Personal Health Records: PHRs and Privilege

Report home | Read the report (PDF) | Previous section | Next section


Many people are aware that health information may be privileged, but few – including some physicians – fully understand what that means. The physician-patient privilege (and the sometimes separate psychotherapist-patient privilege) offers some protections for confidential communications between physician and patient.

The privilege is statutory, is of limited utility, is not always available, and has extensive exceptions. This is not the place to discuss the complex legal details. When privilege does apply, the privilege can prevent a physician from disclosing a confidential communication with a patient. The privilege provides a significant privacy protection when it is available.

One basic requirement is that the privilege generally only applies when a communication is truly confidential and between physician and patient only. Traditionally, if a spouse or a nurse is present at the time of the communication, the privilege does not apply. Some statutes maintain the privilege even when a spouse or nurse is present, however.

What happens to the privilege when a consumer instructs her physician to send a copy of a health record to a commercial PHR company? Because PHRs are new, and there has been no reported litigation, the answer to this question is uncertain. However, it is seems certain that a prosecutor or another person who wants a consumer’s health record will argue that the consumer waived any privilege by sharing the record with a third party. A court is likely to agree that the patient waived the privilege by consenting to the disclosure.

Use of a PHR by a consumer on an office computer or other employer-owned Internet access device may also affect the privileged status of health information. Most employers reserve the right to read electronic mail sent over an employer’s network, and the exposure of electronic mail to the employer could undermine any privilege. The same may be true for any other use of an employer’s computer facilities, including use of an office computer to read or add information to a PHR. Employers may reserve the right to review all activities on their computer facilities, including using keystroke loggers and other tracking techniques. That kind of review may undermine the privilege of any health information that passes over an employer’s system, whether between employee and physician or between employee and PHR.

At a minimum, the consensual sharing of a record with a commercial PHR vendor will not enhance the record’s privilege, and it could defeat the privilege altogether. This is not a trivial issue, and it is one that could come as a surprise to many consumers and health care providers.



Roadmap: Personal Health Records – Why Many PHRs Threaten Privacy: II. Discussion – PHRs and Privilege


Report home | Read the report (PDF) | Previous section | Next section