Personal Health Records: PHRs and Correction
Report home | Read the report (PDF) | Previous section | Next section
One basic privacy right is the right to seek correction of personal information that is incorrect or incomplete. This is a difficult area for health records because health care providers do not like to change records, and they strongly resist removing information from a record. Often, the resistance is reasonable. For example, a preliminary diagnosis may turn out to be wrong, but the record of the diagnosis must remain in the record to explain a particular test or treatment.
What rules apply to the correction of PHR records? Many records in PHRs may originate with a health care provider. Who can change or delete the records? Will a PHR vendor change records only with the consent of the health care provider who supplied the records or can the consumer who is the subject of the record change it? Just who actually controls the record?
If the consumer truly controls the PHR record, then the consumer should have correction rights. However, if the record is to be shared with other health care providers, those providers will be understandably reluctant to rely on records that the patient changed. What happens when providers disagree about a patient’s diagnosis? Can one provider change another provider’s record? Can the consumer change both records? Suppose that a consumer deleted evidence of a prescription for a controlled substance in the hopes of obtaining a duplicate prescription from another doctor.
Here’s an example to illustrate a part of the problem. Suppose that a PHR record shows that John Doe had an appendectomy last year. However, this John Doe knows that he did not have the surgery. The record came from a surgeon who accidentally put the wrong patient number on it or who mixed up the record with another patient with the same name. Perhaps the PHR vendor matched records incorrectly. Another possible cause is a medical identity thief who obtained Doe’s insurance number and used it to obtain treatment in Doe’s name.
What can the consumer do about the incorrect information now in a PHR? HIPAA has some procedures for correction, but patient correction rights under HIPAA are inadequate in some circumstances. This is a messy area for all health records, but the centralization of records in a PHR may magnify some of the messy elements.
The principal difference between a HIPAA record and a non-HIPAA PHR record may be the issue of control. The health care provider controls the record maintained about a consumer’s care, and the consumer must negotiate corrections with the provider. The correction rights available under HIPAA can help consumers, although they do not work perfectly. The PHR vendor may have obtained the record with consumer consent, but it may not be clear if the consumer will have the right or ability to change it, depending on the structure of the PHR system. If the PHR requires that the consumer correct the original physician record first, the result may be an administrative or legal nightmare. For example, a health care provider may be unwilling to correct the record, may not be required to do so under HIPAA, or may no longer be in practice. However, if the PHR allows the consumer to correct the record directly, the value of the records may be undermined.
Corrections of health records are complicated, and no existing set of rules works well in all circumstances. Putting health records in a PHR may make existing problems worse, and it will almost certainly be more complicated because of the presence of a new record keeper whose responsibilities may not be clear and who may not be trusted by health care providers.
Roadmap: Personal Health Records – Why Many PHRs Threaten Privacy: II. Discussion – PHRs and Correction