Acceptability of a Personally Controlled Health Record in a Community-Based Setting: Implications for Policy and Design

Introduction

A personal health record (PHR) is a digital Web-based collection of a patient’s medical history in which copies of medical records, reports about diagnosed medical conditions, medications, vital signs, immunizations, laboratory results, and personal characteristics like age and weight are stored [1]. PHRs have been much discussed over the past few years, and considerable activity concerning them is occurring in health information technology, policy, and market sectors. In recent years, three personally controlled health record (PCHR) platforms have launched: Google Health, Microsoft’s HealthVault, and the Dossia consortium of large employers (including Walmart, Intel, and AT&T) which has a platform based on our open source Indivo PCHR. The PCHRs are a special class of PHRs distinguished by the extent to which users control record access and contents [2]. User control over these functions is governed by subscription and access control mechanisms and annotation capabilities within the record system [3]. It is generally assumed that increasing individuals’ abilities to view and share their medical histories or clinical decision support messages, including from distributed information sources, multiple care sites, and time periods, will result in better self-care preparation and motivation, reductions in treatment and medication errors, and improved health [2-7].

While anticipated benefits of PCHRs may eventually drive their diffusion, the overall approach of a citizen- or patient-centered health record system that interoperates with, but is not tethered to, a provider system represents a fundamental change from current approaches to health information management. Transforming standard practice may be challenging for a myriad of reasons [8]: low levels of health and technology literacy may impede technology uptake and use [9,10], distrust of Web-based health information systems [11], privacy concerns [12-14], and inequalities in access to/accessibility of computerized health information tools may slow adoption [15,16]. Adoption and use may be negatively effected by fears of disrupted and altered service relationships and pushback from providers. Rapid technology development and potential for benefit from PCHRs underscore the importance of understanding acceptability, barriers, and facilitators to their use.

We conducted patient-centered research on beliefs and reactions to the Indivo PCHR, a model PCHR deployed as part of a federally funded technology demonstration. Indivo is an open source PCHR platform that has served as the model for the burgeoning PCHR movement [2,17]. In situ/in vivo experiences and preferences for using PCHRs such as Indivo are important additions to survey and opinion research about PHRs in general. Indivo combines a Web-based health record with integrated capabilities for running a survey tool and rules engine, decision support and health messaging components, user-defined access controls, and sharing and annotation capabilities [2,7]. We deployed Indivo to a community of early PCHR adopters and undertook a range of formative research efforts to learn more about beliefs and behaviors governing PCHR use, stakeholder and lay understanding of the technology, and reactions to the system. Our primary aim was to learn more about the acceptability of PCHRs using Indivo as a test case by describing assumptions about the technology, as well as barriers and facilitators to its adoption. Our secondary aim was to identify design and policy issues germane to best practice technology development for consideration prior to refining the system for diffusion and evaluation.

Methods

Qualitative data about beliefs, attitudes, and preferences related to the personally controlled health record system were collected over a two-year period (May/June 2006 through April 2008). Questions and observational assessments focused on identifying assumptions, reactions, and preferences germane to the PCHR technology, as well as barriers and facilitators to its use. All study protocols were reviewed and approved by Institutional Review Boards governing human subject research at both the study site and Children’s Hospital Boston.

Setting

The study was sited in an urban area within the northeastern region of the United States. The setting was a community-based, university health maintenance organization, and the samples, described below, were comprised of persons affiliated with the site and setting.

Samples

A range of study participants was included in each of three formative research activities: administrative, clinical, and public health stakeholders (n ~ 20) from the study community participated in focus group and one-to-one interviews. Participants were adults, 35 - 60 years of age, with training in medicine and/or health care administration. There were 12 usability testers and 40 pilot participants, all of whom participated in observational assessments and usability and pilot testing antecedent to the system’s demonstration deployment. Testers included undergraduate, graduate, employee, and retiree populations 25 - 65 years of age. Approximately 250 users 18 - 83 years of age (with an average age of 53) participated in the demonstration study, from which 81 email communications to study administrators were logged and their content analyzed. All participants were English speakers, were volunteers, and provided written informed consent and HIPAA authorization for sharing personal health information when piloting with live records.

