Are personal health records safe? A review of free web-accessible personal health record privacy policies

Journal of Medical Internet Research

Volumn 14, Issue 4, 2012, Pages

  Señor, Inmaculada Carrión ^a   Fernández Alemán, José Luis ^a   Toval, Ambrosio ^a  

^a UNIVERSITY OF MURCIA   (Spain)

Author keywords

Computer security; Health Insurance Portability and Accountability Act; HIPAA; Personal health records; Privacy; Standards

Indexed keywords

COMPUTER SECURITY; CONFIDENTIALITY; ELECTRONIC MEDICAL RECORD; HEALTH INSURANCE; HUMAN; INTERNET; LEGAL ASPECT; MEDICAL RECORD; REVIEW; UNITED STATES;

COMPUTER SECURITY; CONFIDENTIALITY; HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT; HEALTH RECORDS, PERSONAL; HUMANS; INTERNET; MEDICAL RECORDS SYSTEMS, COMPUTERIZED; UNITED STATES;

EID: 84872380171     PISSN: None     EISSN: 14388871     Source Type: Journal    
DOI: 10.2196/jmir.1904     Document Type: Article

References (75)

1. Liu L, Shih P, Hayes G. Barriers to the adoption and use of personal health record systems. In: Proceedings of the iConference. New York, NY: ACM; 2011 Presented at: iConference; Feb 8-11, 2011; Seattle, WA, USA p. 363-370. [doi: 10.1145/1940761.1940811]]
2. US Department of Health and Human Services, Office for Civil Rights. 2008 Dec 15. Personal Health Records and the HIPAA Privacy Rule URL: http://www.hhs.gov/ocr/privacy/hipaa/understanding/special/healthit/phrs.pdf [accessed 2011-08-05] [WebCite Cache ID 60iXgrSXM]]
3. Fernandez-Luque L, Karlsen R, Bonander J. Review of extracting information from the Social Web for health personalization. J Med Internet Res 2011 Jan;13(1):e15 [FREE Full text] [doi: 10.2196/jmir.1432] [Medline: 21278049]]
4. Tang P, Ash J, Bates D, Overhage J, Sands D. Personal health records: definitions, benefits, and strategies for overcoming barriers to adoption. J Am Med Inform Assoc 2006 Apr;13(2):121-126 [FREE Full text] [doi: 10.1197/jamia.M2025] [Medline: 16357345]]
5. Adida B, Kohane I. GenePING: secure, scalable management of personal genomic data. BMC Genomics 2006 Apr;7:93 [FREE Full text] [doi: 10.1186/1471-2164-7-93] [Medline: 16638151]]
6. Bonander J, Gates S. Public health in an era of personal health records: opportunities for innovation and new partnerships. J Med Internet Res 2010 Aug;12(3):e33 [FREE Full text] [doi: 10.2196/jmir.1346] [Medline: 20699216]]
7. Kaelber D, Jha A, Johnston D, Middleton B, Bates D. A research agenda for personal health records (PHRs). J Am Med Inform Assoc 2008 Dec;15(6):729-736 [FREE Full text] [doi: 10.1197/jamia.M2547] [Medline: 18756002]]
8. Anderson R, Brown I, Dowty T, Inglesant P, Heath W, Sasse A. Joseph Rowntree Reform Trust Ltd. 2009. Database State URL: http://www.cl.cam.ac.uk/- rja14/Papers/database-state.pdf [accessed 2011-12-02] [WebCite Cache ID 63dH8MiQ0]]
9. Connecting For Health: The Personal Health Working Group Final Report. New York, NY: Markle Foundation; 2003. URL: http://www.policyarchive.org/handle/ 10207/bitstreams/15473.pdf [accessed 2012-08-06] [WebCite Cache ID 69iJt9UgM]]
10. Liberati A, Altman D, Tetzlaff J, Mulrow C, Gøtzsche P, Ioannidis J, et al. The PRISMA statement for reporting systematic reviews and meta-analyses of studies that evaluate health care interventions: explanation and elaboration. J Clin Epidemiol 2009 Oct;62(10):e1-34. [doi: 10.1016/j.jclinepi.2009.06.006] [Medline: 19631507]]
11. Caligtan C, Dykes P. Electronic health records and personal health records. Semin Oncol Nurs 2011 Aug;27(3):218-228. [doi: 10.1016/j.soncn.2011.04. 007] [Medline: 21783013]]
12. Institute of Medicine. 2001 Mar 5. Crossing the Quality Chasm: A New Health System for the 21st Century URL: http://www.iom.edu/-/media/Files/ Report%20Files/2001/Crossing-the-Quality-Chasm/ Quality%20Chasm%202001%20%20report%20brief.pdf [accessed 2012-08-06] [WebCite Cache ID 69iPFk2Zq]]
