The Role of Health Care Experience and Consumer Information Efficacy in Shaping Privacy and Security Perceptions of Medical Records: National Consumer Survey Results

Introduction

The Health Information Technology (HITECH) Act of 2009 put a number of federally funded initiatives in place to support the adoption and “meaningful use” of electronic health records (EHRs) by eligible providers, including physicians and hospitals [1,2]. These included financial incentives, initiatives to develop standards to exchange information electronically, and technical support for providers to adopt and use EHRs. A key and important element, which the HITECH Act also emphasized, was the importance of ensuring patient and provider trust in EHRs and the electronic exchange of health information [3].

The evolution of both technology and policy to address privacy and security needs is critical as providers’ use of EHRs has grown rapidly since HITECH [4,5]. As of 2012, almost three-quarters of physicians reported adopting an EHR [6]. As EHRs become the norm, a majority of patients’ medical records will become digitized, enabling providers to share health information electronically with other providers to better coordinate care.

As we transition from a paper-based to an electronic system of storing and sharing medical records and we make advancements to ensure the privacy and security of electronic health information, it is critically important to understand how consumers perceive these developments. Consumers represent important stakeholders in this process because it is their health information that is being digitized and shared electronically.

Consumers have expressed a desire for greater transparency and control over their health information, which many see as a key aspect of ensuring privacy [7]. Ensuring safeguards are in place to protect medical records so the information remains confidential is also an important concern and is considered a fundamental component of security [7]. A number of studies have suggested that consumer perspectives regarding the privacy and security of electronic health information are complex and varied. National surveys have shown that there is widespread concern about the privacy and security of EHRs and electronic health information exchange (HIE), with about half of individuals reporting in a recent survey that they expect EHRs to worsen privacy and security [7,8]. However, other findings indicate that many view EHRs as enhancing certain elements of privacy such as providing patients with greater control over their information and transparency regarding who accesses their information [9]. Findings across several surveys also suggest that a majority of individuals understand the potential benefits of EHRs and HIE [7-9], and consider these benefits to outweigh the potential privacy risks [7,10,11].

Evidence is still emerging regarding how these complex perspectives and growing adoption of EHRs may affect consumers’ perceptions regarding the privacy and security of their own medical records, including the sharing of their data among providers and patient-provider communication. Few studies have examined the association between consumer privacy and security concerns with provider EHR adoption [8].

With the increasing adoption of health information technology (IT), the Office of the National Coordinator for Health IT seeks to monitor general trends as well as identify key factors associated with individuals’ perceptions of privacy and security of medical information. Using data from a nationally representative survey of adults conducted by the National Cancer Institute (NCI) in 2011-2012, we sought to answer the following questions:

1. How confident are adults in the privacy and security of their medical records? What technology-related care experience and patient engagement–related factors are associated with consumer confidence in privacy and security?
2. What proportion of adults have withheld information from their provider due to privacy or security concerns? What technology-related care experience and information efficacy–related factors are associated with withholding information?
3. What are adults’ levels of concern regarding sending health medical information from one provider to another? Does this vary by whether it is sent by fax or electronically, and what differentiates adults who express concerns about these different modes of sharing electronic health information?

Methods

Data Collection and Response Rates

The data presented here are from the 2011-2012 administration of the NCI Health Information National Trends Survey (HINTS). HINTS is a nationally representative survey of the US noninstitutionalized adult population (≥18 years) that tracks attitudes, knowledge, and behavior related to health and cancer communication and health outcomes, with an emphasis on the evolution of health information technology in health care [12,13]. Data collection for the fourth iteration of HINTS (HINTS 4 Cycle 1) began in October 2011 and concluded in February of 2012 (N=3959), and included new items related to privacy and security of medical information. There are 3 more cycles of data collection planned through 2014. Data were collected via a self-administered mailed questionnaire using a comprehensive national listing of household addresses available from the United States Postal Service using a 2-stage, stratified sample. Within households, respondents were chosen using a randomized selection process. The final response rate for the postal survey was 36.7%, which is congruent with norms for federally funded population surveys. Full-sample and replicate weights were computed and are available to obtain population-level estimates and correct variance estimates, respectively. These weights correct for nonresponse and noncoverage to the extent possible. In creating these weights, sampling errors are reduced through the use of calibration variables from the American Community Survey (ACS) of the US Census Bureau based on the following demographic variables: age, gender, education, marital status, race, ethnicity, and census region. In addition, 2 other calibration variables from the National Health Interview Survey (NHIS) were used; namely, health insurance status and cancer status. Thus, weighted estimates of these calibration variables using the HINTS data will agree with those from the source data. Full details on the survey design and sampling strategies for the HINTS program have been published elsewhere [12,14].