Analytic Approach

Narrative data were collected in three formats: (1) transcribed audio-taped focus group interviews conducted with stakeholders and pilot users; (2) written observational notes of usability testing compiled by the study team; and (3) text communication from email exchanges with demonstration participants. Collection and analysis of data for each of these activities involved the following specific activities.

We used a semi-structured protocol to collect focus group data. Questions about health information management, Internet use, and personally controlled health records were asked of early adopters, including administrators and clinicians at the study sites. Follow-up probes were used to elicit information about attitudes, preferences, and reactions to the PCHR model. A trained moderator and an observer facilitated group discussions, and all data were transformed to narrative (transcript) notes for analysis.

We used a formal usability testing protocol to observe interactions with, and reactions to, the PCHR in a semi-standardized fashion. The protocol involved engaging testers in interactions with an advance (beta) version of the final system configured as a live record. Each tester’s record was populated with the test user’s actual medical record data with individual consent and IRB approval. Testers completed specific tasks presented to them in a checklist of test activities (eg, review your laboratory data, add a “device” to your record in the appropriate location). A range of activities was included in the test, including registering, reviewing personal health information, amending health information, identifying categories of information (eg, laboratory results, problems, medications), completing behavioral health surveys, and sharing health information. Testers were observed by a trained team of developers and the study principal investigator who took notes about questions, failures, reactions, level of interest, and engagement. Each observer was assigned 2 - 3 testers to follow in a demonstration setting. Testers were asked to “talk aloud” their thoughts and actions as they completed the various team-specified functions. The objective was to learn more about how they interacted with the system to solve problems and to assess whether attempted actions matched expectations. At the close of testing sessions, semi-structured discussions were held to elicit feedback from testers. Notes made by observers were compiled as memos in narrative form which were used to fine tune the user interface and inform our understanding of reactions to the technology and individual engagement with personal health information.

We tracked all subject-initiated email communication with the study team through the full pilot period of six months. Emails were individually reviewed, redacted of identifying information, organized, and analyzed for major and minor themes as described above. Two independent, trained analysts reviewed communications, independently coded them, and then reviewed their summaries to arrive at a consensus. Narrative data were summarized for this report.

For analysis of all narrative/text data, two analysts (ERW and LK) worked independently with a shared rubric of major thematic codes to describe the data. Major constructs were operationally defined for thematic analysis as follows: Awareness of PHRs/PCHRs was defined as familiarity with the concept and/or practice of Web-based, patient-controlled health record systems. PCHRs were distinguished from PHRs and electronic medical records by the degree to which patients versus providers have control over the system and its information content. Privacy of personal health information was defined as the ability of individuals to control access to their PCHR and the security/integrity of health information [18,19]. Autonomy was operationally defined as individual control over selection and subscription to data sources; the ability to self-report or update health information; authorization of access and sharing permissions; and control over messaging. Additionally, several pilot users were debriefed about the consent process, considered a key component to the public face of the PCHR [20]. Analysts read all narrative data independently to assign codes to text fragments and develop subsidiary coding schemes. Coding schemes and transcripts were worked iteratively and inductively to refine them and achieve consensus. Data were triangulated across the three assessment activities to build a comprehensive picture of issues related to awareness, privacy, autonomy, and barriers to/facilitators for acceptability and use.

Findings reflect triangulation of data collected at different junctures over the formative evaluation and pilot period but do not reflect a pre/post assessment of acceptability. We report on experiences and perceptions common across multiple respondents. Illustrative quotations are provided in table form (with select exceptions where quotations are included in the descriptive text) to describe prevailing norms and experiences. Barriers and facilitators were identified by the study team, based on close observation of the pilot system implementation in the context of other formative data, and reflect the consensus of the study team, drawing on a synthesis of stakeholder and user reports and experiences generated from the data. Barriers and facilitators are categorized as primarily societal, interpersonal, or individual level factors. Practice recommendations for policy and design are suggested in the discussion section and summarized in a text box based on the pattern of observed barriers and facilitators and formative findings.

Results

Findings which concern levels of awareness of PCHRs, privacy, and autonomy, as well as variations by stakeholder group/role or age group are summarized below and discussed (Table 1).

