First Read Ziff Davis Enterprise
Advertisement
Advertisement
Wednesday, May 21, 2008 10:04 PM/EST

Weighing the Pros and Cons of Online Medical Records

In my blog on May 19, I presented my arguments on why people should stop and think carefully before they decide to put their personal medical records on the newly launched Google Health platform or any other health Web site.

The next day, Matthew Glotzbach, product management director with Google Enterprise, presented his views on why enterprises as well as individuals are shifting to cloud computing for data storage and application processing. Glotzbach discussed this issue during his keynote speech May 20 at the Software & Information Industry Association's Netgain conference in San Francisco.

My question is whether or not Google in particular and the Internet in general can be trusted to safeguard our health records, arguably the most sensitive documents we possess.

Glotzbach said that one of the important reasons why enterprises are moving to cloud computing is that data security in the cloud is far more reliable than the blundering data security efforts of many enterprises and government agencies.

Enterprise data security, he said, is a "big gate with no fence" because the biggest security threats aren't found at the corporate data warehouse. They are at the endpoints of the network on the laptops, hard drives and flash drives of end users. He recited the familiar litany of recent data breaches that made the news, such as reports that the Federal Bureau of Investigation has itself lost 160 laptops in the last 44 months.

Glotzbach noted that more than 2 million laptops are stolen in the U.S. every year, and many of these laptops contain sensitive corporate information, including customer IDs and Social Security numbers. He also quoted a statistic that 68 percent of USB thumb drive owners have reported losing these devices at one time or another and more than 60 percent of these drives had sensitive corporate data on them.

But my concerns about Google Health are even more fundamental than that. Companies such as Google, Microsoft and AccessMyRecords.com want to encourage people to put their health records online. People are being asked to do what few people ever had the ability to do before, digitizing their personal health records and storing them in an online database ready for access at any time.

Health care professionals have certainly recommended that people assemble their health records and medical histories in folders or three-ring binders for reference as needed by the patient or emergency medical personnel. People have long had the ability to digitize and store their medical records on their PCs.

But now individuals have to make the same decision that has confronted enterprises when they consider whether to switch to SAAS (software-as-a-service) applications in which their proprietary data about customers, sales, finances or product specifications must leave their own data centers and move into the cloud.

If enterprises trust their on-demand application service providers to safeguard data that can be worth millions of dollars, why shouldn't individuals?

I would ask whether or not the benefits of having personal medical records online in a central repository are worth the time and effort required to get them online. Then I would ask whether the benefits of having those records online are justified by the decision the patient makes to place them in the custody of a third party's data servers.

To me it seems like an awful lot of trouble and at least a little bit of risk for a modicum of convenience. Will having these records online really make me any healthier? Will the act of storing them in the cloud make me exercise more, lower my cholesterol, watch my blood sugar and control my blood pressure? I don't see why if I wasn't already following my doctor's advice.

Will my doctors make better treatment decisions for me? That hardly seems likely, since they already have their own copies of my records in their files, whether they are paper or electronic.

For myself, I'm content to take my chances with the records scattered about in the files of hospitals, physicians and insurance companies.

Comments (10)

A very interesting perspective I agree but what if in an emergency situation and the only information available to the intervention group is your online medications and history? What if in another country? What if your currently active drugs have major side effects with a newly prescribed drug from another doctor or your medical condition has a side effect with a newly prescribed drug? What about all the prescription errors that result from doctor's hurried hand-writting? Is the risk worth the returns? One can easily remain anonymous with their medical profile if security is a major concern. I have put my profile on Google Health and my parent's and my children's.

I read with great interest your blog about Patient Health Records (PHRs). MyMedicalRecords.com (MMR) is an advanced PHR and an Integrated Service Provider on Google Health.

Using MMR, complete patient records can be easily faxed, voiced, or uploaded into a password-secured, web-based account. An emergency log-in feature also allows access to your critical medical information in the event of an emergency, and it has a drug interaction database for prescriptions, as well as many other features.

Perhaps you and your readers would like to test drive MMR by signing up for 30 days free using the promotion code TRYMMR.
Scott Smith
Director of Public Relations
MyMedicalRecords.com
ssmith2@mmrmail.com
10100 Santa Monica Blvd #430
Los Angeles CA 90069
888-808-4667 ext. 123


Doctors very rarely use any information for diagnostic purposes that is written by patients. The clipboard form you fill out is only to flag a problem that the doctor will investigate themselves. Self entered diagnostic information on a web-record is very unreliable, and most doctors will not even bother, especially if the information has to be retrieved from the internet.
The best system so far is a big envelope that the patient carries. This can contain paper photocopies of lab reports, consultations from other doctors on letterhead, prescriptions, etc.
The best parts of the Google, Microsoft and other web-records will be the direct connections to external professional systems, especially prescriptions. But, since the internet connection is open-ended there are serious data breach concerns. At least with connected hospital systems such as RHIOs, you can have some idea who might gain access. These still don't allow patient control of access.
One of our current projects is a smart card and PIN, used by the patient for authentication, identification, and transport of health data. But this still needs to ultimately also include biometric verification.