Outcome Measures

The NCI and the ONC worked collaboratively to create new HINTS items to assess perceptions about privacy and security of medical information. These questions underwent multiple rounds of cognitive testing to assess their validity using respondents who represented a range of levels of education, age, and health status.

The definitions for the items related to security and privacy were developed from the National Committee on Vital and Health Statistics (NCVHS) [15]. According to NCVHS, health information privacy is an individual’s right to control the acquisition, uses, or disclosures of his or her identifiable health data. Security refers to physical, technological, or administrative safeguards or tools used to protect identifiable health data from unwarranted access or disclosure.

Security concerns were assessed with the question “How confident are you that safeguards (including the use of technology) are in place to protect your medical records from being seen by people who aren’t permitted to see them?” Response options included very confident, somewhat confident, and not confident.

Privacy concerns were assessed with the question “How confident are you that you have some say in who is allowed to collect, use, and share your medical information?” Response options included very confident, somewhat confident, and not at all confident.

Withholding of information was assessed by asking: “Have you ever kept information from your health care provider because you were concerned about the privacy or security of your medical record?” (yes/no).

Finally, concerns regarding sending medical information to providers were assessed through 2 questions. The first was in regards to sending information by fax and asked respondents: “If your medical information is sent by fax from one health care provider to another, how concerned are you that an unauthorized person would see it?” (very concerned, somewhat concerned, not at all concerned). The second question focused on medical information “sent electronically from one health care provider to another” with the same response options.

Independent Variables and Measures

Overview

The complex perspectives regarding privacy and security of medical and health information suggest a variety of factors may be involved that go beyond sociodemographic and health-related factors, which have been the focus of some studies [7,16]. Experience with technology, including their providers’ use of an EHR, may affect how individuals perceive privacy and security of their medical information. Additionally, individuals’ experiences with their health care provider may affect their level of confidence in the ability of the provider to maintain the privacy and security of their medical records and their subsequent withholding of information from their health care provider. How individuals seek out and obtain health information may affect their perceptions related to privacy and security of their medical information. Individuals with greater health information efficacy are more likely to seek out health information and make health care decisions on their own, and have higher levels of health literacy and numeracy [17-19]. Individuals in poor health may also perceive privacy and security of their medical records differently than those who are healthy and have fewer encounters with the health care system. Thus, in addition to sociodemographic characteristics (age, education, race/ethnicity, and gender) and health status, we also included the following variables in multivariate analyses.

Health Care Experience-Related Variables

Respondents reported on the quality of care received in the past 12 months from their health care provider (excellent, very good, good, fair/poor, no health care visits in the past 12 months) and their trust in information provided by a health care provider (a lot, some, a little/not at all).

Technology-Related Variables

An index of Internet activity was created to assess the degree to which respondents were engaged in online behaviors. This index considered use of the Internet, use of a personal health record (PHR), use of email to communicate with a health care provider, and having downloaded health information from the Internet. Respondents were given a score of “0″ if they did not use the Internet, “1″ if they used the Internet but did not engage in any of the 3 specific activities included in the index, “2″ if they used the Internet and had engaged in 1 of the 3 activities, and “3″ if they used the Internet and had engaged in 2 or 3 of the 3 activities. Participants were also asked “As far as you know, do your health care providers maintain your medical records in a computerized system?” (we use the term electronic “health” record although the survey items use the term “medical records”). The survey sought to ask about perceptions neutral of whether it was a paper-based system or electronic system.

Information Efficacy

Information efficacy was assessed with the question “Overall, how confident are you that you could get advice or information about health or medical topics if you needed it?” (completely confident, very confident, somewhat/a little/not at all confident).