Awareness of PCHRs

Participants demonstrated low levels of awareness about personal health record technologies including PCHRs. Prior to the pilot deployment, none were using automated systems to store or manage their own health information, and none had heard about or followed public or professional discussions about PCHRs. No age differences were evident in awareness about PCHR technology in general. Variation in understanding about subscription models to sources of personal health information (PHI) may have been present. Younger individuals and students (ie, those in the 18 - 35 approximate age range) appeared more familiar with the concept of subscribing to a data system; however, few subjects appeared to have considered this model for obtaining personal health information.

Overall, participants appeared to overestimate the extent to which personal health information is available and flowing electronically within provider systems. Many assumed that such information flow already occurs or that it was inevitable in the near future. Perceiving oneself as personally excluded from electronic health information systems was common. Desire for inclusion and control over PHI comprised a significant motivator for system adoption/use. No differences in age were apparent in these beliefs and perceptions.

Privacy

In general, we observed a moderate level of concern about privacy characterized by a pragmatic technology-supporting norm in which risks to privacy were considered unavoidable. Several specific mechanisms by which privacy might be threatened were identified, including: intentional identify theft, disclosure and misuse of information by insurance companies, accidental mix-up of records and their contents, mismatch of medical records data with personal health records, and misuse and inappropriate viewing, including “snooping” and attempts by health professionals to track or follow-up on outcomes of former patients and co-workers. Participants recognized the potential that privacy could be breached and that such breaches could result in serious harm. The most salient adverse outcomes related to breach of privacy were threats posed to insurability and/or denial of employment or care. Across all groups of subjects, the possibility of an audit check appeared to be among the most reassuring and accessible options for safeguarding privacy and building confidence.

Perceived risks to privacy were offset by an understanding that one’s privacy is risked in paper information exchange as well. Concerns about inadvertent or intentional breach of privacy were discounted by the high value placed on ready access to health information, especially in emergency conditions.

Students and younger users (typically those under 50) may be more sophisticated than older users about technological strategies for ensuring privacy. They appeared familiar with a range of technologies to improve privacy and security including use of encryption, digital signatures, and certificates. Despite their greater technological sophistication, younger users may possess a limited understanding of harmful consequences of sharing information and maintaining a lax privacy practice. In focus groups, young adult subjects (18 - 35 years of age) expressed widely varying opinions about whether it was safe to share health information with persons who were not providers; moreover, younger individuals appeared to be poorly informed of, and to have a naïve appreciation for, potential risks to insurability or employability related to disclosure of health information/records and problems.

Older and retired participants perceived risks related to a breach of privacy and reported they have “less to lose” than younger and employed persons. Some participants expressed concern about stigma or discrimination resulting from the release of PHI. Risks from inadvertent release of infectious, mental health, and chronic disease diagnoses were all recognized, with no clear emphasis on one category of illness as being particularly problematic. Participants, especially older ones, were worried that information disclosure through a PCHR could impose an emotional burden on family members.

Across age groups, many individuals assumed that sick individuals would be acutely concerned about privacy risks and less willing to participate in electronic information exchange/data sharing than healthy individuals. The assumption that sick persons are more concerned than healthy persons with privacy was not borne out in preliminary findings. For some users, chronic illness appeared to offset perceived risks associated with information sharing and motivated demand for accessible and transmissible information, as indicated by one participant:

I would be very interested in having access to all my records. I think this type of program will make my life in particular a whole lot easier.

Within the pilot, concerns for privacy were rapidly overridden by the need for help understanding technical or clinical issues. Participants readily disclosed personal information about diagnoses, conditions, and complications with project staff through email communication in the context of verifying and understanding information in their record:

Hello, I'd like some explanation of the health record that has been posted on my indivo page. There are things there I've never heard of, and important things that aren't there. I don't know what anything means .... Something says I was screened for malignant cancer of the cervix. When? I don't remember anything like that. And viral arthritis? When? What? Please explain, please refer to me to someone who's in charge.

Some participants shared nonclinical, identifying information, including passwords, in email exchanges with project staff. Actual privacy practices were different from espoused privacy concerns for some participants, and substantial vulnerability to privacy risks was observed.

Autonomy

Users expressed high value and interest in the concept of autonomy and welcomed greater access and control of their health information. While highly valued, autonomy was perceived as a double-edged sword. Sticking points included concerns about the locus of responsibility for maintaining the accuracy and integrity of PHI. Users wanted assurances that outdated or erroneous information that they identified and amended in their personal health record would be updated in subscription data sources. They were concerned about ramifications of intentionally or inadvertently changing PCHR contents and nervous about entering their own information using the system’s tools for annotation. Discomfort among some users with the idea of personal or patient annotation was echoed by providers and health service administrators who framed this concern in terms of quality of care, completeness of health information, and risks for liability.

