# Presentation: 744411

## Review of the Personal Health Record (PHR) Service Provider MarketPrivacy and Security

*Stanley Chin*
*Altarum Institute*
*January 10, 2007*

## Overview

- Sought to understand current state of PHR vendor privacy policies
- What is covered?
- Are there concepts that no reviewed policies contain?
- Are there concepts that all reviewed policies do contain? Should contain?
- Focused on business rules surrounding privacy, not techniques used in security
- Can we define a “model privacy policy” at this point
- What are the big questions that remain unanswered now

## Methodology

- Scope
- Reviewed 30 publicly available privacy policies
- If it isn’t publicly available, is it still a privacy policy (Fair Information Privacy Practices)
- Scoring Tool
- 8 major categories containing 31 criteria
- Yes / No questions
- Limitations
- Only publicly available policies were reviewed
- Did not verify vendor contact information provided in privacy policies
- Unknown generalizability

## Individual Policies Are Generally Incomplete

- Policies are highly variable and not particularly broad in scope
- None had more than 18 of the 31 criteria
- Remaining 29 (97%) covered less than half of criteria
- Many emphasized security procedures or Internet privacy policies of the vendor’s web site, rather than protections of PHR data

- Distribution of Privacy Policies by Criteria Covered
- Average number of criteria covered: 8.7

## Coverage by Policy Criteria

- Tried to be generous in scoring, with any mention being counted
- Distribution of coverage of criteria shows that only six are covered by more than half of evaluated policies
- Few refer to external policies or security verification

## Transparency is Often Lacking

- Little disclosure of potential secondary uses of data
- Sixteen (53%) cover potential law enforcement access to data
- Three (10%) cover potential family member access
- None disclose names of any business partners who might receive data
- None disclose what data elements are shared
- Little attention to end of business relationship
- Only 2 vendors (7%) described disposition of user data should the vendor be sold or cease to do business
- Only one vendor (3%) described a policy for de-activated accounts

## HIPAA is Not Serving as a Model for PHRs

- Not all PHR vendors are HIPAA covered entities, but there is relatively little transparency about this
- Eight vendors (26%) reference HIPAA in their privacy policies
- Privacy policies lack definitions of essential legal terms
- Only 8 vendors (26%) provide a definition of “personal health information”
- Only 4 vendors (13%) provided a definition of “de-identified personal health information.”
- Formal mechanisms to enforce written policies are lacking
- Unknown to what extent Federal Trade Commission, private action, other external organizations might intervene
- Association of PHR vendors could have a role

## Steps Towards a Model Privacy Policy

- Big questions remain
- What is appropriate role of government
- How should policies be enforced
- What about provider, hospital, insurer provided PHRs?
- A clear role for industry, consumers, providers to create common privacy framework
- Many unanswered questions regarding how strong these rules should be
- Not yet clear how consumers will react
- Proposed basic components of a privacy policy
- Be available at all times
- Give current contact information, “freshness date” of policy
- Create transparency on secondary data use
- Disclose business relationships of vendor
- Explain protections for minors
- Describe relationship of policy to HIPAA, other Federal, State policies
- Provide readable descriptions and glossary of technical terms
- Separate from Internet web privacy, and security procedures

## Conclusions

- Privacy of PHR data should have a commonly-understood meaning among all vendors, providers, payers and users
- Existing policies are incomplete and there are no consensus privacy requirements
- A clear role for the AHIC workgroup to help define a “model privacy policy”

## Questions?

- Stanley Chin
**Director, Practice Development**
**Phone: (703) 575-1716**
**stanley.chin@altarum.org**
- Robert Lecker
**Director, Informatics**
**Phone: (703) 575-1691**
**robert.lecker@altarum.org**

## Attributes of Vendor Privacy Policies

| Attribute | Scope |
| --- | --- |
| Communication between vendor and user | Is there a specific contact or contact address to whom users can address questions concerning the privacy policy? 
Does the policy show the date the policy went into force? 
Does the published policy address whether or not users are notified when the policy is changed?
Are users given the option of opting-in to new privacy policies affecting their personal health information or staying with the current policy? |
| Readability | Is the privacy policy written in plain language wording understandable to users of average literacy?
Does the published policy contain a frequently asked questions (FAQ) section?
Is the privacy policy available in another common language (Spanish, French, etc.)? |
| Coverage of inactive accounts | Does the policy address the treatment of accounts whose contract with the vendor has lapsed?
Does the policy address the treatment of personal information if the company goes out of business or is bought? |
| Collecting user data | Does the policy address the use of cookies (small pieces of code placed on the user’s computer by the vendor)?
Does the policy discuss situations where the user may be asked to voluntarily provide information in the form of surveys or similar vehicles?
Does the policy address the use of web service logs to track user activity?
Does the policy address whether users are given an option to opt-out of responding to solicitations of information? |
| Sharing of user data with non-health care entities | Is there a different policy for identifiable vs. de-identified data when sharing data with third parties?
Does the policy address whether or not user data is shared with the following entities and what types of data are shared?
Vendor’s business partners or associates including potential advertisers or for vendors’ marketing purposes
Users’ family members
Health care research including public health and pharmaceutical
Legal entities including law enforcement or the courts
Another third party not specified?
Is consent required prior to sharing information to third parties? |
| Definition of terminology | Does the policy define “personal health information?”
Does the policy define “de-identified personal health information?” |
| Adherence to published guidelines or codes | Does the policy address adherence to published security or privacy guidelines, codes or recommendations? Are any of the following specifically mentioned?
HIPAA, URAC, E.U. Safe Harbor Guidelines, AMA, HON, VeriSign |
| Bundled with security policies | Is the published privacy policy bundled with a published security policy? |
| Approximate length in web pages | How long – in published web pages – is the privacy policy? |
| Comments | Does the vendor provide any additional comments regarding features or functionality of their privacy policy? |