#2006-11 April 2006 Personal Health Records: An Overview of What Is Available To The Public by Carol Cronin Consultant The AARP Public Policy Institute, formed in 1985, is part of the Policy and Strategy Group at AARP. One of the missions of the Institute is to foster research and analysis on public policy issues of importance to mid-life and older Americans. This publication represents part of that effort. The views expressed herein are for information, debate, and discussion, and do not necessarily represent official policies of AARP. The fact that a company is named in this report should not be construed as an endorsement by AARP. © 2006, AARP. Reprinting with permission only. AARP, 601 E Street, NW, Washington, DC 20049 http://www.aarp.org/ppi FOREWORD As concerns continue to mount over rising health care costs, many believe that patients must be more engaged in their own health care, assume an active role in the management of their care, and take greater responsibility for its cost and quality. Personal health records (PHRs) could support patient-self management and engagement, and electronic versions would facilitate access to comprehensive health information as well as improve patient/physician communications. Moreover, consumers are interested in having more information about their own health care. The Markle Foundation has identified the adoption of PHRs as a “leading indicator” of other changes that will help consumers benefit from advancements in health information technology.1 A recent survey of American consumers conducted by Markle found that 60 percent of respondents support the creation of a secure online personal health record service that would allow them to check and refill prescriptions, get test results, communicate with their doctors via email, and check for mistakes in their medical records;2 over 70 percent of respondents believe that PHRs would improve health care quality.3 Nevertheless, surveys of American consumers also indicate awareness of the risks associated with the potential misuse of personal health information, such as inappropriate secondary or criminal use of data and security breaches. A November 2005 survey of American adults indicated that 67 percent are concerned about the privacy of their health information.4 PHR design, functionalities, and ease of use will affect whether consumers find value in these tools. Many consumers have (or may soon have ) access to PHRs through their health plans. In addition, other products are now available to consumers directly. AARP commissioned this study to “get the lay of the land” of PHRs that are directly available and, given the great interest in helping consumers achieve more control of their own health, to better understand how the services offered by these PHRs could help stimulate consumer engagement. This study examined 24 PHR products that were available to consumers in 2004 and 2005. The study findings describe the range of services these PHR products offer and underscore the extreme volatility of the market. Although the uptake of PHRs among consumers is still low, it would be useful to gather more information about how those consumers who do have PHRs actually use them. In addition, the author identifies several outstanding public policy questions that should be answered through further research, as PHRs evolve and their use becomes more widespread, including issues about data privacy and ownership. Joyce Dubow AARP Public Policy Institute April 2006 1 Markle Foundation, Connecting for Health Personal Health Technology Initiative, February 26, 2006. 2 Markle Foundation, “Attitudes of Americans Regarding Personal Health Records and Nationwide Health Information Exchange,” October 2005. 3 Markle Foundation, June 5, 2003. 4 California HealthCare Foundation, November 2005. i TABLE OF CONTENTS FOREWORD ....................................................................................................................... i I. EXECUTIVE SUMMARY ........................................................................................ iii II. INTRODUCTION....................................................................................................... 1 Purpose........................................................................................................................ 1 Methods....................................................................................................................... 2 III. FINDINGS—GENERAL INFORMATION ABOUT PHRs ..................................... 2 PHR Company Information ........................................................................................ 2 Benefits of the PHR Product....................................................................................... 3 Types of PHRs ............................................................................................................ 4 Costs............................................................................................................................ 5 Number of PHR Users ................................................................................................ 5 Distribution Channels ................................................................................................. 6 IV. FINDINGS—CONTENT OF PHRs........................................................................... 7 Common Features ....................................................................................................... 7 Other Features............................................................................................................. 9 Editorial/Clinical Oversight ........................................................................................ 9 Customer Service ...................................................................................................... 10 Privacy ...................................................................................................................... 10 Terms and Conditions ............................................................................................... 11 V. FINDINGS—RESEARCH AND EVALUATION .................................................. 12 VI. CONCLUSION......................................................................................................... 14 REFERENCES ................................................................................................................. 