Data Analyses

We used SUDAAN version 10.01 [20] to account for the complex sampling procedure used by HINTS and to incorporate the final sample and jackknife replicate weights needed to produce nationally representative point estimates and correct standard errors, respectively. Descriptive statistics were used to provide population-level estimates for American adults’ (1) perceptions of privacy and security of medical records, (2) choice to withhold medication information from health care providers because of privacy or security concerns, and (3) relative concerns about the transmission of medical information via electronic means or via fax. Bivariate analyses estimated the degree to which privacy and security concerns were related, and how each of these was associated with choosing to withhold medical information. Finally, multinomial generalized logit models were used to estimate the relative odds of having concerns about security, privacy, or unauthorized access to faxed versus electronically transmitted health information. Multivariable logistic regression was used to estimate the odds of withholding information from a health care provider due to concerns about privacy and/or security. Predicted probabilities were also computed.

Results

Respondent Characteristics

Table 1 shows the sociodemographic characteristics of the nationally representative sample. In all, 58.58% (2443/3924) of adults reported that over the past 12 months they had received either excellent (28.73%, 1190/3924) or very good quality of care (29.85%, 1253/3924). A quarter of adults reported they were completely confident in their ability to obtain health-related advice or information they needed (25.53%, 1002/3931), whereas more than one-third (38.81%, 1531/3931) reported they were only somewhat, a little, or not at all confident in their abilities to do so. With regards to technology exposure and uptake, approximately one-quarter (26.26%, 957/3621) of adults engaged in some health-related activity online. The majority (83.99%, 3332/3855) reported their providers kept their medical records in a computerized format.

Confidence Regarding Privacy and Security of Medical Information

Overall, three-quarters of adults reported they were very or somewhat confident in the security of their medical records (75.45%, 2570/3461). Three-quarters of adults also reported they were either very or somewhat confident in the privacy of their medical records (75.41%, 2586/3469).

The distribution of adults’ level of confidence regarding the privacy and security of their medical records was fairly similar (Figure 1). Concerns about security and privacy were related: among those who were very confident in the security of their medical records, 75.1% (644/826) were also very confident in the privacy of their medical records (χ²₄=99.9, P<.001).

‎View this figure

Factors Associated With Confidence in Privacy and Security

In multivariate analyses, reported quality of care and information efficacy were significantly associated with perceptions of privacy and security (Figure 2). Specifically, adjusting for other characteristics, predicted probabilities estimated from the model indicated that more than twice as many adults receiving high quality of care reported being very confident in the privacy of their medical information as compared to those who received fair or poor quality of care (38.11% vs 15.69%, P<.001). Similarly, twice as many adults who received high-quality care reported they were very confident in the security of their medical records (33.19% vs 14.51%, P<.001). Approximately one-third of adults with higher levels of information efficacy reported they were very confident in the privacy of their medical information (35.92%) or the security of their medical information (31.79%) compared to approximately one-fifth of adults with low levels of efficacy (both P<.001).

Additionally, Hispanics, African-Americans (P=.03 for privacy, P<.001 for security), and women had significantly (both P<.001) higher odds of reporting greater confidence in the privacy and security of their medical information (Table 2). Provider EHR use was not associated with confidence in privacy or security of medical records.

‎View this figure

Withholding of Information Because of Privacy or Security Concerns

A total of 12.33% (520/3904) of adults reported they had kept information from their health care provider because of concerns about the privacy and security of their medical information (Figure 3).

Factors Related to Withholding Information From a Health Care Provider

As shown in Figure 3, adjusting for other characteristics, individuals who rated the quality of care they received as lower (fair or poor) had 3 times the predicted probability of withholding information compared to those who received excellent care (23.93% vs 8.39%, P=.02). Asian-Americans had 2 times higher predicted probability of withholding information from their health care provider due to privacy or security concerns compared to white non-Hispanics (22.39% vs 9.90%, P=.01). Provider EHR use was not associated with withholding due to privacy or security concerns (Table 3).

‎View this figure

Concerns Regarding Sending Medical Information Between Providers

A majority of individuals expressed they were either very or somewhat concerned about unauthorized individuals viewing their data when it is sent between health care providers, whether by fax or electronic means (data not shown). A quarter of adults were “very concerned” (24.89%, 892/3474) about unauthorized persons gaining access to faxed health information compared to 18.75% (724/3462) if the information was sent electronically. Similar proportions of individuals expressed they were “somewhat concerned” about fax (42.12%, 1476/3474) or electronically (45.77%, 1566/3462) sending of information. Approximately one-third of individuals expressed they were not concerned about fax (32.99%, 1106/3474) or electronic (35.47%, 1172/3462) means of transmitting their health information between providers.

