1 Health Insurance Portability and Accountability Act of 1996, Pub. L No. 104-191, 110 Stat. 1988 (codified as amended scattered in portions of 29 U.S.C., 42 U.S.C. and 18 U.S.C.).

2 See O’Harrow, Robert Jr., Protecting Patient Data, Wash. Post, Mar. 23, 2001Google Scholar, at E01.

3 Press Release, HHS Press Office, Statement by HHS Secretary Tommy G. Thompson Regarding the Patient Privacy Rule, Apr. 12, 2001, available at http://www.hhs.gov/news.

4 See, e.g., Medical Error Reduction Act of 2000, S. 2038, 106th Cong. (2000).

5 Some limited intersections have previously been identified. See, e.g., Hodge, James G. Jr. et al., Legal Issues Concerning Electronic Health Information Privacy, Quality, and Liability, 282 JAMA 1466, 1466 (1999)CrossRefGoogle ScholarPubMed.

6 eHealth has been defined in the following terms:

Terry, Nicolas P., Structural and Legal Implications of E-Health, 33 J. Health L. 605, 605 n.I (2000)Google ScholarPubMed. See , What is e-Health?, 3 J. Med. Internet Research e20 (2001)CrossRefGoogle Scholar, available at http://www.jmir.Org/2001/2/e20/index.htm; Mea, Vincenzo Della, What i Telemedicine?, 3 J. Med. Internet Reseacrh e22 (2001)Google ScholarPubMed, available at http://www.jmir.Org/2001/2/e22/index.htm.

7 See infra text accompanying note 35.

8 Standards for Privacy of Individually Identifiable Health Information, Final Rule, 65 Fed. Reg. 82,462 (Dec. 28, 2000) (to be codified at 45 C.F.R. §§ 160, 164). The regulation text is available at http://aspe.hhs.gov/admnsimp/final/PvcTxt01.htm.

9 See Am. Hosp. Ass’n, Hipaa: Privacy, Security, and Electronic Transactions Standards, at http://www.aha.org/hipaa/hipaa_home.asp (last visited Nov. 9, 2001) (providing documents related to HIPAA’s implementation). However, note the joint letter to the Chairman of the House Ways and Means Committee from the AHA, the Federation of American Hospitals and other hospital groups urging Congress not to delay the electronic transactions standards beyond the October 2002 compliance date. Id.

10 For a friendly yet critical analysis, see Gostin, Lawrence O., National Health Information Privacy, Regulations Under the Health Insurance Portability and Accountability Act, 285 JAMA 3015 (2001)CrossRefGoogle ScholarPubMed.

11 Health Insurance Portability and Accountability Act of 1996, Pub. L No. 104-191, § 261, 110 Stat. 1988 (1996).

12 Health Insurance Portability and Accountability Act of 1996, Pub. L No. 104-191, § 263, 110 Stat. 1988 (1996).

13 http://ncvhs.hhs.gov/.

14 Nat’l Comm, on Vital and Health Statistics, Nhii Workgroup on The Nat’l Health Info. Infrastructure, Assuring a Health Dyimension for the National Information Infrastructure (1998), available at http://www.ncvhs.hhs.gov/hii-nii.htm.

15 Nat’l Comm, on Vital and Health Statistics, Nhii Workgroup on The Nat’l Health Info. Infrastructure, Assuring a Health Info. Infrastructure, Interim Rep., Toward a National Health Information Infrastructure (2000) [hereinafter NCVHS Interim Rep.], available at http://ncvhs.hhs.gov/NHII2kReport.htm.

16 Id. The NCVHS Interim Rep. continues,

Id.

17 President’s Info. Tech. Advisory Comm., Panel on Transforming Health Care, Report to the President: Transforming Health Care Through Information Technology 4 (2001) [hereinafter PITAC REP.], available at http://www.itrd.gov/pubs/pitac/.

18 Id. at 8.

19 See NCVHS Interim Rep., supra note 15.

20 Id.

21 PITAC Rep., supra note 17, at 2, noting:

22 See generally Winn, Jane K., XML and the Legal Foundations for Electronic Commerce: Making XML Pay: Revising Existing Electronic Payments Law to Accommodate Innovation, 53 SMU L. Rev. 1477, 1478 (2000)Google Scholar (discussing the technologies underlying electronic commerce).

23 Siemens Med. Solutions Health Servs. Corp., HIPAA Overview, at http://www.smed.com/hipaa/overvrew.php (last visited Oct. 26, 2001).

24 For background, see Roy Rada, H1PAA@1T Reference: Health Information Transactions, Privacy, and Security 13-48 (2001).

25 Electronic data interchange (EDI) is the electronic transfer of information, such as electronic media health claims, in a standard format between trading partners. EDI allows entities within the health care system to exchange medical, billing, and other information and to process transactions in a manner which is fast and cost effective. With EDI there is a substantial reduction in handling and processing time compared to paper, and the risk of lost paper documents is eliminated. EDI can eliminate the inefficiencies of handling paper documents, which will significantly reduce administrative burden, lower operating costs, and improve overall data quality.

Id. at 21.

26 45 C.F.R. § 162.1000(2001).

27 See D'Arcy Guerin Gue, Transactions and Code Sets: For Geeks Only?, at http://www.hipaadvisory.com/action/tcs/geeksonly.htm (last visited Nov. 1, 2001). “Transactions and Code Sets Standards are data models that have been defined and approved by agreement of the members of various independent organizations that focus on supporting the electronic transfer of Information.” Id.

28 http://www.x12.org (last visited Nov. 19, 2001). ANSI ASC X12N HIPAA Implementation Guides are available from the Wash. Pub. Co., at http://hipaa.wpc-edi.com/HIPAA_40.asp (last visited Nov. 9, 2001).

29 http://www.ncpdp.org (last visited Nov. 19,2001).

30 See Security and Electronic Signatures, 63 Fed. Reg. 43,241, 43,243 (proposed Aug. 12, 1998) (to be codified at 45 C.F.R. pt. 142), available at http://aspe.hhs.gov/admnsimp/nprm/emplist.htm. See also Amatayakul, Margret & Bisterfeldt, Joan, HIPAA On The Job: Data Mapping for HIPAA Transactions, J. Am. Health Info. Mgmt. Ass’n., Jul/Aug 2001Google Scholar, at 16.

31 In addition to Health Plan and Individual Identifiers, the Pharmacy and Claims Attachments data sets and the final version of the Security standards are still open in late-2001.

32 The shorter-term “translation” of data between entities that will be required explains the inclusion of the somewhat obscure “Health Care Clearinghouse” within the regulations.

(1) Processes or facilitates the processing of health information received from another entity in a nonstandard format or containing nonstandard data content into standard data elements or a standard transaction.

(2) Receives a standard transaction from another entity and processes or facilitates the processing of health information into nonstandard format or nonstandard data content for the receiving entity.

45 C.F.R. § 160.103 (2001). For an example of clearinghouse technology, see NaviMedix, at http://www.navimedix.com/ (last visited Nov. 19, 2001).