17 APPENDIX A................................................................................................................... 18 ii I. EXECUTIVE SUMMARY Introduction The growing interest in health care information technology and electronic medical records has been accompanied by interest in personal health records (PHRs) on the patient/consumer side of these advances. Surveys indicate that a substantial number of Americans support the creation of a secure online PHR, while still expressing concern about the privacy of their medical records. Purpose In order to learn what types of PHRs are available to consumers and their families, 24 American-based PHRs were reviewed between April and November 2005. These PHRs were directly available to any member of the public at the time of the review, thereby excluding PHRs only available to particular groups (i.e., health plans, medical group members). Findings: General Information about PHRs Many of the 24 PHRs examined were new, with one-half introduced to the market in the last two years (2004 or 2005). Most PHR companies were small, independent, privately held companies, with almost 30% of them founded by physicians frustrated with not having complete medical records when needed. An analysis of the main messages of the PHR sites indicated three themes regarding why consumers should use them: (1) to help users make better health decisions by organizing and managing their health information; (2) to save time; and (3) to avoid injury and death by assuring completely accessible medical information. Several types of PHRs were reviewed including Internet-based (information resides on the Internet and is accessible through a password log-in), PC-based (residing on one's personal computer); portable devices (digital memory devices that can be carried and plugged in); and mixed models (including paper components). In these types of PHRs, information needed to be entered by users. Another model involved collecting, organizing, and making a user's actual medical records electronically accessible. Costs for the PHRs ranged from free to almost $500 a year with some companies charging a one-time fee to purchase software, while other companies charged ongoing fees that varied depending on how many family members used the service or the range of services chosen. Although many companies did not provide their current number of users, the 8 companies that did so reported numbers ranging from less than 1,000 to over 2 million users. Besides being available through the Internet, PHR distribution channels included hospitals, physicians, managed care/health insurance companies, employers, iii pharmacies, disease management companies, health clubs, and community-based organizations. Some PHRs positioned their product for an international clientele with the ability to instantly translate information. Others advertised on popular Internet search engines PHR Content and Services All of the PHRs had a section of the product or service that requested general health and medical information about the user. They all requested emergency contact information, with some providing this information on wallet cards. Almost all of the PHRs had a section to record the drugs and health insurance used. Most of the PHRs captured information about one's family history and included links to health education materials. Many also included some type of patient diary or journal where users could write what they wanted. Interactive features were included on many, such as reminders about preventive screenings or prescription refills. Documents and images could be stored in some PHRs, while others included the ability to download useful forms such as medical record releases. The ability to graph information over time was available on some. A range of other features that were found less frequently included expense organizers, newsletter subscriptions, and personal toll-free voicemail. A small number of sites listed information about Medical Advisory Boards, while several included logos from external review organizations such as Health on the Net (HON), URAC, TRUSTe, Verisign, Thawte, or the Better Business Bureau. All had a means for users to contact the site, and many had toll-free phone numbers for customer service. Twenty of the 24 PHRs had privacy policies that provided a range of information on what type of data were collected and who had access to it. More than half had "Terms and Conditions" sections that laid out legal rights and responsibilities. A few of the sites reported findings of research or evaluation including information on demographics and how the sites were used. Conclusion/Areas for Future Research A review of 24 PHRs in 2005 revealed that there are a variety of products on the market that are directly available to consumers. These products seem to be well suited to consumers who require multiple physicians, tests, hospitalizations, prescriptions, or for those who travel and might experience a medical emergency away from home. Although most of the PHRs did not reveal their user numbers, it appears that market uptake is modest. Reasons for this might include lack of public familiarity with PHRs, concerns about privacy and security, user time requirements to enter data, and the lack of connectivity to physicians. A variety of issues and questions remain regarding PHRs. Some concern PHR products specifically (the experience of actual users and physicians), while others address broader policy issues (legal implications, privacy, and security). Given the importance of health technology now and in the future, it will be prudent to monitor the development of PHRs as they evolve to meet the needs of future patients and their families. iv II. INTRODUCTION Health care information technology has been much in the news of late. The benefits of connecting health professionals and organizations through electronic medical records (EMRs) are often noted as key to improving health care quality. At the same time, there is increased interest in more actively engaging patients in their care by having them access their health information. Personal health records (PHRs) are often viewed as the patient/consumer side of health care information technology. Although there is still no universally accepted definition of PHRs, a recent American Health Information Management Association (AHIMA) Work Group's definition captures many of the salient points: "The personal health record (PHR) is an electronic, universally available, lifelong resource of health information needed by individuals to make health decisions. Individuals own and manage the information in the PHR, which comes from the health care provider and the individual. The PHR is maintained in a secure and private environment, with the individual determining the rights of access. The PHR is separate from and does not replace the legal record of the provider." (AHIMA e-HIM Personal Health Record Work Group, 2005) Recent public surveys have indicated interest in PHRs. A survey in September/October 2005 conducted for the Markle Foundation found that 6 out of 10 Americans support the creation of a secure online PHR that would allow consumers to do such things as review and refill prescriptions, get results over the Internet, and check for mistakes (Markle, 2005). Another national survey