Medical Privacy Malpractice 
Think before you reveal your medical history

Some people have a utopian vision of online healthcare. Web sites will provide encyclopedic medical information. Doctors will interact with patients online. And meanwhile, insurers, Medicare and Medicaid will take care of the bills. But the electronic convergence of doctors, patients, insurers-and employers-has given rise to unprecedented threats to privacy.

PC World estimates that 26 million Americans logged on to health-content Web sites in 1999 to research medical conditions and download information. There are now some 20,000 of these sites, and more are appearing every day. We can't vouch for the medical information on these sites, but we can tell you this: when you browse, someone is very likely to be watching.

Many of the bigger sites invite users to create a personalized Web page where they can acquire medical information tailored specifically to their age, gender, medical history, diet, weight and other factors. Some sites offer alerts on chronic conditions, health and fitness quizzes, and even the opportunity to store one's own medical records and prescriptions online-in case of emergency.

Who has access to this information? Insurance companies? Prospective employers? Random strangers? Can the information be used to deny insurance coverage or employment? What if the information is wrong? Will people be allowed to review and correct their files?

The California HealthCare Foundation recently examined the privacy policies and practices of 21 popular health sites-including DrKoop.com, Drugstore.com, and WebMD.com. They found that visitors to the sites are not anonymous, and that many leading health Web sites don't practice the privacy policies they preach. In some cases, third-party ad networks run banner ads on the sites which collect information and build detailed profiles of each individual's health conditions.

A Georgetown University report called privacy "the loose link in the chain of trust that must be repaired if health Web sites are going to gain consumer trust and confidence."

Hypothetical Protection from HIPAA
Online medical privacy regulations and common practices are currently unsettled. The new Healthcare Information Portability and Accountability Act (HIPAA) requires the U.S. Department of Health and Human Services to adopt national standards for the confidentiality of electronic transmission of health information. But those regulations haven't been worked out, so we can't predict how much protection they'll afford.

In any case, companies will have two years to comply with the HIPAA regulations once they're released. Meanwhile, various state legislatures are moving to enact broader privacy protection for medical records. Until the dust settles, we recommend caution. Think carefully before you decide to reveal your sensitive medical information on the Internet.

For more information on medical privacy issues, try these sites:

National Coalition for Patient Rights (http://www.nationalcpr.org)

Health Privacy Project (http://www.healthprivacy.org)