While individual control over PHI was valued highly by younger/student participants (18 - 35 years of age), substantial variability was evident in opinions about the safety of granting write access control over their records to any other person, including for some, a primary care provider. Some viewed the patient/record owner as the final arbiter of a record’s contents, while others considered the primary care provider as the final arbiter. The value older participants assigned to personal control and autonomy, including as a source of accessible information in emergency conditions, was mitigated by the concern that their records could be inaccessible should they become impaired due to illness or age if they did not arrange for access by significant others or proxies.

Generally speaking, users placed a premium on the ability to control access to their health information and, generally speaking, favorably viewed options to control access to their PHI and share their records with members of their family or close social group (significant others, etc). Nevertheless, few users formally shared their records in practice despite the ability to do so; those that did used workarounds or informal—and riskier—approaches to sharing, rather than the formal sharing mechanism engineered within the system. The pilot system was implemented with a model of strict individual autonomy. This model was intentionally subverted by several users who shared passwords and account information with family members to advance caring relationships. Evidence of this turned up throughout the pilot as sharing of email accounts and record information, typically among older spouses as multiple email communications illustrate (Table 1).

Strict user control of incoming and outgoing messages delivered through the PCHR was viewed by many participants as an essential ingredient of an autonomous system and a prerequisite to sustained use. The ability to filter incoming messages by content and frequency was highly valued. Such abilities may be inconsistent with expectations of automatic tailoring of messages to contents of records and prior health communications. Vertical integration of systems such that messages, alerts, and communications are wholly integrated with user preferences represent design/implementation areas for which tools and best practices may be needed.

Barriers and Facilitators

Barriers and facilitators to adoption and use of the system were identified at institutional, interpersonal, and individual levels from across all formative data collected (Table 2). Several of these barriers and facilitators were notable for their broad policy and practice implications and are highlighted here.

Uncertainty about locus and extent of responsibility for ensuring PCHR accuracy given the distributed nature of subscription data sources comprised a barrier to adoption across social levels. Concern was expressed by administrators, clinicians, and patients/individuals about potential liability and quality of care risks associated with patient access to PHI through a clinically disintermediated system that permits user annotation and sharing. The potential for confusion and misalignment of information systems resulting from diverging health information in cases where users annotate or amend patient-reported information in the PCHR was noted. The absence of a mechanism for automatically feeding back annotations to subscription data systems concerned stakeholders from all groups. Concern over this issue may comprise an impediment to adoption at institutional and individual levels.

In a similar fashion, uncertainty about responsibility for clarifying the meaning and contents of records and concern about time requirements to address patient questions affected stakeholder buy-in and challenged norms for interpersonal relationships between patients and providers. While observed levels of problems were lower than anticipated, they were exacerbated by gaps in health and technology literacy. Older/retired persons in particular encountered technical barriers around system access, underscoring the importance of clarifying responsibility and resources for help. Lay and technical vocabularies do not match, causing consternation among users who see unfamiliar and/or frightening content in records. Providers are not always well positioned or resourced to respond to users’ questions.

Our PCHR system was available as part of an IRB reviewed demonstration. A dearth of guidelines and precedents for operating human subject research within a PCHR environment posed barriers to implementation and required education of IRBs and review panels. Research norms stipulating tight investigator control of information are contradicted by PCHR models of strict individual autonomy and control of information. The tension between these models needs to be understood and negotiated with IRBs to authorize research-based implementations. We developed and used an automated multistage consent process that included authorization for release of health information as stipulated under the Health Insurance Portability and Accountability Act [19] to alert and educate users to the significance of PCHR-enabled health information exchange. The multistage consent protocol was partitioned into: a first screen that provided summative information about the study and consent; a second screen that included the full consent and HIPAA authorization; and a third screen with a point-by-point affirmation of consent elements and electronic signature. Despite perceiving that the multistage consent process was arduous, users endorsed its length and the sequential conditioning of information as, “telling me something serious was happening” and “letting me know that you [system/investigators] take this approach seriously”. IRB review and a multistage consent process appeared to facilitate lay participation and trust in our research demonstration.