found that nearly 1 in 3 (32%) of those surveyed say they or a family member have created their own set of medical records to ensure that all of their health care providers have all of their medical information (The Kaiser Family Foundation/AHRQ/Harvard School of Public Health, 2004). Purpose Given the interest in PHRs, what is currently available to consumers and their families? The focus of this report is on PHRs that are directly available to any member of the public. This excludes PHRs that are only available if one is a member of a particular group (for example, a member of a health plan, an employer group, or a disease management program, though some of the PHRs reviewed do customize their products for groups and one ceased being available to the public after the review). It also excludes EMRs that only offer patients and families a "view" into the record such as those available in certain medical groups or HMOs. 1 Methods This report provides a summary of 24 PHRs that were reviewed between April and November 2005. The PHRs were identified through published lists and other Internet research. Although the list of those reviewed is not exhaustive, it does provide a fairly comprehensive view of the range of PHRs currently available in the marketplace. All of the reviewed PHRs have some electronic/software component, although some include a paper option as well. There are a number of PHR companies that exclusively focus on the emergency access aspects of a personal health record. While this review includes some companies providing this type of service, others were not included. In addition, there are English-language PHRs based in other countries (Australia, New Zealand, and Canada) that were not included in this review, although they do seem to be available to Americans. After identifying the list of PHRs to be reviewed, their websites were analyzed to identify both information about the organizational sponsor and the general content of the PHR itself. Each organization sponsoring a PHR was then contacted either by e-mail or phone to provide additional information and to verify a subset of information gleaned from the website. Twenty-two of the 24 PHRs reviewed responded to the inquiry. Section III provides general information about the PHRs including company information, benefits, types, costs, number of users, and distribution channels. Section IV provides an overview of the content of the reviewed PHRs including their editorial oversight, privacy protections, and "terms and conditions." Section V discusses PHR research and evaluation activities. The final section (VI) offers concluding observations and areas for future research. A list of reviewed PHRs is included in Appendix A. III. FINDINGS—GENERAL INFORMATION ABOUT PHRs PHR Company Information One-half of the PHRs reviewed (12) had introduced their product in the last 2 years (2004 or 2005). The oldest of the PHRs dated to 1999, and the most recent were introduced during the summer of 2005. The vast majority of the companies were independent, privately held, small companies. Two of the companies, (WebMD and CapMed, which is owned by Bio-Imaging Technologies, Inc.) are publicly traded, while a third is non-profit (MedicAlert). Of the for-profit companies, more than half only offer PHR products and services. Other companies include PHRs as part of a larger portfolio of health care data and information services. Finally, one product is offered by a software company that has designed a range of organizing software, and another company offers executive physicals. Interestingly, seven of the companies were founded by physicians who indicate their frustration in 2 dealing with patient medical records as a motivating factor in the company founding. At least two of the PHRs were developed by caregivers—a mother with a chronically ill son and the child of a parent who had a stroke. The balance of the companies were generally managed by staff with expertise in health business and health information technology. Benefits of the PHR Product In order to better understand how the PHR companies "positioned" their products and services in terms of consumer benefits, the main messages of the 24 company websites were reviewed. Three themes emerged from these messages in terms of why consumers and their families should use or purchase the PHR. Two of the themes emphasize the positive value of the PHR, and one emphasizes the value in avoiding negative occurrences. Quotes from PHR sites follow the main message descriptions. • "Take Control"—Many of the sites included messages about how the PHR product or service can help empower users to make better health decisions by organizing and managing their health information and that of their families. Some messages also emphasize the positive value in communication and linkage with one's physician and other health professionals. Examples of quotes include: "Helping you make better decisions for life" "Innovations that empower consumer health" "Take control and live a healthy life" • "Save time"—Increased health care efficiency is a second theme of the PHRs. Other attributes used to describe this theme were convenience and accessibility. Examples include: "Save time and money by avoiding searches for your records…" "Increased efficiency in interacting with the health care system" "No more frustrating or dangerous delays in obtaining a complete record" • "Avoid death and injury" messages are found in almost all of the PHRs that emphasize the importance of having medical information available "anywhere, anytime" in case of an emergency. Their usefulness in preventing prescription drug and other errors is also often noted. Examples include: "Be prepared" "Do you know where your personal health information is located?" "In an emergency, this information could save your life" In addition, many of the PHR websites emphasize the importance of health and medical information being "safe," "secure," or "private." 