Is Medical Record Blackmail a Trend to Come?

CNN reports on what may be a harbinger of trends to come: Express Scripts, one of the largest pharmacy benefit management companies (PBM’s), received an anonymous threat that, unless it paid an extortionate demand, millions of its patient records would be released. Trends in data breaches generally suggest that Express Scripts will not be the last target of such blackmail.

Providers who face similar threats of blackmail should take a page out of Express Scripts’ playbook: it contacted the FBI, publicly disclosed the threat to the patients, and reiterated its commitment to protecting patient privacy rights. In so doing, Express Scripts provided a model from which others can learn.

With growing volumes of medical records stored electronically, the threat of records getting hacked will be an everpresent reality. The attraction to would-be extortionists is the idea that providers will pay just to avoid the negative publicity associated with patient privacy breaches, which upset patients worried about protecting their privacy and trigger legal investigations from government agencies like California’s new Office of Health Information Integrity (OHII), coming in January.

Microsoft HealthVault Partners with Aetna

Microsoft’s HealthVault or Google’s Google Health are the best known competitors is the emerging market for electronic health records (EHR) or personal health records (PHR). (The two terms are often used interchangeably, although EHR is meant to refer to the provider-controlled record (with myriad legal issues attendant to its content) and PHR to the patient-controlled record, so that, technically, both are PHR.) The Wall Street Journal reports that Microsoft has partnered with Aetna to transfer enrollee medical records to HealthVault. Patients enrolled in Aetna health plans will have the option of placing their Aetna PHR (e.g. claims, diagnoses, test results and prescriptions in HealthVault. The partnership with Aetna follows a June 2008 announcement of a HealthVault trial partnership with Kaiser. None of the major health plans (in California, Anthem Blue Cross, Blue Shield, United, Cigna, or Health Net) have yet partnered with Google Health.

Online Databases and Handheld Devices Allow Patient to Manage Care

Anne Eisenberg reports in the New York Times on new devices and software applications intended to make electronic health records useful for patients. (“Keeping Your Own Health Chart, Online,” Oct. 12.) For example, a forthcoming handheld device, the “Zuri” from Zume Life, will prompt users to take pills on schedule, record diet and exercise information, and track symptoms.

One big trend is devices that can upload health data (blood pressure, heart rate monitors, blood glucose monitors, weight scales) directly to online health records maintained through services like Microsoft’s HealthVault or Google’s Google Health. Storing the information online is not merely a matter of convenience for recording purposes; it enables data to be transmitted to healthcare providers for better quality of care and potentially for fewer or shorter visits to the doctor. Patients who dislike filling out initial intake medical forms, for example, can use NoMoreClipboard, a service that transmits the information directly to doctors electronically.

While the article concludes with a note of caution about patients’ privacy concerns, the concern is reminiscent of the worry that e-commerce might never overcome consumer fears about sharing credit card numbers online. While it remains to be seen which service provider(s) will win and how quickly adoption will take place, the question regarding online health records is more “when” than “if.”