When responses to these questions were combined to understand the percentage of adults who were concerned about both methods of transmission, neither or only 1 or the other, a majority of adults (59.06%, 2100/3459) indicated they were either very or somewhat concerned about both electronically sending or faxing their health information, whereas approximately one-quarter (27.55%, 914/3459) were not concerned about either method. Very small proportions of adults were concerned about electronically exchanging data only (5.44%, 188/3459) or faxing data only (7.94%, 257/3459) (Figure 4).

Factors Associated with Concerns Regarding Methods of Sharing Data Between Providers

As shown in Figure 4, adults with higher levels of information efficacy had a significantly lower predicted probability of being concerned about both fax and electronic means of sending information between providers compared to adults with lower levels of information efficacy (49.61% vs 60.28%-61.15%, P=.02). Provider EHR use was not associated with concerns regarding methods of sharing data between providers (Table 4).

‎View this figure

Discussion

As EHR adoption has increased dramatically, a majority of individuals report they are confident in the privacy and security of their medical records. Three-quarters of adults reported they were either very or somewhat confident in the security of their medical records; similarly, three-quarters of adults reported they were very or somewhat confident in the privacy of their medical records. However, we found evidence suggesting that concerns regarding privacy and security may have a negative influence on provider-patient interactions. In all, 12.33% of adults reported they have withheld information from their health care provider due to concerns about the privacy and security of their medical record. Additionally, a majority of adults (59.06%, 2100/3459) reported being very or somewhat concerned that an unauthorized person might view their medical information when it is sent between health care providers, regardless of whether the information was sent by fax or electronically.

Our findings suggest that, thus far, the transition from paper to electronic health records is not associated with negative perceptions regarding the privacy and security of individuals’ medical information. Individuals who believed their providers were using electronic modes of storing or sharing health information did not report lower levels of confidence or greater concerns. Our findings regarding the lack of association between perceptions of provider EHR adoption and privacy and security concerns are consistent with other national survey results, which also found a lack of association between whether an individuals’ doctor used an EHR and perceptions regarding the privacy of HIE [8]. Our findings also suggest that there is room for improvement because half of adults reported they were less than very confident in the privacy and security of their medical records; this is consistent with prior studies that have indicated a majority of individuals are concerned about the impact of EHRs on privacy and security [7,8]. Thus, monitoring this over time will be critical because these perceptions may evolve as exposure to providers’ use of health IT increases.

A majority of adults did express concerns about the sharing of information between health care providers, whether by fax or electronic means. Similar levels of individuals (between 64.52% and 67.01%) expressed being very or somewhat concerned about either fax or electronic means of sharing their data. Our findings suggest that safeguards and policies should focus on building trust in the exchange of health information between providers, regardless of method of exchange. Although relatively few had concerns specific to electronically sharing information only, ONC is leading several efforts to ensure that entities facilitating exchange implement appropriate privacy and security policies to protect the information as it flows electronically across organizations while also enabling patients to have a “meaningful choice” in how their information is exchanged [3]. For example, in order for providers to receive incentive payments, they must transmit health information using secure technology.

Lack of confidence in privacy and security of medical records seems to negatively affect patient-provider communication. Although a minority of individuals (12%) reported withholding information due to privacy and security concerns, the impact on their health care may be significant. A prior survey found that 4% of individuals reported they had avoided requesting medical care or filling a prescription due to concerns about privacy [21]. Another survey found that 15% of individuals reported they would withhold sensitive information if their providers could exchange health information electronically [22]. A recent study found that smokers were more likely to withhold information from their health care provider due to privacy and security concerns, suggesting that individuals with potentially stigmatizing health conditions may be more likely to withhold sensitive information [16]. Together, these findings suggest that greater privacy and security concerns may be associated with negative patient-provider interactions and that withholding may be specific to certain types of sensitive health information. There are federal initiatives underway that seek to segment or separate sensitive information from other types of electronically transmitted information to alleviate potential concerns [23]. Five pilot projects are underway to demonstrate the technical capability for exchanging sensitive health information so that a patient’s privacy preferences are honored.

