Are personal health records safe? A review of free web-accessible personal health record privacy policies.
BACKGROUND
Several obstacles prevent the adoption and use of personal health record (PHR) systems, including users' concerns regarding the privacy and security of their personal health information.


OBJECTIVE
To analyze the privacy and security characteristics of PHR privacy policies. It is hoped that identification of the strengths and weaknesses of the PHR systems will be useful for PHR users, health care professionals, decision makers, and designers.


METHODS
We conducted a systematic review using the principal databases related to health and computer science to discover the Web-based and free PHR systems mentioned in published articles. The privacy policy of each PHR system selected was reviewed to extract its main privacy and security characteristics.


RESULTS
The search of databases and the myPHR website provided a total of 52 PHR systems, of which 24 met our inclusion criteria. Of these, 17 (71%) allowed users to manage their data and to control access to their health care information. Only 9 (38%) PHR systems permitted users to check who had accessed their data. The majority of PHR systems used information related to the users' accesses to monitor and analyze system use, 12 (50%) of them aggregated user information to publish trends, and 20 (83%) used diverse types of security measures. Finally, 15 (63%) PHR systems were based on regulations or principles such as the US Health Insurance Portability and Accountability Act (HIPAA) and the Health on the Net Foundation Code of Conduct (HONcode).


CONCLUSIONS
Most privacy policies of PHR systems do not provide an in-depth description of the security measures that they use. Moreover, compliance with standards and regulations in PHR systems is still low.
Department of Informatics and Systems, Faculty of Computer Science, University of Murcia, Murcia, Spain. mariainmaculada.carrion@um.es
Inmaculada
I
Carrión Señor
José Luis
JL
Fernández-Alemán
Ambrosio
A
Toval
D016494:Computer Security / Q000331:legislation & jurisprudence; D003219:Confidentiality / Q000331:legislation & jurisprudence; D020408:Health Insurance Portability and Accountability Act; D055991:Health Records, Personal; D006801:Humans; D020407:Internet; D016347:Medical Records Systems, Computerized / Q000331:legislation & jurisprudence; D014481:United States