The Health Record Banking imperative: A conceptual model

The United States Census Bureau has estimated that the percentage of the United States population over the age of 65 will grow from 12.4 percent in the year 2000 to 20.4 percent in the year 2040.¹ As a result, we can expect to see a continued upsurge in heart disease, hypertension, diabetes, stroke, cancer, osteoporosis, arthritis, and Alzheimer's disease. Rising health-care costs coupled with the increased prevalence of chronic diseases can be expected to compel opinion leaders and lawmakers to set societal standards for treatment quality, resource distribution, and patient rights. New health-care modalities, including those related to the management of information resources, are emerging to deal with this growing health and economic crisis.

One technology that will be essential in addressing these needs is that of the electronic health record (EHR). As our society becomes more connected via the Internet, as it purchases and sells products and services over this medium, and as it accesses and maintains financial services on Web servers, a new generation dependent on secure and private access to data will recognize and accept the importance of this means for documenting, storing, and sharing their vital health records on a Web-based system. Surveys, such as those performed by the Markle Foundation and Accenture, show that consumers have considerable interest in such a network and would be willing to pay privately for such a service.^2,3 Clearly the economic savings on a national scale provides an important impetus for developing a health-care information network as well.^4–6

In April 2004, President Bush issued an executive order calling for the “development and nationwide implementation of an interoperable health information technology infrastructure to improve the quality and efficiency of health care.”⁷ In response to this executive order, the Office of the National Coordinator for Health Information Technology (ONCHIT) of the Department of Health and Human Services (HHS) advanced a strategic framework to address this challenge with four primary goals: informing clinicians, interconnecting them, personalizing care, and improving population health.⁸

The formation of a health-care data exchange depends on a common set of standards to facilitate communication. The strategic framework of HHS promotes the development of these standards by use of regional health information organizations (RHIOs) and a national health information network (NHIN). RHIOs act as agents to “foster regional collaborations among health-care entities so that a patient's information can be securely stored in the local community but is electronically accessible to those involved with providing their care in that community.”⁹ The NHIN serves as the interconnecting infrastructure between the RHIOs, facilitating their interoperability and allowing the free flow of medical information with patients.

To advance the development process for the NHIN, HHS published a request for information (RFI) calling for outside input in the design and operation of this network. A number of common themes and key challenges emerged from the responses to this request.¹⁰ Respondents wanted a decentralized network architecture, using the Internet, with open standards and policies. The desired network would represent both public and private efforts and reflect the interests of all stakeholders. It would be patient-centric, protecting the privacy of personal health information. The federal government would take the leadership role and offer incentives to accelerate the network's deployment and adoption. Among the challenges listed by many respondents were the development of additional and better-defined standards, the conciliation of various contradictory inter- and intra-state laws concerning health information exchange, and funding the NHIN.

As an alternative approach to the NHIN, one which addresses those challenges as well as the four goals set forth by the ONCHIT, we propose a Health Record Banking (HRB) system. We believe that an HRB system would function as a sustainable institution, independent of long-term government funding. The HRB system objectives not only match those of the health information exchange that define the RHIO/NHIN structure, but also focus on a means for financial independence and a mechanism for fostering medical research. These objectives include uninterrupted access to patient records, maintenance of the rights of the consumer to control his or her personal health data, and provision of a means for storing all EHRs and data in fail-safe, readily accessible, secure, and restricted repositories.

In addition, the HRB system must advance the wide-ranging information needs of the health-care provider in the treatment of the patient, promote an environment conducive to knowledge discovery through large population-based research, and realize an independent, sustainable system focused on the secure storage and delivery of health data, while providing a solid and rational business case. Different banking models for health records have recently been presented,^11–13 and current proposals in both houses of the United States Congress^14,15 demonstrate a growing public interest for this type of solution.

Today's systems for recording and maintaining health records are nonstandard, partitioned, and consumer-hostile. A national interoperable health information infrastructure can transform this picture.¹⁶ By using this infrastructure, health-record banks have the opportunity to improve the quality and efficiency of health-care delivery, to facilitate true population-based research, and to develop a sustainable system with a rational business case independent of governmental budgets.