13. Hesse B, Nelson D, Kreps G, Croyle R, Arora N, Rimer B, et al. Trust and sources of health information: the impact of the Internet and its implications for health care providers: findings from the first Health Information National Trends Survey. Arch Intern Med 2005;165(22):2618-2624. [doi: 10.1001/archinte.165.22.2618] [Medline: 16344419]]
14. Sittig D. Personal health records on the internet: a snapshot of the pioneers at the end of the 20th Century. Int J Med Inform 2002 Apr;65(1):1-6. [Medline: 11904243]]
15. Kummervold P, Chronaki C, Lausen B, Prokosch H, Rasmussen J, Santana S, et al. eHealth trends in Europe 2005-2007: a population-based survey. J Med Internet Res 2008;10(4):e42 [FREE Full text] [doi: 10.2196/jmir.1023] [Medline: 19017584]]
16. Kim M, Johnson K. Personal health records: evaluation of functionality and utility. J Am Med Inform Assoc 2002 Apr;9(2):171-180 [FREE Full text] [Medline: 11861632]]
17. Simons W, Mandl K, Kohane I. The PING personally controlled electronic medical record system: technical architecture. J Am Med Inform Assoc 2005 Feb;12(1):47-54 [FREE Full text] [doi: 10.1197/jamia.M1592] [Medline: 15492031]]
18. Ball M, Smith C, Bakalar R. Personal health records: empowering consumers. J Healthc Inf Manag 2007;21(1):76-86. [Medline: 17299929]]
19. Hulse N, Wood G, Haug P, Williams M. Deriving consumer-facing disease concepts for family health histories using multi-source sampling. J Biomed Inform 2010 Oct;43(5):716-724. [doi: 10.1016/j.jbi.2010.04.003] [Medline: 20382264]]
20. Landis J, Koch G. The measurement of observer agreement for categorical data. Biometrics 1977 Mar;33(1):159-174. [Medline: 843571]]
21. Yee G, Korba L. Personal privacy policies. In: Vacca JR, editor. Computer and Information Security Handbook. Amsterdam: Morgan Kaufmann; 2009:487-505.
22. Beldad A, Jong M, Steehouder M. Reading the least read? Indicators of users' intention to consult privacy statements on municipal websites. Gov Inf Q 2010 Jul;27(3):238-244. [doi: 10.1016/j.giq.2010.01.004]]
23. Earp J, Anton A, Aiman-Smith L, Stufflebeam W. Examining internet privacy policies within the context of user privacy values. IEEE Trans Eng Manag 2005;52(2):227. [doi: 10.1109/TEM.2005.844927]]
24. International Organization for Standardization. 2011. ISO/TS 13606-4:2009: Health informatics - Electronic Health Record Communication - Part 4: Security URL: http://www.iso.org/iso/iso-catalogue/catalogue-tc/catalogue- detail. htm?csnumber=50121 [accessed 2011-08-05] [WebCite Cache ID 60iYu0R7f]]
25. Westin A. Privacy and Freedom. London: Bodley Head; 1970.
26. Denzin N. Sociological Methods: A Sourcebook. New Brunswick, NJ: Aldine Transaction; 2006.
27. Carmines E, Zeller R. Reliability and Validity Assessment. Thousand Oaks, CA: Sage Publications; 1979.
28. Microsoft. 2012. Microsoft HealthVault URL: http://www.microsoft.com/en- us/healthvault [accessed 2011-08-05] [WebCite Cache ID 60iZtNKO9]]
29. Health Butler, LLC. 2011. HealthButler URL: http://healthbutler.com/ [accessed 2011-08-05] [WebCite Cache ID 60iZYlaTs]]
30. Google. 2011. Google Health URL: https://www.google.com/health/ [accessed 2011-08-05] [WebCite Cache ID 60ialazPN]]
31. ZebraHealth, Inc. 2011. ZebraHealth URL: https://www.zebrahealth.com/ [accessed 2011-08-05] [WebCite Cache ID 60iaQFShX]]
32. NoMoreClipboard.com. 2009. NoMoreClipBoard URL: http://www. nomoreclipboard.com/ [accessed 2011-08-05] [WebCite Cache ID 60iaC3pH9]]
33. Doclopedia. My Doclopedia PHR URL: https://www.doclopedia.com/Login.aspx [accessed 2011-08-05] [WebCite Cache ID 60iZvVD0s]]
34. HealthyCircles. 2011. HealthyCircles URL: https://www.healthycircles.com/ [accessed 2011-08-05] [WebCite Cache ID 60iZb4z21]]
35. Dr. I-Net Corp. Dr. I-Net URL: http://www.drinet.com/ [accessed 2011-08-05] [WebCite Cache ID 60iZTcn9T]]
36. What is myHealthFolders? MyHealthFolders, LLC# 2011 URL: https://myhealthfolders.com/ [accessed 2011-08-05] [WebCite Cache ID 60ia7bGZC]]
