By Maureen McKinney

April 22, 2008 | The entry of corporate behemoths like Google and Microsoft into the health information industry could have fundamental impacts on patient privacy, as well as on clinical research, according to an April 17 article in the New England Journal of Medicine.

The article, entitled, “Tectonic Shifts in the Health Information Economy,” differentiated personally controlled health records (PCHRs) from basic personal health records because PCHRs place primary control of data use and disclosure in the hands of patients. The authors cited the need for collaboration among PCHR providers, academic medical centers and the government in order to reach a consensus about appropriate methods of preserving data security and conducting research.

“Giving someone access to data that is institutionally controlled may have some benefits for the patient including insight into their own care, but with PCHRs, we go well beyond the walls of the institution,” explained Kenneth Mandl, associate professor at Children’s Hospital Boston, and co-author of the article. “Patients can engage with other institutions and entities, while the data flows into a repository that is exclusively controlled by the patient.”

One major concern with this dramatic increase in data liquidity, said Mandl, is that corporate entities entering the personal health record field are not held to the same standards as an academic research institution. Because companies like Google currently say they do not have to comply with the requirements and safeguards of the Health Insurance Portability and Accountability Act (HIPAA), there is no indication if they will adhere to research standards, he said.

“Under HIPAA, if one is to do research, they go before an institutional review board, which operates under the federal government and reviews protocols on how the data should be used,” Mandl said. “There are restrictions as far as aggregating patient data, benefits, risks, and notification. That’s a clear system of oversight, but with PCHRs, data from the repositories may be used for various kinds of research including drug approval and marketing.”

In addition, Mandl said, academic research centers may be at a disadvantage because not only do they have to comply with HIPAA protocols, they also might not have access to patient data pools as large as those of HealthVault and Google. If the largest and most complete databases reside on PCHR servers, it prompts questions about those companies’ research missions, the authors said.

In one example scenario provided in the article, a patient grants PCHR access to a clinical trial of a new medication, a medical social networking site, and an government-sponsored postmarketing surveillance program—none of which provide any informational control to medical centers.

“There is a reasonable argument that such control has been parochial and has created inefficiencies in fostering scientific discoveries and in delivering high-quality clinical care,” the authors said. “Nonetheless, if the pendulum swings the other way, and entire generation of clinical researchers in training will find themselves with second-class or no access to the best research resources.”

Patient privacy in PCHRs also remains uncertain and depends largely on how the hosting services of these companies approach the issue and inform their clients about the risks of certain types of disclosures, said Isaac Kohane, associate professor at Children’s Hospital Boston, director of the hospital’s informatics program, and co-author of the article.

Mandl and Kohane cited several critical steps that must be taken in order for PCHRs to be effective including the free exchange of patient data using agreed-upon standards, greater adoption of electronic health records, and new methods for protecting identity and security.

“Frankly, we don’t know what the optimal way is right now,” said Mandl. “We do think patients deserve guideposts, so we need to find the right mix that encourages discovery and, at the same time, protects the individual. That’s a conversation that PCHR service providers and medical centers need to be having.”