The biggest surprise for me this week was learning that Microsoft and Google in their PHR efforts, are not "Covered entities" in terms of adhering to HIPAA privacy rules. See in their own words .
What? Sun just turned down an RFP from a PHR vendor for hosting their PHR service to general public in the US market. Our concerns were being a covered entity and be able to justify the cost of ensuring confidentiality. So, how did Google and Micro$oft escape this?
The answer in their own words: "We store data on behalf of health care providers. Instead, our primary relationship is with the user."
Hmm. It reminds me of the situation in California where one motorist was pulled over for using his cell phone while driving. He wanted to escape citation by claiming that he was just texting and not talking on the phone which is against the law!.
So, what is in it for Google and M$? The answer is simple. In the near future, whoever ends up owning your medical record is going to sit on a mountain of new business opportunity. The business opportunities range from targeted advertisement to redirecting web traffic to their other offerings.
So far the entities interested in owning your PHR are:
- employers
- insurance companies
- healthcare providers
- independent entities
- Banks
Yes, banks! Nations' leading banks are actively getting on this consumerism bandwagon and trying to monetize down the road. Banks are, well, banking on the trust their consumers have with them managing their finances and expect that trust to extend to managing their health records as well. Employers motive also would be selfish to manage their employees health by themselves. But what happens when the employees leave the company? Can they take their records with them? Payers want to own their members records since they will see this as a leverage to hold on to their current members. If the hassle of transporting PHR across payers is cumbersome, members might be incented to stay put with their current payer. If providers want to own the medical records, the question is which provider? There is nothing really in it for them to own and manage their patients longitudinal records. Their own EMR? yes, PHR? No.
So who should own it? That leaves only the consumers them selves or the government. Government should be the last entity to own our medical records given the recent track record. So, that leaves only the individual consumers to own our medical records over time. Ignoring for now the physical location of the records, the individual consumers probably have the right incentive, motive and trust to own their records.
The last time I visited India, I accompanied my aging father on a visit to a specialist lugging a big bag filled with his medical records, images and reports! That is his longitudinal, historical PHR albeit, in paper!