3 Types of PHRs There were several types of PHRs reviewed. They generally fell into one or more of the following categories (in order of frequency): • Internet-based: These services begin with a registration process that involves the user choosing a username and password. Through a web interface, users then complete information about their (or a family member's) health that is stored in a secure server maintained by the PHR company. Users can access that information (and/or authorize access to others such as emergency contacts, physicians, or ER departments) by logging-in and providing their password. • On personal computer (PC): The second most common type of service were PHR products that involved health information residing on one's own computer. The user would use a CD or download the PHR template from the Internet to the computer. Information about one's health would then be entered and maintained by the user on his or her computer. • Portable Devices: Several companies featured various types of digital memory devices containing one's health information that could be carried around on lanyards, key chains, watches, bracelets, pens, laser pointers, or on credit-card wallet CDs. The information is launched by "plugging" that device into a computer in a physician's office or an emergency room. • Medical record storage/accessibility: A few companies collected, organized, summarized, and then made electronically available actual copies of all of one's medical records. In some cases, the company provides the information back to the user in a wallet or regular CD, or it could be accessed through the Internet. • Mixed models: Several companies have different combinations of options available including both a PC-based model and a USB chip that allows one to copy the information from the computer and carry it with the user. Another company that has a USB chip has the ability to "synchronize" information with an Internet-based version that is available in case of an emergency. Several of the Internet-based services allow uploading of actual images and documents, which begins to build portions of the medical record. Finally, several of the companies also offer the option of a paper binder as an alternative or add-on to their service. There were two types of PHRs reviewed in terms of the content that they contained—the most common were PHRs that collected and stored a broad range of health care information. The others were specifically designed for patient subgroups such as people with diabetes (MedicCompass: www.medicompass.com/diabetes), women interested in breast health (MyNDMA), or individuals with hydrocephalus (www.myhin.org—a customized version of the Follow Me product). 4 In all of the reviewed Internet and PC-based products and services, users need to gather and enter information about their health care directly into the PHRs. There were different methods of data entry, with some combination of straight text entry, wizards to aid input, drop-down menus, or point-and-click lists. As previously mentioned, many included the ability to scan in actual documents as well. One company provided users with a personalized fax number that automatically converted material to a PDF document. Many of the companies emphasized the ability to share the information with one's physician or other health professionals either by giving the physician electronic access or printing out and bringing information to the health visit. Costs The costs of the PHR products and services reviewed ranged from free to up to $500 a year. There were several products that were free to the user including iHealthRecord (which is currently paid for by a $25 a month fee paid by physicians) and the Personal Health Record feature on the consumer health site Health A to Z. Some companies (such as Peoplechart and Health Histories) offered a part of their services for free. Companies that charged for their product or service differed in whether they charged a one-time-only fee or an ongoing fee. One-time costs for the purchase of a CD, USB chip, or credit card-sized CD or downloadable software ranged from $14.95 to $74.95 (with half of the companies charging under $30 and half more than $30). Costs in companies that offered their product on an ongoing basis ranged from $10 a year to $84.95 a year. Other companies charged for their product on a monthly basis, ranging from $0.99 a month to $9.95 a month. Those that included some human component of gathering, organizing, summarizing, and making accessible actual medical records tended to be the most expensive (with charges ranging from $9.95 a month to a flat fee of $149). Prices varied within some companies depending on how many individuals/families might use/access the PHR, the size of available memory, or the range of services that are chosen. Several companies offered free trial periods. Number of PHR Users Companies that offer PHRs were asked to provide their current number of users. Of the 24 PHRs asked, 11 did not provide the information stating that it was proprietary. The remaining 13 companies fell into the following categories: <1000 users: 3 companies 1,000-2,000 users: 2 companies 7,000 users: 1 company 17,500 users: 1 company 2.3 million 1 company 5 One company indicated that its number of users was in the "thousands" and another responded "less than one million." Three additional companies "distribute" their product to others (through doctors offices, as part of an overall consumer health website, or through hospitals or other third parties) so they are not certain how many consumers actually use the PHR that has been provided to them. Caution should be used in interpreting these numbers as they are self-reported and "users" can be defined in various ways. Information from other public sources indicates that PHR use is still relatively small. A “Connecting for Health” 2003 online survey revealed that only 1.5% of respondents managed their health records on a computer and an additional 0.5% maintained their records online. This compared to 40% who kept some paper medical records at home (Markle Foundation Connecting for Health, 2004). Another online survey conducted by Harris Interactive in August 2004 found that 2 in 5 (42%) adults keep personal or family health records in one place, with 13% reporting that they keep them electronically (of those, 11% use their own filing system, 2% use a filing system that was purchased, and 1% use a health record website) (Harris Interactive, 2004). Distribution Channels Although all of the PHRs reviewed maintain websites that market their product and services directly to the public, many distribute their product in other ways as well. For example: Hospitals were mentioned as distribution channels for PHRs. CapMed has distributed their PHR to several hospitals including Lancaster General in Pennsylvania, the Christus Health System in Texas, and Christiana Health Care System in Wilmington, Delaware. CheckUp mentioned their distribution in maternity gift bags for new mothers with an area hospital. The Guide to Good Care is working with the hospice and home health departments of a local hospital. Physicians were a key distribution target mentioned by several companies including iHealthRecord, which recently announced an initiative with the California Association of Physician Groups to deliver interactive personal health records to patients. The company has also been working with Brown and Toland, a 1,500 physician medical group in San Francisco. Health Histories indicated that they have physicians selling their products and services to their patients, while VitalVault noted that they are working with several local physicians including neurology, urology, and radiology groups. Managed care/health insurance companies were mentioned by several of the PHR companies including one (Healthframe) that indicated that their product was available through a Health Savings Account (Sterling). 