Gene Greer :

The acceptance of on-line medical records and its value is in direct proportion to the number of physicians and medical facilities that are involved in your health care. My wife has numerous doctors and medical institutions involved in keeping her live and functioning. As we have moved around the country we have medical records scattered in California, Tennessee, Virgin, Maryland and the District of Columbia. What each and every doctor has discovered in treating my wife would be of great value to the overall holistic approach which has never occurred because the information is in so many places. There have been numerous test done and redone because the information was not shared between doctors. Add to that the interference of the health insurance industry in the care management because they don't have current information and you get a significant requirement for informational collaboration.

I am for the integrated medical record completely. I am presently the CIO for a speical needs children's hospital and special needs children's insurance plan and I know that collaboration between doctors seeing the special needs population is crucial. However we don't have the RHIO so information between practices and hospital can be shared to again have a holistic approach to children that see numerous care providers for their total care needs.

I am not sure if Googles approach is the right direction or not. But the need for an integrated digital medical records for those with multiple providers is definitely needed.

Gene Greer
CIO
The HSC Foundation

Larry George :

I see John Pallato has never been referred to a specialist by his primary care provider. Unless you hand-carry a paper copy of your complete folder with you, they never have the current data and often don't even have a record of why you're being referred. Showing up at a emergency room is another good reason for accessibility as Jimmy Fragos points out.

I do have concerns with security. One approach, although it would require more infrastructure than is currently implemented, is to use smart cards both for authentication and encryption. With the card, both you and the interested physician have web access to the data. Pull the card and leave the office and the physician no longer has access to your personal data - only you. However, this requires issuing smart cards and providing readers for physicians - although using a PC-card reader/writer is an inexpensive way to do this. And at least for the moment, laptops usually have a PC-card slot.

njomd :

I'm a physician practicing in a resort town. Having an online health record available when a visitor to our area gets sick could be lifesaving. It would certainly save aggravation and improve treatment.
Just finding out what medications a patient is taking (or is supposed to be taking) can be a huge hassle. People who are sick have a LOT of trouble remembering their medical histories. They're frightened, and can't think clearly because of the illness or injury. It's worse when they're also away from home. I can't tell you how many times I've asked about medications, only to receive an answer like "A sugar pill in the morning, and a water pill, and a pressure pill - wait, I think I take two pressure pills. Oh, and something for my heart - or is it for my heartburn?" I ask for more details, and get "Well, one of them is a little blue pill. I take that at bedtime." Or the patient pulls out a 7-day pill box and expects me to identify - by sight - each pill. The original pharmacy containers are, of course, home in the kitchen, 400 miles away. (FYI - pharmacists know what pills look like. Doctors don't.) People carry medication lists but don't update them. People don't know when they last had a tetanus shot, or whether they ever had a pneumonia shot. Sick people have trouble remembering details like this. Sometimes people are unconscious, or just too sick to even try to tell the doctor these details (Ever try to get information from someone who is vomiting uncontrollably?)
Or test results. If a patient has an abnormal lab value, is this his usual value, or is it something new? Was that spot on his chest x-ray there last month? Last year? 5 years ago? Is it bigger? Exactly what coronary vessel was angioplastied 3 years ago - distal LAD? proximal RCA? first diagonal? Are these EKG changes new, or were they on his last EKG 6 months ago?
Or take allergies to drugs. Many people don't know what they're allergic to, and allergic reactions can be life threatening. Conversely, a patient may say he's allergic to the wrong drug. (I saw a retired pharmacist today who told me he was prescribed dicyclomine at a recent ER visit. He was actually prescrbed - and was taking - doxycycline. There's a MAJOR difference...and he, of all people, should have known better.) Sometimes we can call the patient's regular doc and get these records. Most physicians are more than willing to fax me records if I need them. Unfortunately, this is often not possible at night and on weekends. Indeed, the patient's regular doc may not even be available, and the covering physician probably knows nothing about the patient. These factors are as much of a problem to physicians in the next town as they are hundreds of miles away. Paper records locked in your doctor's office on Saturday night may as well be on the moon.
And an inability to access these records costs money. LOTS of money. Tests are repeated because the treating physician needs the results and can't access the report from when that test was done last month.
Privacy concerns are real; I don't mean to belittle them. However, it's my experience that most sick people are more worried about getting treated properly than about their privacy.
So, Mr. Pallatto, if you want to rely on paper, I suggest you stay home, where your records are with your regular doc. For anyone who ever leaves home - well, bring on the Web-based medical record, linked to the doctor's EMR!