Workflow planning and organizational will are required to ensure appropriate effort is given to authenticating users. From the perspective of institutional gatekeepers and stakeholders, building an interoperable bridge with a vendor-based heath information system to subscribe to EMR data required a modest commitment of resources and had a minimal impact on deployment/use. A modest burden was experienced around authenticating participants/users and development to ensure appropriate export of data from source EMRs to PCHRs.

On the other hand, close alignment of the system with trends for consumer-centered health care and information systems facilitated acceptability at the institutional level and primed acceptance for the approach among some users [21]. The perceived value of the system for advancing knowledge and supporting care and the noncommercial nature of the project facilitated buy-in and participation at institutional and individual levels. The value of a patient reporting to a record prior to a medical visit in order to support care and optimize time was highly valued: institutions, patients, and providers all understand time and attention limits around care visits. The potential value of using a PCHR to support efficient use of a limited resource facilitated acceptance. Institutional stakeholders and users readily identified assets of the PCHR approach relative to portals, especially with respect to the suitability of PCHRs for maintaining life-long health information, traveling with individuals as they leave care settings, and supporting “family” records and socially embedded caring relationships.

Finally, the value of using the PCHR as a platform for increasing health literacy and health engagement was evident in feedback from participants provided during usability testing and communications with the study team, and this may facilitate future development. Users were keenly interested in having a personally controlled health record and in the possibility of the technology advancing toward a platform model that supported multiple functions, including user interface functions that would allow mouse-over explanations of medications, drill-down capabilities to investigate treatments, definitions of medical conditions, problems and treatment strategies, summaries of research evidence, and even—among some testers—linkages to research data. Similar interest was expressed in applications supporting personalized feedback and contextualization of health information, including support for individually reported survey/annotations collected within the PCHR. Interest in these functions was evident across user groups but was consistently expressed by younger (primarily student) users and working adults.

Discussion

Principal Results

Formative evaluation about acceptability of a PCHR in a community setting confirmed that issues related to privacy, autonomy, and accessibility of technology and health information all play a role in uptake and use of nascent systems. Low levels of awareness about personal health record technologies, including PCHRs, and lack of familiarity with the concept of subscribing to a health information data source may produce barriers to creating robust and complete records for some users. Keen privacy concerns coexist with pragmatic norms when addressing the risk of privacy. These factors were identified within the context of low levels of awareness about PCHR technologies and substantial thirst for access to, and control of, PHI. Privacy and safety conditions prefigured trust and were lynchpins for technology adoption and use, consistent with expectations [12]. Espoused concerns for privacy were belied by somewhat lax privacy practices, indicating a need for careful design-based protections in which users are continually educated and reminded about safe practice. This may be especially so among younger individuals whose privacy concerns may be naïve. The self-selected nature of the pilot sample precludes assessment of the degree to which privacy concerns impeded technology uptake. However, we saw little indication that privacy concerns alone constitute a barrier sufficiently large to impede broad adoption and use.

Strict protection of autonomy was highly valued among PCHR users. Nevertheless, autonomy practices were intentionally subverted within some family and social relationships consistent with others’ reports about management of health information in the home [23]. Perceived imperatives to solve technical problems and/or understand the meaning of health information rapidly eroded privacy and autonomy practices among users. Users readily disclosed personal information and gave others access to their records to solve technical problems or discuss record contents. Expressions of uncertainty about the locus of responsibility for verifying the accuracy of PCHR contents and for ensuring alignment of distributed health information systems where users could annotate the PCHR were voiced by all stakeholder groups and reflect tensions relating to the autonomous PCHR model.

Sharing capabilities were highly valued but underutilized in this early deployment. Findings confirm predictions of the needs for technical assistance and for education of users engaged with this new approach to information [24]. Assessment of, and planning for, the effects of broad technology diffusion on the workflows of a range of stakeholder groups is needed: impacts of this new approach on clinicians, information technology professionals, and staff providing ethical oversight and management of HIT and research need monitoring. Clear operational guidelines, governance systems, and administrative supports are needed, along with relevant consent and technical assistance materials. Caution is warranted when basing PCHR policy and design decisions on opinions about privacy and autonomy without practice-based evaluation, given the possibility for divergence between policy and practice and distortion of others’ preferences and sensitivities.

