Standard Specification for Relationship Between a Person (Consumer) and a Supplier of an Electronic Personal (Consumer) Health Record

This specification covers the relationship between a person (consumer), organization, or custodian (or other authorized representative) and a managing (storing) organization (such as a web site or other organization). This will provide guidance to consumers, suppliers of personal (consumer) health records (PCHR) applications, and the public at large regarding the PCHR. Because the PCHR is distinct from the provider-based patient health record (PHR), the laws and conventions for provider-based patient health records may not apply to the PCHR. The PCHR supplier shall allow a consumer or other authorized individual easy access at any point in the PCHR application to the policies and standards to which the PCHR supplier site adheres, as well as their associated charges, if any. In a PCHR application, a consumer has the right to know about the following: the PCHR supplier's business model or a general outline of how its revenues are generated; how PCHR information is handled; how to get a copy of the PCHR; the extent of data mining, whether it is in aggregate or de-identified form, as well as options for opting-out of such data mining activities; PCHR supplier's privacy policy; options for transferring the PCHR to another supplier or elsewhere; provisions for identifying the audit trail for access to the consumer record when suppliers change and when changes occur in the business enterprise under which the supplier and record keeper operates; in case the business enterprise changes, the reissuance of privacy statements and positive reconfirmation of postal and mail address by the consumer following any corporate changes is recommended; and how to request deletion or destruction, or both, of a personal file at a PCHR supplier's system.