Managed Care - July 2008 - (Page 7) LEGISLATION & REGULATION A doctor may only be interested in a patient’s medical care, says Jan Oldenburg, Kaiser Permanente’s “practice leader in the Internet services health portfolio,” but there’s much more information members may want to track on diet, exercise, blood pressure, and more that can help improve their health. And with a third-party vendor like HealthVault, members can also be assured of maintaining control of that record even if they switch insurers. Microsoft is an experienced player when it comes to online privacy and security, she adds. Kaiser members have a trusted relationship with the company, and Microsoft has “formulated a series of policies on privacy and security, engaging consumer privacy groups in validating and participating” in the process. “We are talking about a couple of companies [Microsoft and Google] that have really put some effort into doing the right thing,” agrees Deven McGraw, director of the Health Privacy Project at the Center for Democracy & Technology. Both have worked long and hard at getting privacy and security right. That said, she adds, “There is room for oversight. This is very sensitive health care information that is going to be more available on the Web than was ever the case before.” And it’s not just about Google and Microsoft, says McGraw. A host of companies will offer ways for consumers to better manage their health care — and not all of them are going to have the same standards as the giants. Says McGraw: “We need to make sure we are not just resting protection on being able to read and understand a privacy policy.” Oldenburg, though, is also quick to acknowledge that Kaiser Permanente and its members are in virgin online territory here. It is difficult to know what lies ahead. “I don’t think any of us know what direction this will go,” says Oldenburg. Members of the House subcommittee on health may not wait to find out. Just weeks ago, the members began circulating a memo on draft regulations that would subject the PHRs to a breach-notification law requiring them to alert people to an unauthorized access and giving the Federal Trade Com- mission the authority to enforce it. And it calls on the secretary of health and human services to “submit recommendations to Congress on the security, privacy, and breach-notification standards that should apply” to PHRs such as Microsoft and Google. The House subcommittee is doing the right thing by not just focusing on a new law, but directing the federal agencies to devise new regulations as well, McGraw says. New regulations may not come quickly, she says, but they are likely to be adopted faster than new legislation. At least one IT expert on the managed care side is concerned that lawmakers won’t be entirely fair in crafting new legislation. In prepared congressional testimony, James Ferguson, executive director of health IT strategy at the Kaiser Foundation Health Plan, agreed that consumers should be notified in the event of a breach and emphasized that all the players in this field —whether operating under HIPAA or not — should be held to the same privacy and security rules. “The draft bill exempts PHR vendors from notification requirements if the data in question have been encrypted,” Ferguson told lawmakers. “However, it does not provide the same exemption for [HIPAA] covered entities and business associates. We are concerned about the unequal application of the notice provision and believe all entities should be held to the same rules.” Portability is a strong argument for using a company like Microsoft, says Jan Oldenburg of Kaiser Permanente. Adoption will be slow This is one issue that insurers can’t ignore. “The advantage to insurers is mainly around consumer engagement,” says Carlton Doty, a senior analyst who has studied the trend for Forrester Research. “When you look at national insurers, many have been promoting payerbased health records. Aetna has one. United has one. But what Google and Microsoft provide is true portability. The consumer controls the data and the access to it, and the industry is moving to portability and interoperability with the provider network.” And with groups like Kaiser hooking up with Microsoft, he adds, “We’ll see some other insurers jump onto this as well.” Large PHR providers have done a good job, but still need oversight, says Deven McGraw, a privacy expert. JULY 2008 / MANAGED CARE 7
For optimal viewing of this digital publication, please enable JavaScript and then refresh the page. If you would like to try to load the digital publication without using Flash Player detection, please click here.