33 See Guerin Gue, supra note 27:

34 Id.

35 Exceptionally, the individual identifier is somewhat controversial. Development of the individual identifier was purposefully delayed until the protections envisioned in the PIHI regulations were published. It is likely that the individual identifier will be the patient’s social security number, itself potentially contentious. See Cal Civ. Code 1785.11.1(f) (West 2001) (limiting use of social security numbers in healthcare situations). See also the ApT. 26, 1993 letter to Hillary Clinton, in her then role as Chairperson, Health Care Reform Task Force, urging that the Social Security Number not be used as the Health Identification Number, available at http://www.epic.org/privacy/medical/ssn_letter.txt.

36 Security and Electronic Signatures, 63 Fed. Reg. 43,241, 43,243 (proposed Aug. 12, 1998) (to be codified at 45 C.F.R. pt. 142). The final regulation likely will deal primarily with security, while electronic signatures likely will be placed in a separate regulation.

37 Standards for Privacy of Individually Identifiable Health Information, Final Rule, 65 Fed. Reg. 82,462 (Dec. 28, 2000) (codified at 45 C.F.R. §§ 160, 164). See also U.S. Dep’t Health and Human Servs., Office for CIV. Rights, Standards For Privacy of Individually Identifiable Health Information [hereinafter Guidance/Q&As], available at http://www.hhs.gov/oer/hipaa/finalmaster.html (last revised July 6, 2001).

38 45 C.F.R. § 164.502(1) (2001).

39 Defined in 45 C.F.R. § 160.103 (2001).

40 45 C.F.R. § 160.102 (2001).

41 See 45 C.F.R. § 164.501 (2001).

42 It is assumed that oral information must be in a tangible form to be subject to the regulation; otherwise it could not be received or created by the provider. The regulation does not seem to require that an oral communication be recorded. This assumption seems consistent with the advice since issued by DHHS, see infra text accompanying footnote 424.

43 45 C.F.R. § 160.103 (2001).

44 45 C.F.R. § 164.501 (2001).

45 45 C.F.R. § 164.502(a) (2001). The various types of disclosure permitted and how they are regulated is discussed infra at text accompanying notes 255 to 278.

46 45 C.F.R. § 164.530 (2001).

47 45 C.F.R. §§ 160.300-.312 (2001).

48 45 C.F.R. § 164.502(g) (2001). See infra text accompanying note 393.

49 Norman-Bloodsaw v. Lawrence Berkeley Lab., 135 F.3d 1260, 1269 (9th Cir. 1998) (holding that research institution violated federal privacy rights of clerical and administrative workers who were tested for intimate medical conditions without their knowledge as part of an employee health examination).

50 See also United States v. Westinghouse Elee. Corp., 638 F.2d 570, 580 (3d Cir. 1980) (holding that employee medical records fall within protected zone of privacy); United States v. Sutherland, 143 F. Supp. 2d 609, 610 (W.D. Va. 2001) (holding that government cannot disclose prescription records without giving patients a chance to object). See generally Roe v. Wade, 410 U.S. 113, 152 (1973):

51 See, e.g., King v. State, 535 S.E.2d 492, 494 (Ga. 2000) (discusssing GA. Const, art. I, § 1, para. 1). But see Rollins v. Ulmer, 15 P.3d 749, 750 (Alaska 2001) (finding that the registration requirements of Alaska's medical marijuana law are constitutional).

52 See, e.g., Cal. Civ. Code §§ 56-56.37 (West 2001); Haw. Rev. Stat. Ann. § 323(c) (Michie 2001); Mont. Code Ann. §§ 50-16-501 to 16-553 (2001); Wash. Rev. Code Ann. §§ 70.02.005 to.02.904 (West 2001); Wis. STAT. § 146.83 (2001).

53 Joy Prjtts et al., Health Privacy Project, the State of Health Privacy: An Uneven Terrain (A Comprehensive Survey of State Health Privacy Statutes) 20 (1999) [hereinafter Health Privacy State Rep.], available at http://www.healthprivacy.org. See also tabular data at 32-34.

54 See, e.g., Mass. Gen. Laws Ann. ch. Ill, § 70G (West 2001).

55 45 C.F.R. §§ 160.201 -.205 (2001).

56 See, e.g., Tex. Health & Safety Code Ann. § 181 (Vernon 2001) (designed to fill the “one-bite” marketing gap frequently cited by privacy advocates). For detail on marketing rule see infra text accompanying note 234.

57 Uniform Health-Care Information Act (1985), available at http://www.law.upenn.edu/bll/ulc/fnact99/1980s/uhcia85.htm; Proposed Revisions of Uniform Health Care Information Act (2000), available at http://www.law.upenn.edu/bll/ulc/uhcia/hci0600.htm.

58 See, e.g., Hurvitz v. Hoefflin, 101 Cal. Rptr. 2d 558 (Cal. Ct. App. 2001); Tadlock & Keeney, 101 Cal. Rptr. 2d 916 (Cal. Ct. App. 2000); Anonymous v. CVS Corp., 728 N.Y.S.2d 333 (N.Y. Sup. Ct. 2001); Jeffrey H. v. Imai, Biddle v. Warren Gen. Hosp., 715 N.E.2d 518 (Ohio 1999); McCormick v. England, 494 S.E.2d 431 (S.C. Ct. App. 1997); Berger v. Sonneland, 26 P.3d 257 (Wash. 2001).

59 See, e.g., Wis. Stat. § 146.84(c) (2001) (“An individual may bring an action to enjoin any violation of § 146.82 or 146.83 or to compel compliance with § 146.82 or 146.83 and may, in the same action, seek damages as provided in this subsection.”). See also Cal. Civ. Code § 56.35 (West 2001); Haw. Rev. Stat. Ann. § 323(c) (Michie 2001).

60 United States v. Sutherland, 143 F. Supp. 2d 609, 612 (W.D. Va. 2001).

61 709 N.Y.S.2d 215, 216 (N.Y. App. Div. 2000).

62 Unless the patient waives the privilege, a person authorized to practice medicine, registered professional nursing, licensed practical nursing, dentistry, podiatry or chiropractic shall not be allowed to disclose any information which he acquired in attending a patient in a professional capacity, and which was necessary to enable him to act in that capacity. The relationship of a physician and patient shall exist between a medical corporation, as defined in article forty-tour of the public health law, a professional service corporation organized under article fifteen of the business corporation law to practice medicine, a university faculty practice corporation organized under section fourteen hundred twelve of the not-for-profit corporation law to practice medicine or dentistry, and the patients to whom they respectively render professional medical services.

N.Y. C.P.L.R. § 4504(a) (2001).

63 Unless the patient waives the right of confidentiality, a health maintenance organization or its comprehensive health services plan shall not be allowed to disclose any information which was acquired by such organization or plan in the course of the rendering to a patient of professional services by a person authorized to practice medicine, registered professional nursing, licensed practical nursing, or dentistry, and which was necessary to acquire to enable such person to act in that capacity.