In order to meet the consumer's demands for ownership of all health records and control of information access for review by others, health-record banks will become the warehouses for all health data. These multi-use shared repositories will have common interfaces for receiving and transmitting data, use similar types of storage, and offer comparable services. In many ways, this type of repository will function like today's banks. Consumers (as well as health organizations and health-related businesses) will maintain different types of accounts, allow certain institutions (doctors, clinics, hospitals, etc.) automatic read or deposit access to their accounts, receive dividends for storing records in the bank and allowing access to deidentified health data (i.e., data with personal information such as names and social security numbers removed), and will have the ability to change banks, if so desired.

Accounts can hold different types of data. Consumer-centric personal health-record data might include all records about a patient entered by health-care workers, laboratory, pathology and radiology data, psychiatric records, dental records, health insurance records, hospital records, and pharmacy records. Additional data, such as monitoring device records, genomic data, health directives, personal health diaries, and living wills, could also be included. Joint accounts shared by families could allow access to information by a legal guardian in the case of disability or incompetence.

Through the electronic personal health record (ePHR, the equivalent of the commercial bank's individual or joint personal account), the patient can control his or her own data, maintain a complete record, and make any or all of the information instantly available to any caregiver at any time, anywhere in the world. Consumer-defined parameters can determine who has access to what information over what period of time. Permitted health-care providers can access all data in a paperless environment. All medical- and health-related transactions are recorded and entered into the ePHR. The handling of sensitive issues (e.g., psychiatric records and contagious diseases, such as HIV/AIDS) needs to be examined and determined through public deliberation. The use of the ePHR means that the subjective recall of medical history will no longer hamper timely or correct treatment of the patient.

Health-care providers may deposit all health records they have authored, correspondence, and administrative data into a provider health-record account (similar to the small-business accounts of commercial banks). Larger enterprises, such as hospitals and health maintenance organizations (HMOs), can store their records in business accounts comparable to commercial-bank corporate accounts.

Benefits
The medical research benefits of complete and accessible digital health records are clear. Huge stores of deidentified data would be available for rapid data mining in connection with many research questions about diagnostics, therapy, and education. In contrast with research limited to scores or hundreds of participants, health-record banks could make millions of relevant files immediately accessible to the investigator. Questions which heretofore could not be approached because of the limited availability of subjects and the expense of compiling data would no longer be unsolvable. Examples of this abound: the outcomes or side effects of different combinations of drugs or therapies for various diseases, unanticipated laboratory findings for various syndromes, and changes in disease patterns or progression, given a wide range of demographic, predisposing factors.

Equally compelling, though, is the business case, which provides benefits to consumers, medical research, and commerce. The consumer could have control of his or her records and receive dividends (money or health “credits”) for selling deidentified health data and for storing the health record in a standardized form at an established repository. The health-care industry, pharmaceutical industry, insurance firms, and medical researchers could reap great value from data mining and researching the enormous databases of deidentified health data and would readily pay for access to these data bases. Government agencies (allowed limited access to records) would be able to monitor sentinel events, thus receiving more precise information to aid in the development of a reasoned long-term health policy.

Realizing this vision requires attention to concerns of the provider and the consumer. Providers have long controlled the flow of information in health care; changing the locus of control to the consumer is no simple matter. Consumers may find this new responsibility confusing and even overwhelming, and be justifiably sensitive regarding the confidentiality and security of their personal health information. Clearly, major concerns which must be resolved prior to the implementation of an HRB system include the rights of the individual to view and, to a great extent, control personal health data, the role and rights of the physician in entering and retrieving data in the health record, the guarantee of secure and confidential health records, the determination of standards for data entry and storage, and other challenges.

In the following sections, we provide an overview of the HRB system and present a vision of how it could bring about a transformation in health-care technology. We identify and discuss 10 critical issues that must be addressed in the development and implementation of an HRB system.

To meet the challenge of preserving and protecting the privacy, confidentiality, and security of tomorrow's expansive medical records, to ensure their integrity and availability, and to enable rapid communication of their contents, we must look beyond traditional health-record storage. In many ways, we must use both creativity and an engineer's practical approach. In the following subsections, we describe our approach for the implementation of an HRB system.

