PHR and Privacy: What to expect

As part of the development of criteria for personal health records (PHR), the CCHIT Work Group has spent a great deal of time discussing your privacy and how your PHR should handle it.

Here are some of the areas we expect CCHIT Certified PHR products to meet:

• Consent. You should be in control of your personal health information and how it is used. PHRs that meet certification requirements must include safeguards that require you to give your explicit consent before your account is opened, or allow you to opt out of the service. It also must allow you to decide if your data can be collected, displayed, accessed, stored, released or disclosed.
• Controlling Access to your Information. Your PHR should give you the ability to decide what information is private and to restrict access to it. Your PHR provider must get your permission to gather or disseminate
  any information about you. You also decide who else can view information in your PHR, and limit the types of information that can be viewed.
• Conditions of Use. The conditions for using your PHR should be explicitly explained to you, and you have the right to challenge your PHR provider if it does not comply with the conditions of use. If conditions of use are changed, your PHR provider is required to notify you of the changes.
• Amending the Record. You should have the ability to change or request changes to your health record via email or telephone, and the telephone number of customer service must be posted on the Web site of your PHR provider.
• Account Management. Your PHR provider must have a way for you to terminate your account, if you wish, and to confirm that all your personal data has been deleted from the system.
• Document Import. Your PHR system should be able to retrieve health records, explicitly label and manage your personal health information and be able to distinguish between data entered by you and data retrieved from other sources.
• Data Availability. Your system should allow you to view or print your health information whenever you need it.