Given the individual practitioner's difficulties in controlling information practices, professional norms targeted at an institutional level may come to be important. The Joint Commission on the Accreditation of Healthcare Organizations now has an information practices component to its certification processes. Whether such regulation can or will be a credible substitute for government oversight remains to be seen. Almost every state makes some statutory provision for medical privacy. Coverage and sanctions vary widely across states.
Most states do recognize a common-law duty of confidentiality applying to health professionals.
Even in the rare instances where duties of one class of provider are clearly established, and extend consistently to other types of health professional, important gaps can remain. Consequently, the evolving information strategies of managed care are unlikely to be well addressed. Only about two-thirds of the states currently allow patients access to their medical records, with varying provisions for what may be withheld. While providing inadequate confidentiality and security specifications, many state laws also create obstacles to legitimate sharing of health information. The protections and status afforded to electronic records in such jurisdictions are uncertain.