In the commercial banking world, there are many different types of account holders, accounts, and even banks. These include small accounts (for private users who hold personal or joint accounts), medium-sized accounts (for small and medium-sized businesses), and large enterprise accounts (for corporations). A multitude of different types of accounts and client services are available to the customer—savings accounts, checking accounts, safety deposit services, and so forth. Certain banks specialize in particular aspects of banking, such as savings banks, savings and loan associations, credit unions, and investment banks. The bank's chief source of revenue is the reuse of the money it receives from its depositors (through lending or investment).

In general, the HRB system functions similarly to commercial banking systems. Table 1 illustrates how HRB compares with commercial banking. Many of the features found in the commercial bank today are clearly paralleled in the HRB system. The diverse patron groups include small account holders (individual consumers with a personal health record), medium-sized clients (physicians or group practices, pharmacies), and large enterprise customers (HMOs, hospitals). Distinct accounts are used for storing different sets of health data. Different health data sets may require unique search engines and have diverse storage specifications and access time requirements.

Specialty banks may store only a particular type of data (e.g., genomic data) or only maintain a particular type of account (e.g., solo physician or group practice accounts). Comparable to commercial banking, an important source of revenue is the leasing of deidentified data for reuse by commercial and research enterprises. Additional sources of revenue might include the provision of information disaster-recovery plans (and insurance) for individuals and enterprises, member service charges, health kiosks, health record curation (i.e., the conversion process of medical information extracted from paper-based health records and imported to databases in a standard format), and specialty service charges (e.g., those associated with consumer health-care financial advising).

The HRB system not only allows the consumer to store all personal health information in a secure virtual account (i.e., the ePHR), but, like in a commercial bank, it pays the account owner a dividend for storing this information. The records are owned and controlled by the consumer. In much the same way that a bank depositor maintains a bank account, the consumer determines who has access to which parts of the record over what period of time and who can deposit information in the record. The consumer grants various providers and data sources a variety of access and deposit rights to the health-record account, as illustrated in Figure 1.

Figure 1

The ePHR includes information from a wide range of health-care sources (e.g., records from doctors and providers; clinical, dental, and hospital records; radiology, laboratory, pathology, and genomic data, etc.), information added by consumers themselves (treatment directives, living wills, health diary), health insurance information, and possibly alternative therapy records. Each entry references the source of the item.

Many diverse parts of a patient's medical record are included in the HRB system. Today's electronic medical records, where they exist, are primarily text-based and include the providers' notes and laboratory data. This type of data takes up a relatively small amount of memory. Digital imaging, another essential part of the medical record, requires much more storage space for even the simplest of images. Two sets of data which will become much more significant in the future medical record are the genomic record and data from audiovisual/monitoring devices. Although selected parts of the medical record will be examined frequently, other sections will need to be accessed by the physician only occasionally. Nonetheless, all data sets must be available on demand and searchable. Finally, an audit trail of who has accessed or altered a file and when this occurred will always be a vital part of the record.

The HRB system sorts and places the data in different accounts according to type. Text-based data (e.g., caretaker notes, laboratory reports, and genomic data) is deposited in one type of account, and a second type of account includes all digital imaging, audiovisual/monitoring device data, and pathology image data. Table 2 provides many of the characteristics of a variety of health data sets.

Both to ensure security and to prepare files for potential leasing, all deposited files need to undergo processing before storage. This includes assigning an encrypting code, dividing the file into components that are permissible for leasing and prohibited from leasing, appending the record envelope information (discussed later), and cataloging files for leasing, and preparing a leasing data catalog. All records are deidentified (names and identifiers of all patients, providers, and locations are placed on an encrypted master list separate from the file).

To write an entry in a patient's file, the provider receives initial record access permission from the consumer. This allows the provider to view read-only files and create new entries and upload them to the consumer's health record. Permission to revise a new entry in the record is time-limited. Write access always requires two access codes (the consumer's and the provider's), verification of current authorization, and identity authentication. Although write access to files requires current consumer permission, providers permanently retain the right to read all components of a file that they have written and to view all reports specifically addressed to them.

