Giving patients access to their medical records via the internet: the PCASSO experience.
OBJECTIVE
The Patient-Centered Access to Secure Systems Online (PCASSO) project is designed to apply state-of-the-art-security to the communication of clinical information over the Internet.


METHODS
The authors report the legal and regulatory issues associated with deploying the system, and results of its use by providers and patients. Human subject protection concerns raised by the Institutional Review Board focused on three areas-unauthorized access to information by persons other than the patient; the effect of startling or poorly understood information; and the effect of patient access to records on the record-keeping behavior of providers.


METHODS
Objective and subjective measures of security and usability were obtained.


RESULTS
During its initial deployment phase, the project enrolled 216 physicians and 41 patients; of these, 68 physicians and 26 patients used the system one or more times. The system performed as designed, with no unauthorized information access or intrusions detected. Providers rated the usability of the system low because of the complexity of the secure login and other security features and restrictions limiting their access to those patients with whom they had a professional relationship. In contrast, patients rated the usability and functionality of the system favorably.


CONCLUSIONS
High-assurance systems that serve both patients and providers will need to address differing expectations regarding security and ease of use.
Masys
Daniel
D
Biomedical Informatics, School of Medicine, University of California, San Diego, La Jolla, California 92093-0602, USA. dmasys@ucsd.edu
Baker
Dixie
D
Butros
Amy
A
Cowles
Kevin E
KE
D022126:Access to Information / Q000331:legislation & jurisprudence; D002140:California; D016494:Computer Security / Q000331:legislation & jurisprudence; D003219:Confidentiality / Q000331:legislation & jurisprudence; D020408:Health Insurance Portability and Accountability Act; D006801:Humans; D020407:Internet / Q000331:legislation & jurisprudence / Q000706:statistics & numerical data; D016347:Medical Records Systems, Computerized / Q000331:legislation & jurisprudence / Q000706:statistics & numerical data; D014481:United States; D014584:User-Computer Interface