37. Keas, Inc#. 2011. Keas URL: https://keas.com/ [accessed 2011-08-05] [WebCite Cache ID 60iZjrP1e]]
38. RememberItNow! LLC. RememberItNow! URL: http://www.rememberitnow.com/ [accessed 2011-08-05] [WebCite Cache ID 60iaEGjsk]]
39. MedsFile. 2010. medsfile URL: http://www.medsfile.com/ [accessed 2011-08-05] [WebCite Cache ID 60iZrMEgp]]
40. Community Health Resource & Development Center. 2010. MiVIA URL: https://www.mivia.org/ [accessed 2011-08-05] [WebCite Cache ID 60iaMiN6d]]
41. PatientsLikeMe. 2011. PatientsLikeMe URL: http://www.patientslikeme.com/ [accessed 2011-12-02] [WebCite Cache ID 63dHNkcBq]]
42. Dr. Carr. 2011. Telemedical URL: http://www.telemedical.com/ [accessed 2011-08-05] [WebCite Cache ID 60iaKHr6W]]
43. US Department of Veterans Affairs. 2012. My HealtheVet URL: http://www.myhealth.va.gov/ [accessed 2011-08-05] [WebCite Cache ID 60iZz644p]]
44. MedicAlert Foundation. 2011. MedicAlert URL: http://www.medicalert.org/ [accessed 2011-08-05] [WebCite Cache ID 60iZmQ7p5]]
45. LifeMed Media, Inc. 2011. dLife URL: http://www.dlife.com/ [accessed 2011-08-05] [WebCite Cache ID 60iZOypVa]]
46. Toucan Health Systems, LLC. 2011. Juniper Health URL: https://juniperhealth.com/ [accessed 2011-08-05] [WebCite Cache ID 60iZhdziv]]
47. Epic Systems Corporation. 2010. MyChart URL: https://www.mychartlink.com/ mychart/ [accessed 2011-08-05] [WebCite Cache ID 60ia5GhT5]]
48. iMetrikus, Inc. 2011. MediCompass Care Coordination Platform URL: https://www.medicompass.com/mcweb/default. aspx [accessed 2011-08-05] [WebCite Cache ID 60iZoo4n3]]
49. MDGuidelines ePHR. Welcome to EmryStick. com URL: http://phr.emrystick. com/ [accessed 2011-08-05] [WebCite Cache ID 60iZVtRvV]]
50. MediConnect Global Inc. 2011. myMediConnect URL: http://www. mymediconnect.net/index.php [accessed 2011-08-05] [WebCite Cache ID 60iZKF7Qb]]
51. Medfusion. 2007. Weldome to iHealthRecord by Medfusion URL: http://medfusion.net/ihealthrecord/ [accessed 2011-08-05] [WebCite Cache ID 60iZdbCcs]]
52. TRUSTe. TRUSTe URL: http://www.truste.com/ [accessed 2011-08-05] [WebCite Cache ID 60iadtEia]]
53. Martino L, Ahuja S. Privacy policies of personal health records: an evaluation of their effectiveness in protecting patient information. In: Proceedings of the 1st ACM International Health Informatics Symposium. New York, NY, USA; 2010 Presented at: 1st ACM International Health Informatics Symposium (IHI '10); Nov 11-12, 2010; Arlington, VA, USA p. 191-200. [doi: 10.1145/1882992.1883020]]
54. Carrión I, Fernández-Alemán J, Jayne C, Palmer-Brown D, Toval A, Carrillo de Gea J. Evaluation and neuronal network-based classification of the PHRs privacy policies. In: Proceedings of the 45th Hawaii International Conference on System Sciences. 2012 Presented at: 45th Hawaii International Conference on System Sciences; Jan 4-7, 2012; Wailea, Maui, HI. USA p. 2840-2849. [doi: 10.1109/HICSS.2012.257]]
55. Official Journal of the European Communities. 2002 Jul 31. Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2001 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) URL: http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L: 2002:201:0037:0047:en:PDF [accessed 2012-02-16] [WebCite Cache ID 65VNHZNQy]]
56. Lesemann D. Once more unto the breach: an analysis of legal, technological and policy issues involving data breach notification statutes. Akron Intellect Prop J 2010;4:203-238 [FREE Full text] [WebCite Cache]]
57. Greenhalgh T, Hinder S, Stramer K, Bratan T, Russell J. Adoption, non-adoption, and abandonment of a personal electronic health record: case study of HealthSpace. BMJ 2010;341:c5814 [FREE Full text] [Medline: 21081595]]
58. van der Linden H, Kalra D, Hasman A, Talmon J. Inter-organizational future proof EHR systems. A review of the security and privacy related issues. Int J Med Inform 2009 Mar;78(3):141-160. [doi: 10.1016/j.ijmedinf.2008.06.013] [Medline: 18760661]]