When the provider writes a medical record entry, a copy is deposited in the consumer's personal health-record account, and an identical copy is retained by the provider for storage, either locally on the provider's computer or in the provider's health-record account, as shown in Figure 2. The provider's account contains all authored entries for multiple patients. A provider working in more than one setting may have multiple provider accounts. A specific patient's records may appear only in one of the provider's accounts and may not span multiple accounts. Provider accounts may include all documents authored by the provider, reports or correspondence addressed to the provider about a patient (including laboratory results), and all provider administrative data. Like ePHR accounts, a record bank log preserves a legal record of all provider account transactions (including all accesses and modifications).

Figure 2

The consumer may choose to sell his or her deidentified data in return for some dividend. This dividend may be given each time the consumer's de-identified personal health-record information is accessed or may be awarded in some other manner. The HRB system leases access to the deidentified data in data banks through a “bank association data exchange,” as shown in Figure 3. This exchange is designed for use by pharmaceutical and medical technology companies, insurance companies, research institutions, universities, and government agencies, as shown in Figure 4, and serves as an invaluable resource for research purposes.

Figure 3 Figure 4

Each ePHR is composed of an envelope information section (containing metadata which serves as a searchable index to the patient's record) and a letter contents section (which contains complete data). Each of these has relatively stable components, which are rarely altered, and labile components, which change more often. For an example of one proposed ePHR format with health record indexing, see Table 3. Envelope information includes both a static data section (containing demographic information) and a dynamic data section (composed of UMLS [Unified Medical Language System] terms for capturing medical terminology entered in the record and appended after each new ePHR entry). Satellite record bank systems can transmit deidentified-patient-record envelope information to the central bank association for use in preparing leasing databases.

When the central bank association receives a query from an interested third party, envelope information is compared to the query's parameters, and records corresponding to the query specifications are located. The deidentified records are then copied into a temporary query file to the bank association's data exchange. The temporary query file serves as an unabridged database, customized for use by the leasing researcher. Leasing of this file may be time limited, read access limited, or controlled in some other manner.

The choice of files to be accessed for a research question ultimately depends upon the question being asked and the aim of a study. For instance, if the question being investigated is, “How does the combination of drug A and drug B affect the libido?,” the most likely approach would be to search patient data records (initially screening the envelope headings of the files). If, however, the question is simply, “How often are drug A and drug B prescribed to the same person within a given time frame?,” then reviewing the pharmacy health-data accounts would be simpler, less time-consuming and cheaper. Another study question might be, “What types of physicians tend to prescribe drug A in combination with drug B?” This would most easily be answered by reviewing provider health-data accounts.

Legislation similar to that governing commercial banking institutions will be necessary to define consumer and bank controls, establish a regulatory commission and committees, and protect the consumer against loss in much the same way as the Federal Deposit Insurance Corporation (FDIC) does for financial accounts.

As noted earlier, vital challenges to the implementation of health information exchanges include establishing additional and better-refined standards addressing privacy concerns, paying for the development and operation of the NHIN and access to it, accurately matching patients, and addressing discordant inter- and intra-state laws regarding health information exchange. In addition to these issues, we have defined 10 additional issues critical to the development and implementation of an HRB system. The success of the HRB system model depends upon addressing and solving these significant concerns.

1. Standardization of data entry, sharing, and interoperability—Standardization of health-record data depends on the standards development process, governing bodies, the intended structure and parameters of the database, agreed-upon “acceptable” error rates for data fields, data retention and purging standards, and the establishment of a common platform. Open-source software may be of vital importance in addressing this issue.

2. Information security and Health Insurance Portability and Accountability Act (HIPAA) standards—Much of health data falls under the aegis of HIPAA. HIPAA standards are meant to ensure privacy and confidentiality, accountability, and auditability. Requirements regarding the handling of personal health data need to be considered, including which entities should and should not be covered. Ensuring the rights of the consumer to privacy and confidentiality is critical to establishing trust in such a system.