6 Employers were the target of several of the companies. Some employees might have access to the PHR through a larger consumer health website such as WebMD or HealthAtoZ. Employers that were mentioned as offering PHRs to their employees included: American Airlines, Cisco, Fedex/Kinkos, Ford, GM, IBM, Kraft, Microsoft, and Pepsico. International Distribution Targets: Several companies (Med-Infochip, Securamed) target an international clientele, both in terms of foreign customers and Americans traveling abroad. Some had offices in other countries. One (Health Histories) indicated that part of its history included marketing to church mission groups. Other health distribution targets mentioned included pharmacies (in grocery stores), pharmaceutical companies, disease management companies, health clubs, and a retail medical device store. Other community-based approaches included making the PHR available to a local Knights of Columbus group, a college program for students studying health care informatics, and a PHR that was specifically designed for migrant farm workers in California (www.vwsvia.org—a customized version of the Follow Me product). Advertising: Several of the PHRs advertised on the Google and Yahoo search engines. If one searches for "personal health records," several of the companies reviewed appear in the "Sponsored links" section of the results pages. IV. FINDINGS—CONTENT OF PHRs Common Features The 24 PHRs examined stored a wide range of medical and health information including general health and demographic information, drug information, medical/health contacts, family history, health insurance, patient education content, and patient diaries or journals. Some also allowed users to store health documents and images and included some interactive features. Each of these is discussed further below. All of the PHRs had a section of their product or service that requested general health and medical information about the user. The types of information in these sections included general demographic information (name, address, DOB, etc.), past and current diseases and conditions, hospitalizations, surgeries, injuries, lab tests/results, immunizations, allergies, health visits, preventive screenings, social history items (e.g., alcohol/drug use), vital signs, medical devices/prostheses, dental/vision/hearing information, and occupational exposures. All of the PHRs also had an "emergency contact" section or 7 process that listed points of contact and any pertinent information (e.g., allergies, important conditions, etc.). Some of the services included this information on a wallet card that would give directions about how to access the full PHR online or through a call- center if needed. Almost all of the PHRs also had a section on drugs (prescription, over-the-counter, and supplements/vitamins) with some providing access to a drug interaction checker. Almost all had a section on medical contacts (e.g., physicians, hospitals, pharmacies, and, in some cases, dentists and others). And almost all had a section for health insurance information. Most of the PHRs had a section that captured information about one's family health history. Most also had links to health educational materials—either to such sites as the National Library of Medicine's Medline Plus or to "resource centers" that might include a series of links about a particular disease (e.g., diabetes) or population group (e.g., women's health). One PHR noted that its service included the creation of an individualized medical reference library based on the conditions/diseases entered into the PHR. Another offered the option to "enroll" in an educational program that involved periodic e-mails on selected topics. Finally, some of the services included health news as an available feature. Many of the PHRs also included some type of patient diary or journal where a user could write whatever he or she wanted. This might include logs of conversations with health professionals, pain and symptom logs, or thoughts about more personal or experiential aspects of their health. Many PHRs also included an interactive feature that could remind the user about a health or medical topic. These included reminders about preventive screenings, updating one's PHR or emergency card, taking or refilling prescription drugs (one service indicated it would send a reminder to one’s cell phone or pager), actions related to a particular disease or condition (e.g., diabetes), or other reminders related to one's health goals (e.g., walking five miles every week). One PHR also notified users if there was an FDA recall of a certain drug. Finally, many PHRs could hold documents and images of various types from users. These included such things as advance directives and do-not-resuscitate orders, medical reports (such as discharge summaries), lab and radiology reports, EKGs, mammograms, and other X-rays. Some of the PHRs also could download and print forms that might be useful (such as requests to physicians for medical record release and advance directives). Some also included the ability to graph information in order to visually track health changes over time. 8 Other Features Other PHR features were found less often. These included: • Expense organizers that allowed one to keep track of out-of-pocket expenses by categories, such as medications, visits, or tests. • Subscriptions to newsletters and other ongoing health periodicals. • Notification of one's family and friends in the case of an emergency. • Specialized sections that deal with certain health/medical issues such as a "child health manager" or a "diabetes manager." • The ability to upload information into the PHR from medical devices, such as blood glucose monitors. • The ability to participate in online communities and discussion groups (although this feature seemed to be inactive when reviewed). • The availability of personal, toll-free voicemail for confidential messages from a physician's office. • The ability to search for health professionals and organizations ("search for a mammography facility"). • The availability of a "certified professional health manager" who would assist a user in interacting with the PHR. • Translation of the PHR and ancillary materials into other languages. A small number of sites were available in English and Spanish. Another small set provided the ability to instantly translate information into other languages (in case of emergency in another country). • The availability of other products surrounding the PHR, such as tote bags, pens, or fanny packs. One PHR indicates that participation in their service provides researchers with a powerful tool to quickly and efficiently identify data required to conduct clinical trials, with the consent and authorization of the patient. The company also contributes a portion of its membership fee toward preventive health and research programs. Another PHR notes that their service is tax deductible as a medical expense. And finally, one PHR states that their service could also be used for one's pets. Editorial/Clinical Oversight Three of the PHRs reviewed had Medical Advisory Boards listed on their sites, the purpose of which, according to one site, is "to guide the design and development of the site and to insure that the product is relevant and credible to physicians and patients alike." Two other sites had Advisory Boards primarily made up of corporate advisors, although they also included physicians. 