111 Eighth Avenue

7th Floor

New York, NY 10011

212.624.3700 Phone

Testimony of WebMD Health Corp.

Philip Marshall, MD, MPH, WebMD Health

Vice President, Product Strategy

and

Robert D. Marotta , Esq., Emdeon Corporation

Sr. Vice President & Chief Regulatory Counsel

Before the American Health Information Community

Confidentiality, Privacy, and Security Workgroup

Public Hearing

April 12, 2007

WebMD Health Corp. (“WebMD Health”) welcomes this opportunity to participate in the proceedings of the AHIC Confidentiality, Privacy and Security Workgroup. WebMD Health is the leading provider of health information services, serving consumers, physicians, healthcare professionals, employers and health plans through our public and private online portals and health-focused publications. Through our health sites, including WebMD Health, Medscape, MedicineNet, eMedicine, eMedicine Health, RxList and theHeart.org, we reach more than 35 million visitors a month. WebMD Health is a subsidiary of Emdeon Corporation. We have been asked today to discuss the role of the Personal Health Record (“PHR”) as part of an emerging environment of consumer empowerment within the US health care system.

Our experience with providing PHR solutions to consumers, employers and health plans has shown that PHRs can be a vehicle for consumer choice and can serve as a bridge across a fragmented health care system. Moreover, as consumers are better able to gather, store and make available information from multiple providers, systems, and data sources, the PHR will better support improved treatment, benefit and provider decision-making, and enhance communication with health care providers. The key points that WebMD Health believes to be important are as follows:

1. Although a PHR can be created in a variety of ways using a variety of data sources, the objectives remain the same:

• To enable consumers to gain insight into their health history in order to provide a better context for treatment, benefit, and provider decisions.

• To enable care providers to have the essential, actionable health history in order to make clinical decisions, especially when a clinical record on that patient is not otherwise available.

• To support consumer access as they move across the health care system.

2. A consumer-centric personal health record should enable consumers to access their health information across the continuum of care.

WebMD Health PHR products are designed to collect information electronically on behalf of and at the direction of the consumer from any data source available in the continuum of care, including health plans, providers, pharmacies, laboratories, third-party vendors (e.g., PBMs), and consumers. In order to maximize the value of PHRs to consumers, consumers must be able to access that information and obtain it in a format that can be used to populate the PHR application.

3. The utility of PHRs is tied, in part, to the ability of a consumer to retain access to their health record over time, which may require access across care providers and physical locations. In this regard, WebMD Health recognizes that user authentication and data portability are essential issues to resolve.

• User authentication: The ability to validate a users identity is critically important to the success of PHRs and the security of the privacy and security of the data stored therein. There are a variety of tools currently in use today to authenticate users and the level of authentication must be commensurate with the level of PHR access provided and the sensitivity of the data at issue.

• Data portability: Data portability is critical for creating a longitudinal, consumer-centric record that can support health care consumerism. Portability will require mechanisms that appropriately and securely express both the consumer’s identity and their willingness to exchange data.

4. The widespread adoption of PHRs will be based, in part, on the confidence consumers have in the privacy and security of their information.

• WebMD Health protects the information it holds, stores, and transmits through privacy protections that empower consumers to make decisions about whether and how their information may be used and/or disclosed. Our policies are posted and easily accessible on our websites.

• We also take a defensive multi-layered approach to securing our web-based tools by implementing complementary security controls at the physical, network, system, and application layers. We protect the health information we hold, store, or transmit in accordance with the law and at a level that meets or exceeds industry standards. We also make available to our customers a security practices technology brief that describes our approach to security.

5. PHRs first and foremost are a product for consumers. As such, applicable laws include:

• Federal and state consumer protection laws

• HIPAA in some limited circumstances

• Gramm-Leach-Bliley may apply to PHRs offered by financial institutions, including insurance companies

• State security breach notification laws

• Law of contracts (for compliance with terms and conditions)

6. The setting of an industry-based standard providing a minimum set of privacy principles and protections for PHRs would help to advance the use of PHRs. In doing so, it will be essential to strike a proper balance so that appropriate privacy protections are assured, while avoiding rules that would unnecessarily and inappropriately restrict the development, utility, and uptake of PHRs. These issues are under discussion in Congress and HHS. In addition, a number of advisory groups are looking at the issue:

• American Health Information Community (AHIC)

  • Confidentiality, Privacy, and Security Workgroup

  • Consumer Empowerment Workgroup

• National Committee on Vital and Health Statistics (NCVHS)

• Public/Private organizations

  • Markle Foundation/Connecting for Health

  • National Health Policy Forum

  • RTI State Privacy Project

The robust national conversation on PHRs is healthy and productive and the work that AHIC and its workgroups are doing bring key stakeholders together to move the process forward. We very much appreciate the opportunity to participate in your proceedings and look forward to continuing to work with you.