Aren't These the People Who Invented 'Patch Tuesday'?

Microsoft Corp. launched a Web site Thursday [Oct. 4] for managing personal health and medical information, but privacy advocates worry that neither the technology nor U.S. law will protect patients' most confidential details.

From the consumer's point of view, Microsoft's HealthVault site is part filing cabinet, part library and part fax machine for an individual's or a family's medical records and notes.

The free site can store medical histories, immunization and other records from doctors' offices and hospital visits, including data from devices like heart monitors. It is also tied to a health information search engine the software maker launched last month.

Users can dole out access to different slices of their health data via e-mailed invitations to doctors, family members and other people as the need arises.

Microsoft has been kicking around the idea of a health site since at least 2000, when Chief Executive Steve Ballmer described a "health vault" in a speech to financial professionals in New York.

The software maker isn't the first to jump into the ring. Across the country, groups of providers are starting "regional health information organizations" to share data electronically.

Insurance providers and private companies market their own flavors of patient-controlled storehouses of records, and employers including Wal-Mart Stores Inc. offer such tools to workers.

Steve Case, co-founder of AOL, has launched Revolution Health, an information Web site that offers a records management tool for paying members, and Google Inc. has indicated it will launch its own service.

Microsoft's Windows operating system runs more than 90 percent of the world's desktop computers, including those in hospitals and doctor's offices. The HealthVault site works with different operating systems and browsers, but Microsoft may have an edge with Windows desktop applications. The company launched one such program Thursday that helps upload data from devices like heart rate monitors.

The HealthVault site itself doesn't do much more than provide a window into stored information and a mechanism for sharing it. Microsoft hopes hospitals, doctors' offices, advocacy groups and insurance companies will build Web applications that patients will want to use.

The American Heart Association, American Lung Association and other organizations already have applications in the works, Microsoft said. And devices including blood glucose monitoring systems made by Johnson & Johnson will be able to upload data into the system.

Microsoft said CapMed, which already markets personal health record tools, also plans to create an application for HealthVault, as does Kryptiq Corp., whose program will help doctors send and receive information from HealthVault with technology they already use.

Microsoft said it plans to support HealthVault with advertising revenue from the search portion of the site.

In an interview, Sean Nolan, chief architect of the company's two-year-old Health Solutions group, characterized this "beta" launch of HealthVault as an early step into a difficult industry.

For one thing, there's no guarantee any two providers will call the same treatment or lab work by the same name.

Then, many health records are not yet ready to be handled this way. Between 80 percent and 85 percent of doctors in private practice don't keep electronic records, and hospitals aren't much better, according to Lynne Dunbrack, program director of market research group Health Industry Insights. Paper records can be scanned or faxed to create an electronic version.

When it comes to technology, health care is "where other industries were in the 1980s," Dunbrack said.

As the industry increases its use of data sharing, opportunities for privacy violations will multiply, said Sue Blevins, president of the D.C.-based think tank Institute for Health Freedom.

The 1996 Health Insurance Portability and Accountability Act, or HIPAA, gives hospitals, doctors, insurance companies and other related entities access to patients' records without consent for various purposes.

This alone troubles Blevins, but "adding electronic ease just magnifies the problem," she said. Patients need to be able to control their own data, she said.

With HealthVault, Microsoft tried to build in protections from the start, spelling out exactly what data is shared each time the user connects to a new application or gives someone new permission to see a record.

What Microsoft is doing "is very, very good," Blevins said, but she added that she still has concerns about who really owns data that live on Microsoft servers, or what happens to records when someone dies.

While consumers have been willing to send financial details over the Web in spite of identity-theft horror stories, many still consider private medical information too sensitive to put online.

"Financial information is certainly sensitive, but medical information adds another whole degree of concern, when it's HIV test results or information regarding mental health treatment," said Reece Hirsch, a partner at the law firm Sonnenschein Nath & Rosenthal in San Francisco. "There's a lot of emotional distress associated with inappropriate disclosure of that information."

Microsoft's HealthVault isn't subject to many of HIPAA's rules or state medical privacy laws, because it's seen as the digital equivalent of patients asking doctors to fax them a copy of their records. But the software maker must still grapple with whether sharing data exposes it to greater financial risk in the event that hackers get their hands on confidential medical data.

Many state-level security breach notification laws have been passed in the last couple of years, giving identity theft victims the ability to sue companies whose systems are hacked or whose computers are stolen, Hirsch said. The health care industry is just one U.S. sector that's treading lightly as a result.

Some of the best sources of comprehensive health records data, major insurance companies, haven't agreed to build applications that work with HealthVault. But even if Microsoft were able to get providers and insurance companies to feed data into HealthVault, it's not clear consumers will use it.

Dunbrack, of Health Industry Insights, said most people who have access to a way of managing their medical records online don't even know it exists.

"Historically, personal health records have had really pretty abysmal track records," she said.

Link
Patch Tuesday