9 Several of the sites included logos from external review organizations. Six of the sites had the Health on the Net (HON) logo, which indicates that the sites had reviewed themselves against the eight HON principles (authority, complementarity [doesn't replace physician relationship], confidentiality, attribution, justifiability, transparency of authorship, transparency of sponsorship, and honesty in advertising and editorial policy). Clicking through the verification of HON status on the six sites revealed that four were last reviewed by staff from the PHR in 2005, while two were last reviewed in 2004. Three of the sites had the URAC website accreditation logo, although two of the three were listed as "under review" on the URAC site when checked. (Note: URAC staff indicated that this means some paperwork might not be complete in the re-accreditation process. In this case, the current accreditation continues beyond the expiration date.) One site included the Better Business Bureau reliability logo. Customer Service All of the PHRs had a "Contact Us" section where interested viewers could go for additional information. Many had toll-free phone numbers for customer service, some of which were available 7 days a week/24 hours a day. Others had e-mail only customer service (some with protocols on how quickly they would respond), or they tried to handle customer issues first through e-mail, turning to phone contact only if the issue could not be resolved. Privacy Surveys have consistently indicated public concern about the privacy of their health and medical information. A recent survey report from the California Healthcare Foundation (2005) found that two-thirds of consumers said they were "very concerned" (36%) or "somewhat concerned" (31%) about the privacy of their medical records. The data also revealed that almost three-quarters (73%) of respondents belonging to an ethnic minority said they were "very" or "somewhat" concerned. Of the 24 PHRs analyzed for this report, only 4 did not have a privacy policy on their site. A brief review of the privacy policies for the 20 PHRs that had them revealed that most had the following categories of information: • The types of information collected about individuals using the site and/or the company’s services (often a distinction is made between personally identifiable information and non-personally identifiable information). • How that information is handled internally (site staff procedures, training, etc.). • Whether and how information is disclosed to external parties of any kind. • Notice about links to other sites and the privacy implications. • Children's privacy—most sites indicated users had to be over age 18. • Security policies and procedures (both physical security of servers, etc., and transmission policies)—sometimes in a separate section of the site. • Policies on cookies and other tracking device . • Data mining/analysis policies. • How the user might access and correct information. 10 • Privacy options to opt-in or opt-out. • How the site notifies users about any changes. • How to contact the site. In addition, companies addressed privacy issues around specific aspects of their sites such as passwords/log-ins, e-mails to and from the site, e-mail newsletters, surveys, public forums, audit trails, subscription services, and advertising. Only rarely would a company discuss how to delete health information from the site if the user desired. Several sites included logos from third parties that certified a certain level of privacy or security. Six sites included a Verisign logo somewhere on their site (although one site's Verisign certification had expired). Verisign (www.verisign.com) verifies that information exchanged with a site is encrypted and secure. Three sites had TRUSTe logos (www.truste.org, which indicates that the sites meet certain privacy standards) and one had a Thawte logo (www.thawte.com, which indicates encrypted and secure communication). Terms and Conditions More than half (15) of the sites have a section called "terms and conditions" that lays out the rights and responsibilities of the sponsoring company and site users. Often, legal language is used and the content can be quite long. The information is generally found at the bottom of the home page or in a box somewhere on the registration page. In some cases, users have to actively acknowledge that they have read and agree to the terms and conditions (by checking "I agree"). In other cases, the assumption is made that if the user proceeds, he or she is assenting to the terms and conditions. The types of issues addressed in the Terms and Conditions included: • Warnings that information in the site does not substitute for medical advice, nor does it replace an actual medical record. • Notification that information on the site is "as is" with no guarantee of accuracy or completeness. • Limitations about organizations to which the site links. • Security issues. • Privacy issues. • Endorsement/advertising. • Copyright/trademark/prohibitions against commercial use of the information. • Disclaimers/hold harmless provisions/indemnification. • Terms and termination (payment, reserving the right to terminate). • Governing legal jurisdictions. 