We did find racial and ethnic differences in privacy and security perceptions as well as potential cultural differences affecting withholding of information due to privacy and security concerns. Our findings that African-Americans and Hispanic Americans had a higher likelihood of expressing they were “very confident” in the privacy and security of their medical records compared to white non-Hispanics does run counter to prior studies which have found individuals from racial/ethnic minorities expressing greater privacy and security concerns [7]. However, other studies also show high interest in health IT use and support for HIE among most minorities [24,25]. Thus, monitoring these perceptions over time to see if these patterns are anomalies or new patterns will be important to assess as future rounds of the HINTS survey are conducted. We also found that Asian-Americans were more likely to withhold health information. This finding is consistent with a smaller, community-based study that found a high proportion of Asian-Americans expressed lower levels of support for HIE and PHRs which may have been related to privacy or security concerns [24]. There will be an opportunity to monitor and validate our initial finding as a national survey on privacy and security funded by ONC in 2014 will be oversampling Asian-Americans. Other converging evidence is slated to be published from special emphasis studies using HINTS items in Guam and the People’s Republic of China [26].

Our findings also suggest that confidence in the security and privacy of medical records may be associated with perceptions of quality and a sense of engagement with the health care system. Adults who reported more positive appraisals of the quality of their health care tended to be the same ones who reported greater confidence in the privacy and security of their medical information and were less likely to withhold information from their health care provider due to privacy or security concerns. These findings underscore the important role that individuals perceive that providers play in maintaining privacy and security of medical records. Adults’ general confidence in the privacy and security of their medical records may be linked to high levels of trust in their health care provider to protect the privacy and confidentiality of their health information [9]. High-quality health care providers may also be perceived to be more rigorous in their maintenance of medical records. Future research should examine the adoption of privacy and security safeguards by providers.

Adults who reported a greater sense of information efficacy—that is, a sense of confidence in their ability to find and control the information they need for their own health and health care—also reported a greater sense of confidence in the privacy and security of their medical records and less concern about data transmitted between providers. Our findings suggest that if health information technology serves to empower individuals to successfully gain greater access and control over their health information, their positive perceptions regarding the privacy and security of their health information may increase. Providing individuals with greater access to their own health information and the ability to use that information to manage their health and health care of their loved ones is a central cornerstone of ONC’s strategy to advance the use of health IT to improve care [27]. Federal initiatives are trying to make this vision into a reality by increasing consumers’ access to their own health information through the incentive program requirements and through the Blue Button download initiative [28,29].

Our study assesses individuals’ perceptions using general definitions of privacy and security, but both these concepts consist of a variety of specific areas. For example, privacy includes openness, access, and use limitations, whereas security encompasses issues such as availability and integrity of information. This survey did not cover these individual domains and they warrant further investigation. Additionally, although these survey items were cognitively tested to ensure respondents’ understanding, it is possible that respondents had difficulty assessing the differences between privacy and security. These are self-reported data that cannot be verified. For example, respondent-reported rates of EHR adoption (86%) are higher than physician-reported rates (72%), suggesting that some individuals may have mistakenly thought their health care provider was using an EHR when they were using a practice management system. Although these individuals may have erroneously believed their provider was using an EHR, this study’s examination of the association between perceptions regarding individuals’ privacy and security of their medical records and their providers’ use of health information technology is valid given that the focus of this study on individuals’ perceptions. The response rate for the postal frame tended to be low, although it exceeds random digit dial surveys and is comparable to other federal surveillance mechanisms [30,31]. Efforts were made to address potential sources of error (eg, nonresponse) through poststratification weighting techniques [32].

This nationally representative survey provides timely data on individuals’ perceptions regarding privacy and security of their medical records and its association with health IT and care experiences. Although EHR adoption rates have increased, a majority of adults report they are very or somewhat confident in the privacy and security of their medical records. However, many individuals do express concerns regarding the sharing of medical information between providers. Furthermore, privacy and security concerns have led a small but significant minority of individuals to withhold information from their health care providers. Yet, we did not find an association between these concerns and negative impacts with EHR adoption or electronic HIE. Our findings suggest it will be important to continue monitoring the effects of EHR adoption and HIE on privacy and security attitudes and behaviors. Additionally, efforts should continue to encourage providers to secure medical records, provide patients with a meaningful choice in how their data are shared, and enable consumers to access information they need to manage their care.