Implications for Policy and Practice

The following summative conclusions for design and policy work to advance PCHRs are offered based on observations from formative research relating to a first community-based deployment of an integrated PCHR:

• Discussion about technical and policy approaches is needed to identify strategies for aligning PCHR and subscription data systems, as feasible, to address the possibility of misalignment of information systems where individuals can amend/annotate patient-reported information in the PCHR. Discussion about design options that allow feedback, flagging or reciprocal notification of amended patient-reported information in the source record may be useful given concerns about misalignment and attendant risks for misinformation across individual user, administrator, and clinician groups. The acuity of this issue may increase with intensifying federal emphasis on rapid advance of PCHRs. In the scenario where the PCHR becomes the “record of record”, problems of alignment may be resolved.

• Clear lines of responsibility and dedicated resources are needed to support users and advance their understanding of the contents of their records and the meaning of health information to maximize gains from PCHRs. Gaps in health literacy may eventually diminish as the technology proliferates in the emerging marketplace of health information supports. However, discussion and testing of design-based mechanisms for addressing gaps, for example through mouse-over and drill-down capabilities, is warranted, as are exploration and possibly resource allocation for supports extrinsic to the technology that may serve less literate populations. These may include health coaches, interpreters and guidance staff, and/or technology/information system navigators. Consideration of the possible cost and benefit of supporting new ancillary staff positions may be needed in light of the possibility of interrupted or increased clinician workflow when/if users seek more information about their health and records.

• Clear guidelines and materials to educate users about this new technology, privacy risks and safety mechanisms, including those pertaining to sharing approaches are needed. Social marketing materials may be required to advance technology use, clarify dangers, and address barriers of trust and understanding and reduce potential for abuse. Consideration of demographic differences in need may be required: younger users may be especially naïve to adverse consequences of sharing health information, given their norms for intensive information system use and sharing through electronic social media; older users may face greater barriers related to technology literacy in general and special needs around understanding issues related to competency, proxies, and sharing across generations.
• Creation of a family-focused health record system, seen by many as a logical extension of the PCHR approach [22], is not yet supported by a clear technology and practice model. Subversion by users of strict individual autonomy models for PCHRs suggest the merits and relevance of exploring whether and how personally controlled health records can be designed and rooted in policies that reflect options for social and familial records to support caring relationships and collective knowledge.
• Advances in protocols and models for governing human subject participation in research-based PCHRs and research which enables, or operates through, PCHRs are needed. Education, training, and technical assistance materials are necessary for investigators, IRB panel members and offices, and individuals/subjects. Parallel mechanisms and supports are needed for monitoring fairness, safety, and transparency in commercial and service PCHR applications. For the latter, IRB oversight and consent may not be required although mechanisms for clarifying terms of use, information control, governance, quality assurance, and health information exchange are needed.

Limitations

To the best of our knowledge, this is the first report about the acceptability to users in a community-based setting of a personally controlled health record—in this case, a platform system that puts users in control of PHI from an electronic medical record to which they subscribed. This study was sited in a community of early adopters with relatively high levels of health and technology literacy. This work is limited by its single site/early adopter design and inherent selection effects stemming from that design. Continued study is needed which employs approaches representative of the population and standardized metrics to explore the potential for variations in PCHR acceptability, and barriers and facilitators which reflect age, role, and other characteristics suggested by findings of this formative work. The work is also limited by the early stage of technology development of the test system and the qualitative methods employed. These factors limit inferences about the broader acceptability of the PCHR technology and impact of various barriers/facilitators. Such limitations are, however, typical in formative research of a new technology or concept. Rigorous evaluation of PCHR deployments in expanded samples/settings are recommended to advance understanding of PCHR acceptability and impacts and to develop best practice approaches for addressing the institutional, interpersonal, and individual challenges.

Conclusions

PCHRs are widely viewed as a disruptive innovation that may be transformative in health care. Before we can expect uptake by consumers en masse, potential barriers to adoption and use must be addressed. Early experiences with Indivo, the original reference PCHR, have identified societal, interpersonal, and individual level barriers and facilitators to address through near term system redesign and revised social marketing of the technology. Responding to these observations and continued evaluation may substantially advance the use and relevance of the PCHR platform model otherwise endorsed by users.