11 As with privacy, specific sites address particular issues in their terms and conditions such as legal issues regarding personal health information managers (that would assist with information), emergency access, and international use (for example, agreement to comply with applicable laws regarding the transmission of technical data exported from the United States or a foreign country). V. FINDINGS—RESEARCH AND EVALUATION Some of the PHRs included a place on their site where users could "tell us what you think" or other opportunities for feedback. A few reported that they had conducted research or evaluation on their product or service, or on PHRs in general. These include: In 2002, CapMed collaborated with the University of Maryland School of Business to survey 875 CapMed users on a range of topics. Selected findings include: • 83.5% believe it is important to have health information available at all times. • 79.8% would rather store health information on their PCs rather than on the web. • 69.1% of the primary users are male. The primary use of the PHR by those surveyed included: • 26.4% family medical history. • 21.4% track doctor visits. • 18.7% track medications. • 14.1 % track lab results. • 13.5% track/trend my health. • 5.9% other. iHealthRecord—In the "Frequently Asked Questions" section of its website, responses to a question asking about the gender of those who primarily used the PHR differed from the Capmed/University of Maryland research findings: • Most users are women who are building an iHealthRecord for their children, spouses, aging parents, and themselves. In addition: • 90% describe the iHealthRecord as “easy to use,” “valuable,” and would recommend it to a friend. The most common reasons for building an iHealthRecord are "storing all important medical information in one place," the "ability to access information in an emergency," and "the ability to more easily share information with the patient's doctor." 12 Peoplechart is donating its equipment, services, and technology in a project that has been launched in several areas nationwide to study the use and impact of PHRs. The study has three phases: (1) implementation of the PHR in several sites; (2) feasibility (can the PHR perform certain functions and services?); and (3) evaluation (does the PHR improve care delivery by reducing unnecessary or conflicting care or services; does it improve coordination of care; does it produce substantial savings by reducing duplicative tests?). Potential enrollees in the research projects are expected to be: • Clients who are likely to be referred in or out for specialized care. • Clients who frequently visit specialists or hospitals for procedures or testing. • Clients who see multiple physicians or make frequent visits to health facilities. • Clients who have family members (or friends) assisting or providing them with care. Organizations participating in the research include senior centers, health centers, a palliative care center, a transplant center, and a children's rehabilitation center in Ohio, Hawaii, and Virginia, respectively. Each of the centers and its associated research institution (medical schools at the Universities of Virginia, Chicago, and Hawaii; Stanford; University of Minnesota School of Management; and Johns Hopkins School of Public Health) is responsible for finding its own funding for research, so projects are in various stages of implementation. Another company (K.I.S. Medical Record Solutions) reported the results on their website of internal research they had conducted with a small number of emergency room physicians looking at actual ER patient cases. Some of the physicians had medical records about the patients prepared by K.I.S. Others only had information that typically would be available on an ER patient. Their task was to study the medical case and address the following questions: • What is your initial working diagnosis? • For proper care what additional information is required? • What test would you order on each particular patient? • What is your treatment plan? • What is your final diagnosis and disposition of each patient? The company reported positive results with regard to physicians using the K.I.S. PHR: • Treatments and medication prescriptions were more precise and specific to the medical diagnosis. • The final diagnosis and dispositions of the cases were far more accurate. • Correct diagnosis of the cases improved by more than one-third. • Unnecessary admissions to the hospital decreased by 42%. • Inappropriate discharges decreased by 20%. • Patients with K.I.S. medical records were correctly diagnosed and admitted to the hospital 98% of the time. 13 VI. CONCLUSION A review of 24 PHRs in 2005 revealed that there are a number and variety of products currently on the market that are directly available to consumers. Some are available from very small companies, while others are sold by publicly traded companies. Many emphasize the user's ability to be better informed about his or her health care, to save time, and particularly to have access to important medical information in the case of an emergency. The products seem well-suited to consumers/patients (and their caregiving families and friends) who are experiencing conditions and diseases that require multiple physicians, tests, hospitalizations, prescriptions, and other interactions with the health care system. The products are also positioned for those who travel and might experience a medical emergency away from home. The PHRs do require some level of computer savvy and comfort with the Internet, although many touted the ease of navigating their product and services. Many of the PHR companies noted that future versions of their product would include additional features and changes, indicating their sponsor's desire to continually alter their products as they learn more about the needs of their users and the market. Some of the PHR vendors are tracking, or are directly involved in, national policy and implementation discussions about health information technology—and particularly the electronic medical record. Some are monitoring how the expected evolution of interoperability and other information technology standards will affect and improve their product and services. It is also clear from this review that there are different types of PHRs that serve people with different needs, expectations, and concerns. Those with security and privacy concerns about transmitting information over the Internet can keep their medical information on their own computer, while others prefer the ability to access the information from anywhere through the Internet. The ability to "carry your medical information with you" is also increasingly available with USB chips, CD wallet cards, and other technologies. Other variations include whether an individual prefers: • "Summary" information about one's medical and health information versus the actual records themselves; • Human—and potentially physician or health professional—assistance in this area initiation and maintenance of the PHR completely on one’s own; • An "all purpose" PHR or one that specializes in a particular disease or condition area; and finally, • A PHR, or a PHR plus a range of other services and products (newsletters, links to content, or e-mail reminders). 