N.Y. Pub. Health Law § 4410(2) (2001).

64 Doe, 709 N.Y.S.2d at 217-18.

65 For example, consider physician order entry, discussed at text accompanying infra notes 125-34, and the CPR at infra text accompanying notes 373-409.

66 45 C.F.R. § 164.501 (2001).

67 45 C.F.R. § 160.103 (2001).

68 Gostin, Lawrence O., Health Information Privacy, 80 Cornell L. Rev. 451, 458 (1995)Google ScholarPubMed (reference omitted).

69 http://www.epri-host.org/(last visited Nov. 13,2001).

70 Paul C. Tang & W. Ed Hammond, A Progress Report on Computer-Based Patient Records in the United States, in The Computer-Bsased Patient Rsecord: An Essential Technology for Health Care 1 (1997). See also Computer-Based Patient Record Inst., Cpri Work Group on CPR Description, Computer-Based Patient Record Description of Content (1996), available at http://www.cpri-host.org/resouree/docs/content.html.

71 See, for example, the systems being installed by Perot Systems, at http://www.perotsystems.com (last visited Oct. 31, 2001).

72 See, e.g., U.S. Dep’t Commerce & Nat’l Telecomm. and Info. Admin., Report to Congress: Electronic Signatures in Global and National Commerce Act, Section 105(a) (2001) (discussing the effectiveness of electronic mail in the delivery of records), available at http://www.ntia.doc.gov/ntiahome/ntiageneral/esign/105a/esignl05a.htm.

73 See generally Press Release, Blue Cross of Cal., Blue Cross of California Announces Restructured Physician Quality Initiatives, July 10, 2001, available at http://www.bluecrossca.com/ aboutus.asp. See also Milt Freudenheim, In a Shift, an H.M.O. Rewards Doctors for Quality Care, N.Y. Times, July 11, 2001, at Cl.

74 PITAC Rep., supra note 17, at 6-7.

75 See, e.g., Mildon, Jeff & Cohen, Todd, Drivers in the Electronic Medical Records Market, Health Mgmt. Tech., May 2001Google Scholar, at 14 (detailing the many reasons behind the adoption of electronic records).

76 For example, very few Web-based medical advice sites will be covered by PIHI.

77 Harmon, Amy, Survey About Accountability Online, N.Y. Times, July 10, 2001Google Scholar, at C1 (citing a Markle Foundation survey of the American public’s views of Internet accountability and regulation).

78 Terry, supra note 6, at 605.

79 See generally First Consulting Group, Where Will the Road to E-Health Lead? Ten E-Health Trends 2 (2000) (“condensing” changes in the eHealth market to ten trends), at http://www.fcg.com/knowledge/first_reports.asp.

80 at http://medibuy.com (last visited Nov. 10, 2001); MedUnite, at http://www.medunite.com/ (last visited Nov. 10, 2001).

81 http://www.webmd.com (last visited Nov. 10,2001).

82 See, e.g., Medicine Online, Bid for Sur ery, at http://www.medicineonline.com/ bidforsurgery (last visited Nov. 10, 2001).

83 See, e.g., Health Market, at http://www.healthmarket.com (last visited Nov. 10, 2001); Health Allies, at http://www.healthallies.com (last visited Nov. 10, 2001).

84 See, e.g., Acurian, at http://www.acurian.com/ (last visited Nov. 10, 2001); Centerwatch. Clinical Trials Listing Service, at http://www.centerwatch.com/ (last visited Nov. 10, 2001).

85 See, for example, Panasonic’s Tele Homecare system, at http://www.panasonic.com/telecare/:

Id. For patient monitoring products, including the “LifeShirt,” see also VivoMetrics, at http://www.vivometrics.com/home.html (last visited Nov. 10, 2001).

86 See, for example, the ActiveECG system, at http://www.activecenter.com (last visited Nov. 10, 2001).

87 See, for example, the Vitaphone, at http://www.vitaphone.de/index_e.htm (last visited Nov. 10, 2001).

88 See, e.g., MicroChips, Inc., at http://www.mchips.com/ (last visited Nov. 10, 2001).

89 See Guerin Gue, supra note 27.

90 See, for example, the Final Report of the National Expert Advisory Group on Safety and Quality in Australian Healthcare (1999) (leading to the formation of the Australian Council for Safety and Quality in Health Care), available at http://www.health.gov.au/hsdd/nhpq/pubs/qualsyn/neagsyn.htm. See also Press Release, Commonwealth Dep’t Health and Aged Care, Minister Launches Australian Council for Safety and Quality in Health Care, Jan. 21 2000, available at http://www.dhac.gov.au/mediarel/yr2000/mw/mw20003.htm; Nat’l Health Priorities and Quality Branch, Commonwealth Dep’t Health and Aged Care, National Safety and Quality Activities Safety and Quality in Health Care, at http://www.health.gov.au/hsdd/nhpq/quality/natsafet.htm (last modified Feb. 17, 2000); Wilson, Ross McL et al., An Analysis of the Causes of Adverse Events from the Qualiudy, 170 Med. J. Aust’l. 411 (1999)Google Scholar. In a similar time frame, both the Commonwealth and states have moved to increase the level of privacy protection. See, e.g., Office of the Fed. Privacy Commissioner, Guidelines on Privacy in The Private Health Sector, (2001), available at http://www.privacy.gov.au/publications; Privacy Amendment (Privacy Sector) Bill 2000 (Summary) (amending the Commonwealth Privacy Act 1988), available at http://www.law.gov.au/privacy/billinfo.html; Health Records Bill 2000/2001 (Victoria), available at http://www.dms.dpc.vic.gov.au/pdocs/bills/B00756/B00756I.html.

91 Paul Starr, Health Care Reform and the New Economy, Health Aff., Nov./Dec. 2000, at 23,

92 Id. at 28.

93 Id.

94 Brennan, Troyen A. et al., Incidence of Adverse Events and Negligence in Hospitalized Patients: Results of the Harvard Medical Practice Study I, 324 New Eng. J. Med. 370 (1991)CrossRefGoogle ScholarPubMed; Leape, Lucian L. et al., The Nature of Adverse Events in Hospitalized Patients: Results of the Harvard Medical Practice Study II, 324 New Eng. J. Med. 377 (1991)CrossRefGoogle ScholarPubMed.

95 Comm, on Quality of Health Care in America, Inst, of Med., to Err is Human: Building a Safer Health System (Linda Kohn et al., eds. 1999) [hereinafter To Err is Human].

96 Induced inadvertently by the medical treatment or procedures or activity of a physician. Originally applied to disorders induced in the patient by autosuggestion based on the physician's examination, manner or discussion, the term is now applied to any adverse condition in a patient occurring as the result of treatment by a physician or surgeon, especially to infections acquired by the patient during the course of treatment.

See On-Line Medical Dictionary, at http://www.graylab.ac.uk/omd/index.html.

