title: Assessing the HIPAA standard in practice: PHR privacy policies.
abstract: Health service providers are starting to become interested in providing PHRs (Personal Health Records). With PHRs, access to data is controlled by the patient, and not by the health care provider. Companies such as Google and Microsoft are establishing a leadership position in this emerging market. A number of benefits can be achieved with PHRs, but important challenges related to security and privacy must be addressed. This paper presents a review of the privacy policies of 20 free web-based PHRs. Security and privacy characteristics were extracted and assessed according to the HIPAA standard. The results show a number of important differences in the characteristics analyzed. Some improvements can be made to current PHR privacy policies to enhance the audit and management of access to users' PHRs. A questionnaire has been defined to assist PHR designers in this task.
authors.affiliation: Department of Informatics and System, Faculty of Computer Science, University of Murcia, Murcia, Spain. mariainmaculada.carrion@um.es
authors.forename: Inmaculada
authors.initials: I
authors.lastname: Carrión
authors.forename: José Luis Fernández
authors.initials: JL
authors.lastname: Alemán
authors.forename: Ambrosio
authors.initials: A
authors.lastname: Toval
mesh_terms: D003219:Confidentiality / Q000592:standards*; D057286:Electronic Health Records / Q000592:standards*; D020408:Health Insurance Portability and Accountability Act / Q000592:standards*; D055991:Health Records, Personal; D017410:Practice Guidelines as Topic; D014481:United States