ROBERT GELLMAN, THE WORLD PRIVACY FORUM, PERSONAL HEALTH RECORDS: WHY MANY PHRs THREATEN PRIVACY 4 (2008), available at http://www.worldprivacyforum.org/ pdf/WPF-PHR-02-20-2008fs.pdf (last visited Feb. 17, 2009).
66. Id. at 3.
67. Levy, supra note 19 (quoting Robert Gellman, author of a World Privacy Forum study on the subject).
68. See id.
69. See id.
70. Id.
71. See generally 45 AM. JUR. 2D Proof of Facts 595 § 5 (2008).
72. See id. § 6.
73. Because PHRs are a relatively new phenomenon, this precise question has not yet been litigated. However, most commentators agree that the privilege is waived when formerly protected records are shared with a PHR. See, e.g., GELLMAN, supra note 63, at 5.
74. Liedtke, supra note 39.
75. See, e.g., GELLMAN, supra note 63, at 5.
76. Id. at 6.
77. Id.
78. Id.
79. See id. at 7.
80. See generally SUMMARY OF THE HIPAA PRIVACY RULE, supra note 11, at 4-9; see also GELLMAN, supra note 63, at 7.
81. See GELLMAN, supra note 63, at 7.
82. See id.
83. See id.
84. See id.
85. See id.
86. See id.
87. See id.
88. See id. at 8. To find out, the companies may offer coupons for free or discounted medicine that requires consumers to provide names and addresses. Companies may offer magazines for people who have a particular disease. They may have toll-free numbers for people to call. Companies may also use websites to obtain the names and survey information from consumers.
89. For example, an advertiser might wish to market birth-control products and request that Google only show the ads to women. On its face, this would not violate the privacy policy, because Google can target the ads without sharing any of its data directly with the advertiser. The problem is that, if the targeting is successful, the advertiser can deduce that anyone referred to its site via one of those advertisements must be female. For further discussion, see id.
90. See id.
91. See id.
92. See, e.g., Liedtke, supra note 39.
93. Id.
94. Scott Anderson & T. Evan Schaeffer, Letter to the Editor, Inevitable Advertising, Privacy Issues Make Google Health a Bad Prescription, ST. LOUIS POST-DISPATCH, Mar. 19, 2008, at B3.
95. Id.
96. Id.
97. Graham, supra note 22.
98. See, e.g., id.
99. Id.
100. See Liedtke, supra note 39. For an example of a new service without ads, see, e.g., Google Scholar, available at http://scholar.google.com/ (last visited Nov. 26, 2008).
101. Liedtke, supra note 39.
102. Goldman, supra note 23.
103. Id.
104. See 45 C.F.R. §164.506 (2009) ("A covered entity may disclose protected health information to another covered entity or a health care provider for the payment activities of the entity that receives the information.").
105. See generally 45 C.F.R. §164.502 (2009).
106. For an early example of the FTC sanctioning an Internet corporation for violation of its privacy policy, see In the Matter of GeoCities, 127 F.T.C. 94 (1999). For background on treating breach of a privacy policy as a breach of contract, see Scott Killingsworth, Minding Your Own Business: Privacy Policies in Principle and in Practice, 7 J. INTELL. PROP. L. 57, 91 (1999) ("It is no stretch to regard the policy as an offer to treat information in specified ways, inviting the user's acceptance, evidenced by using the site or submitting the information.").
107. Killingsworth, supra note 104.
108. This is true not only for electronic PHRs, but for Internet businesses in general. See id. ("Just as having no privacy policy can be a handicap, claiming the high ground with a conspicuously consumer-friendly policy can confer competitive benefits.").
109. See, e.g., Posting of Marissa Mayer to Official Google Blog, Google Health: A First Look, available at http://googleblog.blogspot.com/ 2008/02/google-health-first-look.html (last visited Feb. 17, 2009) ("Google Health will protect the privacy of your health information by giving you complete control over your data.");
110. see also Google Health Home: Welcome to Google Health, available at http://www.google.com/health (last visited Nov. 1, 2008) ("We will never sell your data. You are in control.").
111. See generally 45 C.F.R. §164.502 (2009) ("A covered entity may not use or disclose protected health information, except as permitted or required by this subpart.").
112. Id.
113. For example, a search for "migraines" produces a number of targeted advertisements promising migraine cures, appearing both above the standard search results and along the right side of the page. See, e.g., migraines - Google Search, available at http://www.google.com/search?hl= en&q=migraines &btnG=Search (last visited Feb. 17, 2009).
114. Entities covered under the Security Rule are the same as those covered under the Privacy Rule and other HIPAA provisions. See generally 45 C.F.R. § 160.103 (2009).
115. Google Health and HIPAA, supra note 3.
116. See, e.g., About Google Health, supra note 15 ("We store your information securely and privately")
117. See Levy, supra note 19.
118. See generally Google Checkout Tour, available at https://checkout.google.com/buyer/tour.html (last visited Feb. 17, 2009).
119. - 45 AM. JUR. 2D Proof of Facts 595 § 2 (2008).
120. Id.
121. Id. ("[A]s adopted by the states, the exceptions are so numerous 'as to leave little if any basis for the privilege."').