As for a remedy for you, Vince, maybe you can contact some of your law school alums and get involved in a class action. Given that legislatures have deferred to courts rather than addressing these kinds of harms head-on, I would expect to see a new string of class actions developing around breach of duty in failure to maintain an EHR. Each individual’s harm isn’t that great, but the interests of justice do seem to favor some remedy.

Same kind of thing happened with Canopy Financial earlier this year. They had all the tricked out PHR tools, and then blew up and reportedly had their deposits frozen by the FBI. Not fun to have creditors poking around your PHI looking creatively on some way to satisfy a claim. If the VCs can’t do adequate due diligence, how are the Main St. people going to do it?

Certification of some sort would be good. Regulation helps, too, but maybe not much. There could be an FDIC-insured equivalent assurance of proper back-ups in an escrow account accessible by the consumer.

Apart from any business lessons, I’m amazed that they are only offering a PDF version of the record. This means that most people will have to get information re-typed, with all the confidentiality issues and scope for errors that introduces. The least they should do is offer a text-friendly output of the record so that someone, sometime, can attempt to load it into another PHR.