3. Work flow and data transfer—It is to be expected that providers may resist the changes in health-care practice and record keeping that are required for the HRB system. In order to minimize this opposition, workflow and the transfer of data in a new system must be no more cumbersome than they are today. A true and substantial improvement in workflow and data transfer must be a primary focus of the HRB system.

4. Business incentives and the development of a banking model—Clearly, developing well-defined business plans and systems which are economically sustainable is essential before the pursuit of such a radical change in our system of health care. Addressing this issue at the outset will determine the support the HRB system will receive and the direction it will take.

5. Patient identification and record matching—Unlike many nations, there is no unique identifier given to citizens in the United States. A patient in one system may be identified using both the person's name and Social Security number, while in another, the name may appear differently or the Social Security number may also be used by a spouse. Across systems, it is vital to match patient records with the correct consumer. If deidentified data is also used (for leasing and research purposes), the data exchange needs to ensure the anonymity of the consumer while ensuring the integrity of the data set for the purchaser.

6. Legal, ethical, and legislative concerns—The issues of legal liability, legislative mandate, federal oversight and regulation, and ethical considerations require engagement of the public, advocacy groups, and political leaders. These parties must discuss concerns regarding ownership of health data, public health, and safeguards to the continuity of the data.

7. Stakeholder acceptance and acceptance thresholds—The vast undertaking of establishing the HRB system will involve many stakeholder groups. Foremost among these are the consumers, the caretakers, the payors, HMOs, and health-care institutions. Without sufficient interest and support from each of these groups, the HRB system will not have the critical mass of consumers necessary to make it a viable enterprise.

8. Standardization of ePHR format and UMLS health-record indexing—The attributes of the data sets will be determined, in part, through discussion of standardization. One key component for inclusion in the health record will be an index of medical terms contained in the file. Using a meta-thesaurus and semantic network like that of the UMLS, each consumer's file will contain a guide to its contents.

9. Architectural design—Development of a general architectural plan, including functional specifications, may be loosely based on a wide range of systems including those used in large health organizations (like Kaiser-Permanente and the Veterans Administration's VISTA), banking systems, and others. Among the architectural issues to be addressed are those related to infrastructure, database development, integrity validation, and system operating speeds.

10. Determination of critical challenges and project implementation sequence—Before the implementation of the HRB system, it will be critical to address the challenges impeding the system's acceptance and development, establish the actual steps necessary for building such a system, and decide upon the appropriate sequence.

Multidisciplinary groups must be employed to consider the wide range of subjects related to each of these issues. The following is a short list of some of the representatives of domains who should be included: information scientists, infrastructure and technology engineers, health policy makers, health economists and academics, ethicists, government representatives and public officials, business investors, insurers and bankers, pharmaceutical industry leaders, drugstore and pharmacy group proprietors, financial experts, health-service-organization representatives, medical researchers, clinicians, health-care consumers, and members of patient-privacy advocacy organizations.

Development of the considerable infrastructure and enterprise for the HRB system demands a focus on both the details of the system and the vision. This system is aimed at providing timely access to accurate information and its appropriate use by the right people. Developing the crucial standards and building the core structure—a network for health records—will shape the future of health, health research, and health policy. A viable and sustainable health-record network which allows for the sharing of data and knowledge discovery will launch us into a new era of health care.

Further research must focus on addressing issues critical to the successful development and implementation of an HRB system. These include concerns related to all health information-exchange proposals, as well as those distinct to an HRB model. At this time, such issues loom large, given recent disclosures regarding privacy and security of veterans' health records and federal access to personal financial and telephone records. We note that such concerns must be resolved if we are to succeed in realizing not only the HRB system concept but also the NHIN and EHR initiatives already underway.

This research was supported in part by National Library of Medicine Grant 5 T15 LM007452-02. The authors would also like to thank Dr. Nkossi Dambita, Ms. Judy Douglas, Mr. Laurent Laor, Dr. Harold Lehmann, and Ms. Nancy Roderer for their roles in the development of this paper.

Accepted for publication July 23, 2006; Published online December 22, 2006.