97 To Err is Human, supra note 95, at 1.

98 Id.

99 Id.

100 See, e.g., Hayward, Rodney A. & Hofer, Timothy P.. Estimating Hospital Deaths Due to Medical Errors: Preventability Is in the Eye of the Reviewer, 286 JAMA 415 (2001)CrossRefGoogle ScholarPubMed.

101 To Err is Human, supra note 95, at 28 (references omitted).

102 Id..

103 http://www.nccmerp.org/.

104 Such events may be related to professional practice, health care products, procedures and systems, including prescribing; order communications; product labeling, packaging and nomenclature; compounding; dispensing; distribution; administration; education; monitoring; and use.

Id. See also NCC MERP, Taxonomy of Medication Errors, at http://www.nccmerp.org.

105 Agency for Healthcare Research and Qualitys, Pub. No. 01-0020, Reducing and Preventing Adverse Drug Events to Decrease Hospital Costs (2001) [hereinafter AHRQ REP.], .gov/qual/aderia/aderia.htm. See also Press Release, U.S. Pharmacopoeia, USP Releases First Report on Medication Errors, Dec. 13, 2000, available at http://www.onlinepressroom.net/uspharm (discussing U.S. Pharmacopoeia report, Summary of 1999 Information Submitted to MedMARx^su : A National Database for Hospital Medication Error Reporting).

106 AHRQ Rep., supra note 105.

107 Id. See also Assoc. Press, Computers Could Catch Medication Errors, U.S. says, Ariz. Rep., Apr. 12, 2001, at A9.

108 Reason, James, Human Error: Models and Management, 320 Brit. Med. J. 768, 768 (2000)CrossRefGoogle ScholarPubMed.

109 Leape, Lucian L., Foreword: Preventing Medical Accidents: Is “Systems Analysis” the Answer?, 27 Am. J.L. & Med. 145, 147 (2001)Google Scholar.

110 Id. at 148.

111 See, e.g., Status of Patients’ Rights Bill is Debated, N.Y. Times, at http://www.nytimes.com/2001/07/31/politics/3lWIRE-PATIENTS.html (July 31, 2001). See also Pear, Robert, Key Lawmaker is Reported Near Deal with Bush on Rights Bill, N.Y. TIMES, July 31, 2001Google Scholar, at A17.

112 Comm, on Quality of Health Care in America, Inst, of Med., Crossing the Quality Chasm: A New Health System for the 21st Century (2001).

113 Id. at 3.

114 Id. at 175-76.

115 Press Release, Sen. Comm. on Aging, Craig Says Computerized Prescription Technology Saves Lives, May 3,2001, available at http://aging.senate.gov/nr010503.htm.

116 Food and Drug Admin., Final Summary of Food and Drug Administration Action Items—Doing What Counts For Patient Safety: Federal Actions to Reduce Medical Errors and Their Impact (2001) [hereinafter Doing What Counts], available at http://www.fda.gov/cder/drug/MedErrors/patientsafety.htm.

117 Joint Comm’n on Accreditation of Healthcare Organizations, Revisions to Joint Commission Standards in Support of Patient Safety and Medical/Health Care Error Reduction (2001) [hereinafter JCAHO Revised Standards], available at http://www.jcaho.org/standard/fr_ptsafety.html.

118 These are primarily contained in the Leadership Chapter revisions.

119 JCAHO Revised Standards, supra note 117, at I.M.8.

120 Id. at I.M.9.

121 See, e.g., Bates, David W. et al., Effect of Computerized Physician Order Entry and a Team Intervention on Prevention of Serious Medication Errors, 280 JAMA 1311 (1998)CrossRefGoogle Scholar.

122 Donna Tapellini, A Wireless Doctor is in the House, Wired News, at http://www.wired.eom/news/technology/0,1282,40560.00.html (Dec. 7, 2000).

123 See, e.g., JCAHO, Medication Errors Related to Potentially Dangerous Abbreviations, Sentinel Event Alert, Sept. 2001, available at http://www.jcaho.org/edu_pub/sealert/sea23.html.

124 See, e.g., Theresa Agovino, Digital Rx for Doctors’ Bad Handwriting, Akron Beacon J., June 25, 2001, available at http://www.ohio.com/all/2001/June/25/bizdocs/029130.htm; Editorial, Writing a Medical Wrong, S.F. Chron., Oct. 10, 2000, at A24. Non-technological approaches to dealing with this issue, such as calligraphy and handwriting courses for doctors, are also being tried. See Wells, Janet, Rx for Doctors with Poor Handwriting, S.F. Chron., July 1, 2001Google Scholar, at A15.

125 AHRQ Rep., supra note 105.

126 Automated dispensing systems are drug storage devices or cabinets that electronically dispense medications in a controlled fashion and track medication use. Their principal advantage lies in permitting nurses to obtain medications for inpatients at the point of use. Most systems require user identifiers and passwords, and internal electronic devices track nurses accessing the system, track the patients for whom medications are administered, and provide usage data to the hospital’s financial office for the patients’ bills.

See Agency for Healthcare Research and Quality, Pub. No. 01-E057, Making Health Care Safer: A Critical Analysis of Patient Safety Practices ch. 11 (2001), available at http://www.ahrq.gov/clinic/ptsafety.

127 See, for example, the Medstation System 2000/Rx System 2000, at http://www.pyxis.com/products/medstation2000.asp (last visited Nov. 21, 2001).

128 See Siemens Med. Solutions Health Servs. Corp., Siemens Medication Management Solution: Improving Medication Safety, at http://www.smed.com/solutions/products/medmanagement/index.php (last visited Nov. 15, 2001). See also Lundine, Susan, Prescription Info., Orlando Bus. J., Apr. 27, 2001Google Scholar, available at http://orlando.bcentral.com/orlando/stories/2001/04/30/newscolumn2.html.

129 See Doing What counts, supra note 116. On December 3, 2001 the FDA announced that it would develop a proposed rule requiring bar codes on all prescription drug labels. See FDA: Bar Code Requirement for Drugs Planned as Part of Agency Focus on Patient Safety, 6 Health Care Daily Rep. (BNA) 232 (Dec. 5, 2001).

130 See, e.g., Freudenheim, Milt, Digital Doctoring, N.Y. Times, Jan. 8, 2001Google Scholar, at Cl.

131 In no large part because of accreditation pressures. See supra text accompanying note 117.

132 Rxhub.Net, at http://www.rxhub.org/sub/physician.html (last visited Nov. 14, 2001). See also PEPID 2001, Portable Emergency and Primary Care Information Database, at http://www.pepid.com/ (last visited Nov. 14, 2001).

133 http://www.fda.gov/medwatch/ (last visited Nov. 14,2001).

134 Press Release, Epocrates, FDA g Safety Alerts, July 17, 2001, available at http://www.epocrates.com/headlines/pressreleases.cfm.

135 This terminology is used apparently interchangeably by AHRQ. See AHRQ Rep., supra note 105.

136 Id.

137 Inst, of Med., the Computer-Based Patient Record: an Essential Technology for Health Care 179 (1991) [hereinafter Computer-Based Patient Record].

