Personal Health Records

Personal Health Records and the HIPAA Privacy Rule     

PERSONAL HEALTH RECORDS AND  THE HIPAA PRIVACY RULE      

  I NTRODUCTION   

A personal health record (PHR) is an emerging health information technology that individuals can use to engage in their own health care to improve the quality and efficiency of that care. In this rapidly developing market, there are several types of PHRs available to individuals with varying functionalities. Some PHRs are offered by health care providers and health plans covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule, known as HIPAA covered entities. The HIPAA Privacy Rule applies to these PHRs and protects the privacy of the information in them. Alternatively, some PHRs are not offered by HIPAA covered entities, and, in these cases, it is the privacy policies of the PHR vendor as well as any other applicable laws, which will govern how information in the PHR is protected. This document describes how the Privacy Rule may apply to and supports the use of PHRs.

What is a PHR? 

There is currently no universal definition of a PHR, although several relatively similar definitions exist within the industry. In general, a PHR is an electronic record of an individual’s health information by which the individual controls access to the information and may have the ability to manage, track, and participate in his or her own health care. A PHR should not be confused with an electronic health record (EHR). An EHR is held and maintained by a health care provider and may contain all the information that once existed in a patient’s paper medical record, but in electronic form. PHRs universally focus on providing individuals with the ability to manage their health information and to control, to varying extents, who can access that health information. A PHR has the potential to provide individuals with a way to create a longitudinal health history and may include common information such as...