14 At the same time, while most vendors did not reveal their user numbers and many are new to the market, it appears that PHRs directly available to the public have not experienced a dramatic uptake. The early experience of PHRs that are unconnected to health care institutions (particularly physicians) suggests that actual market adoption is a significant hurdle. There may be several reasons for this including: • The concept of PHRs is still relatively new. It is likely that most people have not thought much about their medical records. • Consumers have concerns about the privacy and security of health and medical information. • It takes time and effort to gather and enter information into some of the products and services—particularly for more than one family member. One may question: “is this worth my time, effort, and money?” • PHRs may lack connectivity to one’s physician. Although many of the programs promote the idea of giving physicians access to the information (by sharing passwords, etc.), whether and how often this interaction can occur is not clear. Areas for Future Research A variety of questions and issues arose during the review of the 24 PHRs, some of which address specific issues related to the types of products and services reviewed, while others deal with broader policy issues surrounding PHRs. As PHRs evolve to their next stage—whether directly available; maintained and controlled by the consumer; or made available to, but maintained and controlled by another party (e.g., a health insurance plan, a physician's office, or some other entity)—answers to the following questions will be useful: (1) What are the detailed privacy, security, and legal issues involved with PHRs? • This analysis did a summary review of privacy, security, and "terms and conditions" sections of PHRs. A more detailed review would reveal exactly how companies assure the privacy and security of the information, as well as the legal issues raised in this area. (2) Are PHRs consistent with current standards-setting activities such as the Continuity of Care Record (CCR) activity of the American Academy of Family Physicians and other such efforts? (3) How do PHRs that are directly available to the public compare with PHRs that are "connected to" health organizations in terms of content and offerings? (4) What are the policy issues surrounding the patient/physician/other health professional encounter if information from one of these PHRs is used? If patients print out their PHR summary, will that suffice in terms of the "new patient registration" forms often needed 15 when seeing a new doctor? What is the level of trust health professionals and organizations will have in acting on PHR information? What liability do health professionals have for checking or not checking information that may be in a PHR? (5) What is the experience of actual users of PHRs? What features are used most often/least often? What are the time requirements? What is the typical user profile? Are there differences between users of PHRs solely maintained by consumers versus those maintained by others? (6) What are the issues, concerns, and legal ramifications of health and medical information that is transmitted, stored, and maintained in other countries? As indicated, several of the PHRs emphasized their usefulness to people traveling abroad. In addition, there are PHRs available to Americans sponsored by companies in other countries. (7) How is health and medical information handled in a termination situation? • How does a user "delete" health and medical information from a product or service? • What currently happens to medical and health information if a company ceases operation (or is bought by, merged, with another organization). What happens to that information? (8) By what means does a PHR account holder designate a caregiver to have proxy control of a PHR? What are the circumstances in which a caregiver may set up proxy access without the explicit consent of the PHR account holder (e.g., when a person has dementia)? PHRs represent a newly available vehicle for consumers and their families to collect and maintain a wide variety of medical and health information. While there are a number of "early adopters" using PHRs, the continued viability of PHRs will most likely depend on increased public awareness of these types of services, acceptable and clear privacy and security policies, increased efficiency in populating and updating the PHR with personal health and medical information, and a better understanding of whether and how PHRs will be used in interactions with health professionals. Larger public policy issues affecting health information standards and interoperability and market changes—such as an increased focus on "consumer-directed health care"—will also shape their evolution. It will be important to monitor the development of PHRs as they evolve to meet the needs of future patients and their families. 16 REFERENCES AHIMA e-HIM Personal Health Record Work Group. (July-August 2005). "The Role of the Personal Health Record in the EMR." Journal of AHIMA 76, no. 7, pg. 64A-D. California Healthcare Foundation. (November 2005). National Consumer Health Privacy Survey 2005. Oakland, CA: California Healthcare Foundation. Harris Interactive. (August 2004). Two in Five Adults Keep Personal or Family Health Records and Almost Everybody Thinks This is a Good Idea. Rochester, NY: Harris Interactive. The Kaiser Family Foundation/Agency for Health Care Research and Quality/Harvard School of Public Health. (November 2004). National Survey on Consumers' Experiences with Patient Safety and Quality Information. Menlo Park, CA: Kaiser Family Foundation. Markle Foundation. (October 2005). Attitudes of Americans Regarding Personal Health Records and Nationwide Electronic Information Exchange: Key Findings from Two Surveys of Americans Conducted by Public Opinion Strategies. New York, NY: Markle Foundation. Markle Foundation Connecting for Health. (July 2004). Connecting Americans to Their Healthcare. New York, NY: Markle Foundation, page 48. 17 APPENDIX A LIST OF 24 PHR SITES REVIEWED Company Name Product Name URL Access Strategies Follow Me www.followme.com Bioimaging, Inc. CapMed PHR www.capmed.com Derryfield Digital Health Records on CD www.healthrecordsoncd.com GC Publishers Guide to Good Care www.theguidetogoodcare.com Health AtoZ Personal Health Record www.healthatoz.com Health Histories Health Histories www.healthhistories.com iMetrikus Medicompass www.medicompass.com/diabetes i3Archive MyNDMA www.i3archive.com/i3Archive/jsp/index.jsp Innovision Corp. CheckUp www.checkupsoftware.com KARE Info. Serv. K.I.S. Medical Records www.kismedicalrecords.com Laxor LLC My Health Connector www.laxor.com Medem iHealthRecord www.ihealthrecord.org Medicalert E-HealthKEY www.medicalert.org Med-Info Chip Med-Info Chip www.medinfochip.com MyMedicalRecords MyMedicalRecords www.mymedicalrecords.com Peoplechart Corp. Medical Record Serv. www.peoplechart.com Personal MD Health Manager www.personalmd.com Records for Living, Inc. HealthFrame www.recordsforliving.com REDmedic REDMedic www.redmedic.com (No longer available to the public) Securamed, Inc. Securamed www.securamed.com/ SirkPath, Inc. SynChart www.synchart.com VIM Systems VitalVault www.vitalvault.com WakefieldSoft, LLC HealthfilePlus www.wakefieldsoft.com/healthfile/ WebMD Health Manager https://healthmanager.webmd.com 18