New federal regulations and technological advancements have allowed us access to manage our health data in ways never thought possible. However, many mobile health applications are consumer-focused and developed by 3rd parties, like Primary Record. This post will share the difference between patient portals and consumer health apps, the laws protecting privacy and security in consumer health applications, and how to evaluate the risks and benefits of mobile health applications for yourself and your family.
Patient Portals vs. Consumer Health Apps
Patient portals and consumer health apps are two distinct applications used to access and manage health data. Patient portals are typically offered and managed by healthcare providers or insurers, allowing patients to view their medical records, schedule appointments securely, and communicate with their healthcare team. Consumer health apps, like Primary Record, are often called 3rd-party applications because they are not providers. A growing number are offering to connect patient portals for individuals to organize and manage health information. Primary Record is a family-centered application that replaces a family’s three-ring binder.
Laws Protecting Privacy and Security of Health Data
HIPAA is a term used to quickly reassure that an application or service has the needed privacy and security practices when discussing health data. However, HIPAA was established to protect the privacy and security of individually identifiable health information, known as protected health information (PHI), held by health plans, most health care providers, and health care clearinghouses (these groups are called “covered entities”). These covered entities form groups called business associates that allow them to create, receive, maintain, or transmit health information about you to provide certain services. You likely sign a lengthy document yearly that allows these covered entities to share your health data with business associates.
When an application is not a “HIPAA-covered entity or business associate,” the laws around privacy and security fall under a different set of federal regulations. In the case of mobile health applications used by individuals and families, this is likely the Federal Trade Commission (FTC) Act. When building Primary Record, the FTC Mobile Health App Interactive Tool provided guidelines to ensure every family’s medical Homebase had in place the needed privacy and security measures such as:
- Obtaining authorization from the individual to access their health records to preserve the confidentiality
- Encrypting data and logging access and edits to records by users and systems to maintain data integrity
- Actively monitoring for security breaches or instances of unauthorized access to health records.
- Conducting regular platform security audits to ensure user privacy and data security measures remain in legal compliance
Evaluating Mobile Health Applications
When considering a mobile health application to share or store health data, it is important to evaluate its security and privacy measures. The first step is to review the app’s privacy policy and statements, which should outline how the app uses and protects data. Additionally, it is important to determine if the app complies with applicable laws and regulations, such as FTC.
It is also important to consider the app’s technical and physical security measures, such as encryption and two-factor authentication. Here is a quick checklist of other questions to ask before sharing or storing health data and Primary Record’s answers as a benchmark of what to expect in a mobile health application:
How does the application use and share data?
Primary Record does not provide or share an individual’s healthcare information. Primary Record’s customers control the use and sharing of the healthcare information they collect and manage.
How is the application making money if I am not paying for the service?
Primary Record is paid for by individuals rather than healthcare providers, insurance and pharmaceutical companies, or advertisers. This ensures the application’s mission and future are aligned with family caregiver needs.
Does the application log access and changes?
Primary Record logs access and changes and shares this log with users.
Does the application allow me to delete my account and all data stored?
Primary Record does and complies with California Consumer Privacy Act (CCPA) by granting users the right to know who accesses their information and who it’s shared with, the right to delete and opt out of the use of their information, and the right to non-discrimination.
What benefit will a family member or I get from using this application?
Primary Record users will benefit from a consolidated view of healthcare information across many healthcare networks and providers by having greater control over granting access to other family members or those who support a family member, allowing the larger family-centered Care Team to help the primary caregiver, and one centralized place for taking notes and uploading health-related documents.
Do the benefits outweigh the potential risk of health data being shared?
Primary Record believes the ability of families to organize a complete picture of health records, add context to the records and have tools to share records with healthcare professionals without limitations imposed by larger healthcare systems outweighs the risk of healthcare data not being used or accessed.
Conclusion
Using any mobile application comes with potential risks. Families must carefully evaluate the benefits of engaging with mobile health applications. Primary Record is one of a growing number of mobile health applications looking to help families manage their increasing access to health data. It is important to make sure the applications we use have the necessary privacy, accessibility, and security measures in place to protect health data from potential threats. We can ensure our health data is safe and secure by taking the necessary precautions and using applications and products that are transparent in their steps to protect data. If you have additional questions, Primary Record encourages you to contact us.