59. Weitzman E, Kaci L, Mandl K. Sharing medical data for health research: the early personal health record experience. J Med Internet Res 2010;12(2):e14 [FREE Full text] [doi: 10.2196/jmir.1356] [Medline: 20501431]]
60. van't Noordende G. Security in the Dutch electronic patient record system. In: Proceedings. New York, NY, USA: ACM; 2010 Presented at: Second annual workshop on Security and Privacy in Medical and Home-Care Systems; Oct 4-8, 2010; Chicago, IL, USA p. 21-32. [doi: 10.1145/1866914.1866918]]
61. Nazi K, Hogan T, Wagner T, McInnes D, Smith B, Haggstrom D, et al. Embracing a health services research perspective on personal health records: lessons learned from the VA My HealtheVet system. J Gen Intern Med 2010 Jan;25 Suppl 1:62-67. [doi: 10.1007/s11606-009-1114-6] [Medline: 20077154]]
62. Maloney F, Wright A. USB-based Personal Health Records: an analysis of features and functionality. Int J Med Inform 2010 Feb;79(2):97-111. [doi: 10.1016/j.ijmedinf.2009.11.005] [Medline: 20053582]]
63. Yau G, Williams A, Brown J. Family physicians' perspectives on personal health records: qualitative study. Can Fam Physician 2011 May;57(5):e178-e184 [FREE Full text] [Medline: 21642732]]
64. El Emam K, Jabbouri S, Sams S, Drouet Y, Power M. Evaluating common de-identification heuristics for personal health information. J Med Internet Res 2006 Nov;8(4):e28 [FREE Full text] [doi: 10.2196/jmir.8.4.e28] [Medline: 17213047]]
65. El Emam K, Jonker E, Arbuckle L, Malin B. A systematic review of re-identification attacks on health data. PLoS One 2011;6(12):e28071 [FREE Full text] [doi: 10.1371/journal.pone.0028071] [Medline: 22164229]]
66. Sweeney L. k-Anonymity: a model for protecting privacy. Int J Uncertain Fuzziness Knowl Based Syst 2002;10(5):557-570 [FREE Full text] [doi: 10.1142/S0218488502001648]]
67. Carrión I, Fernández-Alemán J, Toval A. Usable privacy and security in personal health records. Lect Notes Comput Sci 2011;6949:36-43. [doi: 10.1007/978-3-642-23768-3-3]]
68. Greenhalgh T, Stramer K, Bratan T, Byrne E, Russell J, Hinder S, et al. The Devil's in the Detail: Final Report of the Independent Evaluation of the Summary Care Record and HealthSpace programmes. London: University College London; 2010. URL: http://www.ucl.ac.uk/news/scriesummary.pdf [accessed 2011-12-12] [WebCite Cache ID 63snHmtym]]
69. Huynh T, Miller J. An empirical investigation into open source web applications' implementation vulnerabilities. Empir Softw Eng 2010 Oct;15(5):556-576. [doi: 10.1007/s10664-010-9131-y]]
70. National Vulnerability Database. DHS National Cyber Security Division/US-CERT. CWE: Common Weakness Enumeration URL: http://nvd.nist.gov/cwe. cfm [accessed 2011-08-05] [WebCite Cache ID 60iaZ4JzW]]
71. Park M. Embedding security into visual programming courses. In: Proceedings of the Information Security Curriculum Development Conference. New York, NY, USA: ACM; 2011 Presented at: Information Security Curriculum Development Conference; Sep 30-Oct 1, 2011; Kennesaw, GA, USA p. 84-93. [doi: 10.1145/2047456.2047469]]
72. Srinivasan A. Keeping online personal records private: security and privacy considerations for Web-based PHR systems. J AHIMA 2006 Jan;77(1):62-3, 68. [Medline: 16475740]]
73. Bourgeois F, Taylor P, Emans S, Nigrin D, Mandl K. Whose personal control? Creating private, personally controlled health records for pediatric and adolescent patients. J Am Med Inform Assoc 2008 Dec;15(6):737-743 [FREE Full text] [doi: 10.1197/jamia.M2865] [Medline: 18755989]]
74. Steinbrook R. Personally controlled online health data-the next big thing in medical care? N Engl J Med 2008 Apr 17;358(16):1653-1656. [doi: 10.1056/NEJMp0801736] [Medline: 18420496]]
75. Fernández-Medina E, Piattini M. Designing secure databases. Inf Softw Technol 2005;47(7):463-477. [doi: 10.1016/j.infsof.2004.09.013]]