138 See, for example, Thomson MICROMEDEX’S UltiMedex Suite, at http://www.micromedex.com/products/healthcare (last visited Nov. 14, 2001); MEDITECH’S Patient Care System, at http://www.meditech.com/Main/Products.htm (last visited Nov. 14, 2001).

139 See, for example, the listing of medical expert systems, at http://www.computer.privateweb.at/judith/name_3.htm (last visited Nov. 14, 2001).

140 See, e.g., POEMS, Post Operative Expert Medical System, at http://www.cbl.leeds.ac.uk/sawar/projects/poems/overview (last visited Nov. 14, 2001).

141 See generally Nicolas Terry, When the “Machine That Goes ‘Ping'” Causes Harm: Default Torts Rules and Technologically-Mediated Health Care Injuries, 46 ST. LOUIS U. L.J. (forthcoming March 2002).

142 [T]he interaction of such “smart” systems with computer-based patient records will also raise a host of legal and policy issues …. Among them will be allocation of responsibility (and liability) for errors in the artificial intelligence system, whether caused by faulty hardware, faulty software, or error in the system’s medical rules. The more advanced such systems become, the more questions they will generate about the practice of medicine and whether nonphysicians can use these systems to diagnose and treat patients without physician involvement. In addition, systems that can diagnose or treat patients without intervening professional involvement may be classified and regulated as medical devices under food and drug laws. Finally, these “smart” systems can be expected to lead to a redefinition of the physician’s role, as they begin to perform functions that formerly only a physician could perform.

Id. at 179.

143 See Sage, William M., Regulating Through Information: Disclosure Laws and American Healthcare, 99 COLUM. L. Rev. 1701, 1777 (1999)CrossRefGoogle Scholar:

One of Sage’s conclusions includes the observation, “Of all possible uses of disclosure, the performance rationale is most likely to create meaningful change in the health care system, but starts from a very different premise—ends-forcing oversight rather than consumer sovereignty.” Id. at 1826.

144 Joint Comm’n on Accreditation of healthcare Organizations, Sentinel Event Policy and Procedures, available at http://jcprdwl.jcaho.org/sentineI/se_pp.htmI (last revised June 2, 2000). A sentinel event “is an unexpected occurrence involving death or serious physical or psychological injury, or the risk thereof.” Id.

145 JCAHO Revised Standards, supra note 117, at I.M. 9.

146 See Nat’l Coalition on Health Care, Accelerating Change Today (A.C.T.)—For America’s Hericashealth.org/act_initiative.html (last visited Nov. 16, 2001).

147 http://www.nchc.org/ (last visited Nov. 16,2001).

148 http://www.ihi.org/ (last visited Nov. 16, 2001).

149 Nat’l Coalition on Health Care & Inst, for Healthcare Improvement, Reducing Medical Errors and Improving Patient Safety: Success Stories from the Front Lines of Medicine (2000), available at http://www.nchc.org/releases/medical_release_2-22.htm.

150 Am. Health Ass’n, Successful Safety Practices, at http://www.aha.org/medicationsafety/SuccessfulPractices.asp (last visited Nov 17, 2001).

151 See, e.g, JCAHO, Look-Alike, Sound-Alike Drug Names, SENTINEL Event ALERT, May 2001, available at http://jcprdwl.jcaho.org/edu_pub/sealert/seal9.html (last visited Nov. 17, 2001).

152 Agency for Healthcare Research and Quality, The Healthcare Cost and Utilization Project, at http://www.ahrq.gov/data/hcup/hcup-pkt.htm (last visited Nov. 19, 2001).

153 For example, the Kids’ Inpatient Database (KID) contains data from approximately 1.9 million hospital discharges for children, at http://www.ahrq.gov/data/hcup/hcupkid.htm (last visited Nov. 19, 2001).

154 Health Care Quality Improvement Act of 1986 Pub. L. No. 99-660, 100 Stat. 3784-3794 (codified as amended at 42 U.S.C. §§ 11101-11152 (1994)).

155 Graham, Christina A., Comment, Hide And Seek: Discovery in The Contexto of the State and Federal Peer Review Privileges, 30 CUMB. L. Rev. 111 (2000)Google Scholar.

156 http://www.npdb.com

157 42 U.S.C. § 11133 (1994).

158 See Am. Dental Ass'n v Shalala, 3 F.3d 445 (D.C. Cir. 1993). The ADA challenged an DHHS regulation which required a “person or entity” to report malpractice settlement payments to a central data bank. id. at 446. The court held that only entities are required to report, and that the “person” provision violated the HCQIA, under which the regulations were promulgated. Id. at 448.

159 42 U.S.C. §§ 11131-11132, 11134 (1994).

160 See U.S. Dep’t Health and Human Servs., Office of Inspector Gen., Pub. No. OEI-Ol- 99-00690, Managed Care Organization Nonreporting to the National Practitioner Data Bank: A Signal For Broader Concern ii (2001). Discussing nonreporting by MCOs the OIG report noted:

Id.

161 U.S. Dep’t Health and Human Servs., Office Inspector Gen., Pub. No. OEI-01-00-00060, The Medicare Beneficiary Complaint Process: a Rusty Safety Valve 4 (2000).

162 If a professional review action … of a professional review body meets all the standards specified in section 11112(a) of this title ….

42 U.S.C.A. § 11111(a)(1) (West 2001). See also Gabaldoni v. Wash. County Hosp. Ass'n, 250 F.3d 255, 260 (4th Cir. 2001) (holding that hospital that had terminated physician’s clinical privileges had satisfied the preconditions for HCQIA immunity); No. Colo. Med. Ctr., Inc. v. Nicholas, 2001 WL 705600, *1 (Colo. Jun 25, 2001) (holding that participants in a peer-review of a physician complied with HCQIA and were immune from contract and tort claims in the state court).

42 U.S.C. § 11115(d) (1994). See, e.g., St. Luke's Episcopal Hosp. v. Agbor, 952 S.W.2d 503, 509 (Tex. 1997) (holding that a state statute providing for immunity for provider credentialing decisions applied not only to actions by physicians, but also to patient actions notwithstanding incorporation of HCQIA into Texas statute).

164 See Graham, supra note 155, at 125.

165 See Press Release, U.S. Pharmacopoeia, USP Gr Error Reporting in Oklahoma, May 8, 2001, available at http://www.onlinepressroom.net/uspharm.

166 See Sage, supra note 144, at 1704 (“[OJne regulatory strategy has emerged as a favored approach of disparate constituencies: expanding the amount of information about the health care system circulating among consumers, providers, and voters.”).

167 See, e.g., Nat’l Comm. For Quality Assurance (NCQA), at http://www.ncqa.org (providing both accreditation and performance measurement for MCOs). See generally Iglehart, John K., The National Committee for Quality Assurance, 335 New Eng. J. Med. 995, 995 (1996)CrossRefGoogle ScholarPubMed (“The NCQA accredits managed- care plans that voluntarily request a review of their operations and develops performance measures for plans through the Health Plan Employer Data and Information Set (HEDIS), the most prominent of recent private efforts to develop, collect, standardize, and report measures of plan performance.”). See also Am. Accreditation HealthCare/Commission (URAC), at http://www.urac.org.

