Patient-Privacy Issue Gets A Doctor's CarePatient-Privacy Issue Gets A Doctor's Care

The privacy spotlight will glare on the health-care industry next year as providers and insurers scramble to comply with new regulations governing the confidentiality of patient data. While some fight to delay or dilute those regulations, there's someone who champions even broader efforts to protect patient confidentiality, even as he helps create a patient-data IT system that's a model for other health-care institutions.

That person is Dr. Paul Tang, a licensed physician who's the chief medical information officer at the Palo Alto Medical Foundation. Tang contends that to maintain trust in the doctor-patient relationship, lawmakers must pass more-comprehensive legislation to ensure the privacy of health records. "Essential to that caring relationship must be a trust that health-care professionals will protect the confidentiality of patient information," he says.

Health-care providers, insurers, and transaction processors must comply with new patient-data privacy regulations included in the Health Insurance Portability and Accountability Act by June 2003. Those rules will force health-care companies to make big changes to their IT systems. But Tang thinks HIPAA doesn't go far enough, because it leaves out potential stores of personal data such as health-information Web sites.

So Tang has taken on the role of advocate and occasional lobbyist in addition to his post at the Palo Alto, Calif., medical institution that's a pioneer in the use of electronic medical records (EMR). He also sits on the board of directors and heads the public-policy committee of the American Medical Informatics Association, a group of 3,000 health-care IT executives that's a key lobbyist in the debate about how best to secure medical records and safeguard patient privacy. Congress hasn't shown much interest in a comprehensive privacy law, and Tang worries that lawmakers will try to legislate each type of health-information source separately. "We should apply universal precautions to all health data and raise the bar of protection overall," he says.

One reason people listen to Tang-who for 10 years developed technology at Hewlett-Packard for medical apps and workstations-is because he applies IT to help clinicians provide patient care, says John Glaser, CIO at Partners Healthcare in Boston, who's also on the AMIA board. Tang puts his ideas to the test at the Palo Alto Medical Foundation. Its EMR system is HIPAA-compliant and could serve as a model for other medical institutions (see "Prescription For Privacy"). The foundation implemented the system to give its medical staff easier access to medical records in any of its offices via a client-server network or the Internet, using Secure ID technology from RSA Security Inc. and Secure Sockets Layer encryption. Doctors, nurses, technicians, and clerical staff receive various levels of access to patient records, and all activity is logged to track misuse.

"His real focus has been on taking the foundation of our EMR and using it to build our online patient Web services," says Dr. Steven Lane, a family physician at the foundation and a champion of the project. About 1,000 foundation patients use the system to access parts of their own medical records on the Web. For a $60 annual fee, a patient also can communicate with his or her physician and ask for medical advice online.

What compelled Tang, 48, to pursue technology after his medical residency? A strong dose of frustration. "When I was a medical resident at Stanford, I was very frustrated that up to 30% of the time, physicians didn't have the patient's chart at hand when seeing a patient," he says. "I was concerned that this was affecting the quality of patient care."

That was 18 years ago, and Tang never thought so much time would pass before

he could access records and communicate with patients electronically. "It's the realization of a dream," he says. That's a dream that will need to become reality for other medical personnel and hospitals very soon.