Consumers Voice EHR Privacy Concerns

Even as the federal government and the AAFP focus their resources on ensuring that America's physicians get onboard with electronic health records, or EHRs, some American consumers are wrestling with confidentiality concerns about the technology.

That's according to the recently released 2008 Health Confidence Survey (16-page PDF; About PDFs). The Employee Benefit Research Institute, or EBRI, a Washington-based public policy research organization conducted the survey for the 11th consecutive year.

The survey was conducted via random telephone interviews with individuals ages 21 and older between May 24 and June 30. Consumers were asked a variety of questions about America's health care system, including questions about cost, quality, and their levels of confidence and satisfaction with their health care.

Consumers also answered a series of questions about EHRs, and, according to survey responses, more than 55 percent of the 1,000 people interviewed said it was important for health care providers to use EHRs rather than paper records. In addition, 60 percent of respondents said it was important that authorized providers have electronic access to their health information .

Although 21 percent of those interviewed said they would never access their records online even if they were available, 65 percent indicated they would likely or possibly take advantage of such an opportunity.

However, survey respondents clearly lacked confidence in the security of their online records; 62 percent of people interviewed were concerned that health records stored in an EHR and shared via the Internet would not remain private.

Steven Waldren, M.D., director of the AAFP's Center for Health IT, said consumers' concerns reflect their misunderstanding about how health information is used, exchanged and stored.

"People look outside the health care industry, and they see security breaches and identification theft," said Waldren. That causes a certain level of uncertainty and angst about what might happen to their private health information, he added.

"What consumers may not understand is that a lot of their health data -- such as billing information -- is already exchanged electronically," he said.

Waldren pointed out that electronically transmitted insurance company claims capture the patient's name and any health care services provided, including laboratory tests or diagnoses that the patient might consider sensitive.

"EHRs just put a spotlight on how data is already being used," said Waldren.

Paul Fronstin, Ph.D., director of EBRI's Health Research and Education Program and co-author of the 2008 study, said some patients are concerned about how their health information might be used against them.

Genetic testing offers a good example. Suppose, said Fronstin, that a woman tests positive for a genetic marker that indicates she has an increased risk for acquiring a life-threatening disease in the future. "Do you really want your employer knowing the outcome of that test?" asked Fronstin. Some people fear an employer would look at that kind of private health information before making decisions about who "gets the ax" when the employer has to lay off workers, he said.

"I think it's going to take time for people to trust the electronic medical records system because right now we don't have one. So until they're using it and seeing how it works, there's going to be large concerns about privacy." After all, it took a number of years for people to get used to ATMs and actually trust the machine to spit out the money, said Fronstin.

A solo family medicine practice in Kansas City, Mo., provides a good example of how patients learn to embrace and appreciate EHRs when given the opportunity.

Darren Killen, M.D., opened his practice six years ago and installed an EHR system from the beginning. His practice administrator, Anne Kisner, has been at the front desk since the first day, and she's never heard a patient express any concern about the privacy of his or her health records.

"We have well over 6,000 patients, and -- like every office -- some patients have very confidential health information," said Kisner. "Our patients are comfortable with the EHR, and we've had nothing but positive feedback."

Kisner said patients have even told that her they feel more secure in Killen's practice "knowing that there's not a paper chart floating around out there with their information in it."

Every patient's electronic record even includes a photograph of the patient. When Killen takes a patient call at home, not only can he access the patient's chart electronically, he can immediately put a face to the name.

And when patients are standing at the front desk in the office, "we're certain the person standing in front of us is who they say they are," said Kisner.

Waldren said many consumers just haven't experienced the value -- in terms of increased patient safety and convenience -- that an EHR can offer.

He also pointed out that consumers who demand absolute privacy for their personal health information could pay a steep price in terms of risks to their own health. For instance, a patient's undisclosed and untreated diabetes could pose a much greater personal threat than the confidentiality of the patient's personal health records.

"The key is to find a balance," said Waldren. Patients can choose to completely restrict the flow of personal health information, or they can release their information into an EHR with the stipulation that they receive notification whenever their health information is accessed and exchanged.

"Strong penalties should be in place and enforced if the patient isn't notified in those situations," added Waldren.