168 See, e.g., Medicare Program; Establishment of the Medicare+Choice Program, 63 Fed. Reg. 34,968, 34,989 (1998) (incorporating the “Quality Improvement System for Managed Care” (QISMC) standards requiring health plans both to possess quality assessment capabilities and to establish and meet performance improvement goals). See also HCFA, Quality of Care ~ National Projects, Quality Improvement System for Managed Care (QISMC), at http://www.hcfa.gov/quality/3a.htm.

169 See, e.g., Minn. Stat. Ann. § 145.61(5) (West 2001).

170 See, e.g., 42 U.S.C.A. § 11137 (West 2001).

171 Peer Review Improvement Act of 1982, Pub. L. No.97-248, 96 Stat. 381 (1982) (codified as amended at 42 U.S.C. §§ 1320c to 1320c-22 (1994)).

172 Pub. Citizen, Inc. v. Dep’t Health and Human Servs., 151 F. Supp. 2d 64, 66 (D.D.C. 2001).

173 See supra text accompanying notes 117-120.

174 JCAHO Revised Standards, supra note 117, at Rl.1.2.2.

175 See infra text accompanying note 365.

176 See, e.g., Abagail Zuger, A Program's Goal: Evaluate and Rehabilitate Problem Doctors, N.Y. Times, July 3, 2001, at F5 (discussing the Institute for Physician Evaluation).

177 Harris Interactive, Consumer Bac klash Against Managed Care and Pharmaceutical Industries—Bottomed out or in Remission?, Health Care News, May 29, 2001, available at http://www.harrisinteractive.com/news/newsletters_healthcare.asp.

178 U.S. News & World Rep., America’s Best Hospitals, July 23, 2001, available at http://www.usnews.com/usnews/nycu/health/hosptl/tophosp.htm. See also Sun. Times, Sun. Times, Jan. 14, 2001, at http://www.sunday-times.co.uk/.

179 http://www.epinions.eom/health_beauty/tk_~HP001.l.56 (last visited Nov. 14, 2001).

180 http://www.patientwise.net (last visited Nov. 14, 2001)

181 http://my.webmd.com/find_a_phys/doctor (last visited Nov. 14, 2001).

182 Cal. Healthcare Found., What Patients Think of California Hospitals (2001), available at http://hospitalguide.chcf.org.

183 U.S. Dep’t Health and Human Servs., Ctrs. for Medicare & MEDICAID SERVS., Nursing Home Compare, at http://www.medicare.gov/NHCompare/Home.asp (last visited Nov. 27, 2001). Testifying before a Senate Subcommittee, a high-ranking DHHS official recently described this as follows:

Using Technology to Improve Medicare Before the Sen. Comm, on Commerce, Subcomm. on Sci., Tech, and Space, 107th Cong. 4 (2001) (statement of Tom Scully, Admin., Ctrs. for Medicare & Medicaid Servs.).

184 See, e.g., Comm’n, Maryland Nursing Home Performance Evaluation Guide, at http://209.219.237.235 (last visited Nov. 18, 2001). In England, see Nat'l Health Serv., Dep’t of Health, NHS Performance Ratings, at http://www.doh.gov.uk/performanceratings/index.html (last visited Nov. 18, 2001).

185 See, e.g., Mass. Board of Registration in Med., Massachusetts Board of Registration, Medicine Physician Profile System, at http://www.docboard.org/ma/df/masearch.htm (last visited Nov. 14, 2001); FLA. Dep’t Health and Human Servs., Medical Quality Assurance, Practitioner Profiling, at http://www.doh.state.fl.us/mqa/ProfiIing/index.htmI (last visited Nov. 14, 2001); VA. BOArd of Med., Virginia Board of Medicine Practitioner Information, at http://www.vahealthproviders.com/index.asp (last visited Nov. 14, 2001). Such publication is, however, controversial. See, e.g., Boodman, Sandra G., New Tech, Old Politics; Virginia Doctors Block Web Access to Data Available by Phone, Mail, WASH. POST, July 31, 2001Google Scholar at F01; Smith, Tammie, Web Site About Doctors Scrutinized, Disciplinary Data Curbs are Sought, Richmond Tlmes-Dispatch, July 11, 2001Google Scholar, at B3.

186 Julie Appleby, Medicare Overhaul Could Include Ratings: Officials Consider Requiring Hotly Debated Quality Reports on Health Providers, USA TODAY, June 6, 2001, at IB (noting the controversial speech by Thomas Scully, head of CMS). In England, government regulators publish information about hygiene in public hospitals. See Duckworth, Loma & Bell, Thomas, Hit Squads Sent in to Clean up Squalid Hospitals, The Independent, Apr. 11, 2001Google Scholar, at 6.

187 See supra text accompanying notes 59-64.

188 For a broad-rar.ging discussion of the role and reach of modern warning doctrine, see generally Carlin v. Superior Court, 920 P.2d 1347 (Cal. 1996). See also Nicolas Terry, P., Collapsing Torts, 25 Conn. L. Rev. 717, 757 n.197 (1993)Google Scholar.

189 on of “bad” cases infra text accompanying note 290.

190 See supra text accompanying note 135.

191 http://www.cochrane.org (last visited Nov. 17, 2001). See also David L. Sackett, Letter, Cochrane Collaboration, 309 BRIT. MED. J. 1514; Wormald & Katherine Oldfield, Mark R., Evidence Based Medicine, the Cochrane Collaboration, and the CONSORT Statement, 82 Brit. J. Ophthalmol. 597 (1998)CrossRefGoogle Scholar.

192 Agency for Healthcare Research and Quality, Evidence-based Practice, at http://www.ahrq.gov/clinic/epcix.htm (last visited Nov. 17, 2001).

193 David L Sackett et al., Editorial, Evidence Based Medicine: What It is and Whatlt Isn't, 312 Brit. Med. J. 71, 71 (1996).

195 http://www.guideline.gov/index.asp (last visited Nov. 12, 2001).

196 Medscape, Medscape Multispecialty Practice Guidelines, at http://www.medscape.com/Home/Topics/multispecialty/directories/dir-MULT.PracticeGuide.html (last visited Nov. 12, 2001).

197 Agency for Healthcare Research and Quality, Clinical Practice Guidelines Online, at http://www.ahrq.gov/clinic/cpgonline.htm (last visited Nov. 12, 2001).

198 See. e.g., Am. Ass’n Clinical Endocrinologists, Clinical Guidelines Online Index, at http://www.aace.com/clin/guidelines (last visited Nov. 12, 2001); Am. Coll. Cardiology, Clinical Statements/Guidelines, at http://www.acc.org/clinical/statements.htm (last visited Nov. 12, 2001).

