Health Vault and Privacy, Essay Example

Historically, medical records have been maintained through the use of paper records that were kept in large file rooms with some individualized security system that was particular to the institution. In the future, however, there is every chance that medical records will be maintained through some form of electronic record keeping that promises to be more private, more efficient, and arguably more secure. At the present time there are several different electronic records services available but the one that is in question is the one identified as the Microsoft Health Vault. The Microsoft Health Vault is designed to allow patients to store, retrieve, manage, and share their health data over the Internet. In theory, the conveniences offered by this system are desirable but there remain many questions as to how the system will work in actuality. Some of the questions that need to be answered are how willing the public will be to share their information in this way, whether the health care industry will participate and accept the system, and whether the use of the system will improve health care and decrease costs.

Aside from the various practical issues involved in the use of a system such as Health Vault, there are also a number of significant legal issues that must also be determined. The Health Vault system is a specific example of a generalized system of record keeping identified as personal health records (PHR). These type of record keeping systems have become popular in the health industry and are viewed as the future (Jha, 2009). There is a wide range of available methods for maintaining records in this way from the use of a simple thumb drive to the utilization of a comprehensive system that can be accessed by every health care provider across the nation. What complicates the use of such methods of record keeping is the legal reach of a piece of federal legislation known as the Health Insurance Portability and Accountability Act (HIPAA). The intent of HIPAA is to protect the personal and medical history of every patient. Under the provisions of HIPAA any information that is linked to or reasonably could be linked to any individual’s personal health history is deemed deserving of protection and this includes any and all past, present or future information related to a person’s physical or mental condition. In light of the comprehensive nature of the information contained in systems such as the Health Vault it is easy to understand how such information systems poise a serious privacy issue under the tenets of HIPAA. As HIPAA’s broad application includes paper records, electronic records, faxes, emails, phone conversations, and even face-to-face contacts the question of how systems such as the Health Vault are going to address privacy concerns is a major consideration as to their future viability.

What brings this matter into focus presently is the request by the patient that his medical records from this institution be made available and incorporated in the Health Vault system. Under the applicable provisions of HIPAA, this institution is presented with an ethical and legal dilemma.

Although at first blush the protections of HIPAA may appear to be one-sided in favor of protecting the privacy interests of the patient further examination of the intent and application of HIPAA provisions demonstrates otherwise. HIPAA also exists to expedite and provide a line of information exchange for a variety of disciplines beyond the health care field (Annas, 2003). In addition to governing how information will be made available to health care professionals and institutions, HIPAA also governs how the same information will be provided to public health agencies, judicial and administrative agencies, national security concerns, and law enforcement institutions. So, although HIPAA might appear on the surface to be directed toward patient privacy, HIPAA in certain situations places what is perceived as a public need above the privacy concerns of the patient. Unfortunately, at the present time there is some question as to whether or not systems such as the Health Vault are governed by the terms of HIPAA. Presently, there is little legislation directed at the control of information being stored in systems such as the Health Vault. Arguably, the information that is deposited in such systems should be covered by the provisions of HIPAA but it remains to be seen whether Congress will enact legislation bringing systems such as Health Vault under the umbrella of HIPAA or whether the Courts will ultimately decide that the Health Vault system qualifies under the existing language of HIPAA.

The contract language of the Health Vault system ensures patient depositors of information that the depositor, and the depositor alone, has the authority to permit disclosure of any information retained by the system. Such language runs contrary to the provisions of HIPAA that outline a long line of exceptions as to disclosure without the individual patient’s permission. Health Vault claims to cover such contingencies in the language of its Privacy Statement but a review of the language reveals that such language falls far short of the detailed exceptions set forth in HIPAA (Microsoft Health Vault, 2012). This divergence in the language of the two documents calls into question this institution’s obligations in regard to the patient’s request.

Patient’s have an inherent and recognizably important interest in how their health information is used and circulated. The public also has an interest in being informed relative to the health history of its members. Balancing these interests has been the aim of HIPAA and the introduction of information collection systems such as Health Vault has presented society with a new wrinkle in the equation. In the instant case, without knowing the full range of the reasons that the patient might want his medical records filed with the Health Vault, this institution should tread lightly in going forward with any disclosure or filing with such service. The lack of legislation governing the use of information stored with Health Vault presents this institution with some potential legal problems that cannot be ignored. In the event that it is decided to honor the client’s wishes a document that can be interpreted to be in full compliance with the privacy provisions of HIPAA must be executed by the patient before there is any disclosure of any kind.

References

Annas, G. J. (2003). HIPAA Regulations – A New Era of Medical-Record Privacy? New England Journal of Medicine, 1486-1490.

Jha, A. K. (2009). Use of Electronic Health Records in U.S. Hospitals. New England Journal of Medicine, 1628-1638.

Microsoft Health Vault. (2012). Microsoft Health Vault Account Privacy Statement. Retrieved from Microsoft Health Vault: https://account.healthvault.com/help.aspx?topicid=PrivacyPolicy&culture=en-US