njomd

Dave :

I have two perspectives (at least) on this topic. The first is that of a patient who's spent a great deal of time in and out of the hospital seeing a myriad of specialists, surgeons and assorted health providers over the last 18 months. The cost, time and stress associated with having to constantly and consistently repeat information and procedures within the same facility is sometimes overwhelming (and this was in one of the best medical centers in the country!) It's even worse for those who have physicians spread across multiple providers. The Doc hit the nail on the head. I'd bet that most sick people are more concerned with getting good treatment than they are about privacy. There is evidence of this by the growing numbers of people participating in specialized forums, social networks, and blogs that are directed at specific medical conditions. They are sharing they're own medical data, whether the politicians, health care providers and payers like it or not.

My other perspective is that of an IT professional who's worked in and around healthcare for 20 years. A lot of money and time is spent protecting patient data and for the most part regulations and legislations, such as HIPPA have been a tremendous kiss on the cheek to audit and remediation firms in and surrounding IT. Entire segments of our industry have grown and prospered around the concepts of access control, audit trails, and electronic discovery. There are clearly scenarios where privacy needs to be protected, and most of those scenarios ultimately impact one's financial well being when violated. With that in mind, we have built financial systems and networks where an individual's financial data is largely secure and protected. Is it unreasonable to expect our industry to be able to develop the same, if not better standards for our health care records? I don't think it is, especially when the benefits of providing this data have clear cost (estimates of nearly $10K per admission) and quality implications. I think the issues surrounding sharing health information have always had more to do with control and power than they have ever had to do with privacy, IMHO.

If vehicles like Google Health and Microsoft Vault gain any traction at all, the folks writing legislation and those in healthcare need to take note. Even if they fail, the EMR train is already barreling down the tracks.

There are a number of companies already offering electronic medical records and media vehicles to transport them (Allscripts and Medavante for example. Even Medic Alert allows for storage and retrieval of a certain amount of medical information). What's more, payers, like Blue Cross, and Medicare are already driving the behavior of providers by determining payment based on key indicators and outcomes. It's a matter of time before those paying the bills will be demanding more cost efficiency on top of better outcomes through data sharing and EMR.

Gary :

I'm glad that you provided a fairly thought provoking post with valid questions. The same type of questions where raised about the use of telephones and more recently by businesses that weren't sure they needed to have a presence on the Internet. In both cases and so many more, people really didn't understand initially the power this shift in habits would have on our economy and life styles. This discussion needs to happen. But, as more of us start to pay a higher and higher percentage of our own health care costs, we will all want to have portability, save money on the proceeses and spend money on better outcomes. We will look back on this some day and wonder why we even debated this.

WonderAimlessly :

The concept of this technology is a great concept, however, the practice of using it remains questionable. Most likely, businesses will profit from it while the patient doesn't see any advancement in the treatment they recieve. If anything good comes of this, I would hope at least the research facilities can use it to track trends anonymously. Otherwise, I fear that it could lead to an impact on healthcare insurance coverage for the patient (because we all know how insurance companies would love to get their hands on all this data.)

Richard :

It is obvious that John Pallatto has never had a serious illness that required him to visit a number of specialists, clinics or labs. He also has apparently not spoken with anybody who has. If he had, he would know about the onerous requirement of being told to show up at least 30 minutes early for every new appointment in order to complete "history" forms. He would know what it is like to be handed a clipboard with four or five pages of forms that must be completed, laboriously and in great detail, before the appointment will be honored by the provider.

It is absolutely inane to be required to supply the same information, over and over again, just because physicians and other health care providers are unwilling, or unable, to share information. Lest you believe that this is a petty complaint, just wait until you develop a serious illness that is difficult to diagnose. You could visit as many as three or four different providers in a single day. You could easily spend an extra 1-2 hours a day sitting in a crowded waiting room full of people trying to write with clipboards balanced on their laps.

It isn't at all surprising that patients can't supply an accurate list of medications. I carry a list in my wallet, and I try to keep it up-to-date. I am getting really tired of copying all of the information every time I visit a new physician, clinic, lab, radiologist, etc. This includes non-sensitive information such as my address, phone number, insurance information, etc., etc., etc.

Here's an idea! Why not let the folks with the most at stake (the patients) decide for themselves whether they would permit their personal information to be kept in a central database. I know that many IT Departments don't believe in consulting with their users, but maybe just this once ...

Post a Comment

 
 


Advertisement
Advertisement