199 See, e.g., Medexact, at http://www.medexact.com (last visited Nov. 18, 2001). MedExact offers centralized, well-designed treatment information on over 600 conditions and disease states. MedExact's treatment information is drawn from the publications of leading medical associations and institutions such as the National Cancer Institute, the National Institutes of Health, and the American Diabetes Association, and are approved by these organizations before being posted at MedExact. MedExact also includes direct links to these organizations’ own sites. Id.

200 http://www.nlm.nih.gov/nlmhome.html (last visited Nov. 19, 2001).

201 See supra text accompanying note 145.

202 A clinical pathway is a tool that sets locally agreed clinical standards, based on the best available evidence, for managing specific groups of patients. The pathway forms part or all of the patient’s record and allows the care given by members of the multidisciplinary team, together with the progress and outcome, to be documented.

See Editorial, Kitchiner, Peter E. Bundred & Denise J., Clinical Pathways: A Practical Tool for Specifying, Evaluating and Improving the Quality of Clinical Practice, 170 MED. J. AUSTL. 54, 54 (1999)CrossRefGoogle Scholar. See also Robert Trowbridge & Scott Weingarten, Agency for Healthcare Research and Quality, Pub. No. 01-E057, Making Health Care Safer: a Critical Analysis of Patient Safety Practices, Ch. 52. Critical Pathways (2001), available at http://www.ahrq.gov/clinic/ptsafety/chap52.htm.

203 Feder, Gene et al., Using Clinical Guidelines, 318 Brit. MED. J. 728, 728 (1999)CrossRefGoogle ScholarPubMed.

204 Furrow, Barry R., Broadcasting Clinical Guidelines on the Internet: Will Physicians Tune In?, 25 Am. J.L. & Med. 403, 409 (1999)Google ScholarPubMed (footnotes omitted).

205 See, e.g., Chin, Tyler, Gathering Clinical Evidence Online, AMNews, Dec. 11, 2000Google Scholar, available at http://www.ama-assn.org/sci-pubs/amnews/pick_00/tesal211.htm.

206 Furrow, supra note 204, at 421.

207 Morrison v. MacNamara, 407 A.2d 555, 562-63 (D.C. 1979) (citations omitted).

208 1997 Tenn. App. LEXIS 597, *1 (Tenn. Ct. App. Aug. 29, 1997). See also Rodriguez v. Jackson, 574 P.2d 481 (Ariz. App. 1977); Washington v. Washington Hosp. Ctr., 579 A.2d 177 (D.C. 1990); Campbell v. Hosp. Serv. Dist. No. 1, 768 So.2d 803 (La. Ct. App. 2000); Cornfeldt v. Tongen, 295 N.W.2d 638 (Minn. 1980), Bever v. State Bd. of Registration for Healing Arts, 2001 WL 68307 (W.D. Mo. Jan. 30, 2001).

209 Frakes, 1997 Tenn. App. LEXIS 597, at* 1.

210 Id. at *3 (basing the argument on FED. R. EVID. 801).

211 Id. at *9.

212 Id. at *13-14 (noting that TENN. R. EVID. 803(17) is identical to Fed. Rules Evid. 803(18)).

213 See, e.g., McCay v. Mitchell, 463 S.W.2d 710, 715 (Tenn Ct. App. 1970).

214 Tenn. Evid. Rule 618 provides:

215 Fed. R. Evid. 803(18) provides:

Cf. Tenn. Evid. R. 803 (18) Advisory Commission Comment: “Learned treatises can be used to impeach an expert but are not themselves admissible to prove the truth of their contents. No good reason exists to permit hearsay to be taken as true just because it is written in books. Fed. R. Evid. 803(18) is contra.” See also Greathouse v. Rhodes, 618 N.W.2d 106, 115-16 (Mich. Ct. App. 2000) (applying minority impeachment rule).

216 “If admitted, the statements may be read into evidence but may not be received as exhibits.” FED. R. Evid. 803(18). See also Tart v. McGann, 697 F.2d 75, 78 (2d Cir. 1982):

Most commentators found the hearsay objections to learned treatise evidence unconvincing, and recommended that treatises be admitted as substantive evidence. Some commentators went so far as to suggest that treatises be admitted independently of an expert's testimony.… The Advisory Committee rejected this position, noting that a treatise might be ‘misunderstood and misapplied without expert assistance and supervision.’ Accordingly, the Rule permits the admission of learned treatises as substantive evidence, but only when an expert is on the stand and available to explain and assist in the application of the treatise….” (citations omitted).

217 Frakes, 1997 Tenn. App. LEXIS 597 at, *15-16 (reference omitted).

218 Id. at *11. See also Davenport By and Through Davenport v. Ephraim McDowell Mem’l Hosp., Inc., 769 S.W.2d 56, 61-62 (K.y. App. 1988):

219 See, e.g., Frakes, 1997 Tenn. App. LEXIS 597, at *15-16. (“[T]hey should not necessarily be viewed as conclusive evidence of the standard of care. Proof of compliance with practice guidelines should not necessarily establish due care; just as proof of noncompliance should not establish negligence per se.” (reference omitted)).

220 See, e.g., United Blood Servs. v. Quintana, 827 P.2d 509, 519 (Colo. 1992) (holding that blood bank from which woman received AIDS-contaminated blood should be judged using ordinary principles of negligence, and that the defendant's conduct should be measured against what a reasonable and prudent blood bank would or should have done under the same or similar circumstances); Helling v. Carey, 519 P.2d 981, 984 (Wash. 1974) (finding that ophthalmologist breached reasonable standard of care by failing to administer a glaucoma test to woman with substantial vision loss).

221 See, e.g., Velazquez v. Portadin, 751 A.2d 102, 107-11 (N.J. 2000) (finding that a physician's professional conduct implicates only the exercise of reasonable care in the performance of a medical procedure, and not the exercise of medical judgment in selecting among acceptable and medically reasonable courses of treatment).

222 See, e.g., Clark v. Doe, 695 N.E.2d 276, 302-03 (Ohio 1997) (finding a two schools of thought jury instruction misleading in case involving poorly treated broken leg); Levine v. Rosen, 616 A. 2d 623, 626-27 (Pa. 1992) (finding no evidence of divergent opinions, the court rejected the two schools of thought defense in malpractice case involving negligent diagnosis of breast cancer).

223 See, e.g., State Bd. of Med. Examiners v. McCroskey, 880 P.2d 1188, 1194-95 (Colo. 1994) (rejecting the respected minority rule, noting that the accepted standard of medical practice can not be ascertained by “counting how many physicians follow a particular practice”).

224 See Mello, Michelle M., Of Swords and Shields: The Role of Clinical Practice Guidelines in Medical Malpractice Litigation, 149 U. Pa. L. Rev. 645, 666 (2001)CrossRefGoogle Scholar.

225 Kacmar, Donald E., The Impact of Computerized Medical Literature Databases on Medical Malpractice Litigation: Time for Another Helling v. Carey Wake-Up Call?, 58 OHIO ST. L.J. 617, 654 (1997)Google Scholar.

