I participated in a personal health record (PHR) workshop yesterday hosted by the Center for Democracy & Technology (CDT). CDT’s goal was to gain input from a wide array of stakeholders (an impressive collection of about 40 health care leaders with different types of expertise in PHRs) to help inform CDT’s recommendations to federal agencies — HHS and the Federal Trade Commission (FTC) — and try to build some degree of consensus among key stakeholders.
[NOTE: All comments at the meeting were not for attribution, but I confirmed with the organizers that there was no problem in sharing my own impressions following up from the meeting.]
There’s no doubt that current federal statutes and regulation (and there are potentially many that apply to PHRs) create considerable uncertainty regarding how to balance promotion of consumer engagement with concerns over privacy and security. Existing regulations from HIPAA, the Electronic Communications Privacy Act, and others coupled with the new provision from the American Recovery & Reinvesment Act (ARRA) — not to mention the complexity of layering state laws on top of that — provide a lot of work for privacy attorneys. But with all the different (potentially) applicable federal and state laws/regulation, there is very little practical guidance on what has to go into privacy policies. PHR implementers can find some guidance from FTC consent decrees, which can represent an expansion of the law.