226 Id. at 639-53.

227 For a definition, see whatis?com, at http://whatis.techtarget.eom/definition/0,289893,sid9_gci212172,00.html (last visited Nov. 11, 2001 ).

228 See, e.g., Personalization Consortium, at http://www.personalization.org/ (last visited Nov. 17, 2001).

229 Rosoff, Arnold J., The Role of Clinical Practice Guidelines in Health Care Reform, 5 Health Matrix 369, 383-84 (1995)Google ScholarPubMed.

230 Mello, supra note 224, at 708-09. Cf. Richard E. Leahy, Comment, Rational Health Policy and the Legal Standard of Care: A Call for Judicial Deference to Medical Practice Guidelines, 11 Calif. L. Rev. 1483, 1506 (1989) (arguing that courts should take judicial notice of practice guidelines promulgated by legitimate medical authorities as the legal standard of care).

231 Rosoff, Arnold J., Evidence-Based Medicine and the Law: The Courts Confront Clinical Practice Guidelines, 26 J. HEALTH POL., POL’Y & LAW 327, 356 (2001)CrossRefGoogle ScholarPubMed.

232 Individually identifiable health information is information that is a subset of health information, including demographic information collected from an individual, and:

• (1) Is created or received by a health care provider, health plan, employer, or health care clearinghouse; and

• (2) Relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual; and

• (i) That identifies the individual; or

• (ii) With respect to which there is a reasonable basis to believe the information can be used to identify the individual.

…

Protected health information means individually identifiable health information:

• (1) Except as provided in paragraph (2) of this definition, that is:

  • (i) Transmitted by electronic media;

  • (ii) Maintained in any medium described in the definition of electronic media at §162.103 of this subchapter; or

  • (iii) Transmitted or maintained in any other form or medium.

45 C.F.R. § 164.501 (2001):

233 Id.

234 45 C.F.R. § 164.514(e) (2001).

235 See O’Harrow, Robert, Patient Files Opened to Marketers, Fundraisers, WASH. POST, Jan. 16, 2001Google Scholar, at E01.

236 ⁶ 45 C.F.R. § 164.514(f) (2001).

237 See Tracy v. Merrell Dow Pharms., Inc., 569 N.E.2d 875, 880 (Ohio 1991) (holding that physician established necessary relationship with plaintiff to be considered a learned intermediary and had duty to warn patient of risks of investigational drug).

238 See generally Direct-to-Consumer Promotion, 61 Fed. Reg. 24,314 (May 14, 1996); Draft Guidance for Industry; Consumer-Directed Broadcast Advertisements; Availability, 62 Fed. Reg. 43,171 (Aug. 12, 1997); Guidance for Industry on Consumer-Directed Advertisements; Availability, 64 Fed. Reg. 43,197 (Aug. 9, 1999).

239 See, e.g., Perez v. Wyeth Labs. Inc., 734 A.2d 1245, 1263 (N.J. 1999). See also Vitanza v. Upjohn Co., 214 F.3d 73 (2d Cir. 2000).

240 See, e.g., Kashishian v. Port, 481 N.W.2d 277, 278 (Wis. 1992). See also Jones v. Chicago HMO Ltd. 730 N.E.2d 1119 (111. 2000); Petrovich v. Share Health Plan 719 N.E.2d 756 (111. 1999); Gilbert v. Sycamore Mun. Hosp., 622 N.E.2d 788 (111. 1993); Sword v. NKC Hosps., Inc., 714 N.E.2d 142 (Ind. 1999). See discussion infra of institutional liability for failure to provide informed consent accompanying text at note 338.

241 See supra text accompanying notes 177.

242 David W. Bates & Atul A. Gawande, The Impact of The Internet on Quality Measurement, Health Aff., Nov./Dec., at 104,104 (2000).

243 See generally Terry, supra note 188, at 773-74.

244 Rosoff, supra note 229, at 238.

245 Internet Healthcare Coalition, eHealth Code of Ethics, at http://www.ihealthcoalition.org/ethics/ehcode.html (2000); Health on the Net Foundation, HonCode, at http://www.hon.ch/HONcode/Conduct.html (1997); Hl-ETHICS, INC., Health Internet Ethics: Ethical Principles For Offering Internet Health Services to Consumers, at http://www.hiethics.org/Principles/index.asp (last visited Nov. 12, 2001).

246 See Jadad & Anna Gagliardi, Alejandro R., Rating Health Information on the Internet: Navigating to Knowledge or to Babel?, 279 JAMA 611, 611 (1998)CrossRefGoogle Scholar.

247 Delamothe, Tony, Editorial, Quality of Websites: kitemarking the west wind, 321 Brit. Med. J. 843, 843 (2000)CrossRefGoogle ScholarPubMed.

248 One who undertakes, gratuitously or for consideration, to render services to another which he should recognize as necessary for the protection of a third person or his things, is subject to liability to the third person for physical harm resulting from his failure to exercise reasonable care to protect his undertaking, if

• (a) his failure to exercise reasonable care increases the risk of such harm, or

• (b) he has undertaken to perform a duty owed by the other to the third person, or

• (c) the harm is suffered because of reliance of the other or the third person upon the undertaking.

Restatement (Second) of Torts § 324A (1997).

249 For example, in Hempstead v. Gen. Fire Extinguisher Corp., 269 F. Supp. 109, 118 (D. Del. 1967), Underwriter’s Laboratories, a well-known non-profit testing laboratory, was held potentially liable after a whitelisted fire extinguisher exploded. The court noted: “The alleged failure of Underwriters to exercise reasonable care in approving the design of the extinguisher has obviously increased the risk of harm to plaintiff over that which would have existed if reasonable care had been exercised.” Id. This proposition was later approved by the court in Arnstein v. Mfg. Chemists Ass’, 414 F. Supp. 12, 14-15 (E.D. Pa. 1976), which also posited potential liability based on the closely related Restatement (Second) of Torts section 323. See also Nicolas P. Terry, Rating the “Raters”: Legal Exposure of Trustmark Authorities in the Conte atics, 2 J. MED. Internet Research el8 (2000), available at http://www.jmir.org/2000/3/el8.

250 See, e.g., Press Release, Fed. Trade COMM’N, “Operation Cure.All” Wages New Battle in Ongoing War Against Internet Health Fraud, June 14, 2001, (describing the joint FTC and FDA initiative targeting the fraudulent marketing and sale of dietary supplements and other products on the Internet), available at http://www.ftc.gov/opa/2001/06/cureall.htm. See also Greg Winter, U.S. Vows More Scrutiny of Health Ads on Net, N.Y. Times, June 15, 2001, at C4; David McGuire, Govt. Agencies Crack Down On Online Comfrey Sales, Newsbytes, (July 9,2001), at http://www.newsbytes.com/news/01/167742.html..

251 Terry, Nicolas P., Cyber-Malpractice: Legal Exposure for Cybermedicine, 25 Am. J.L. & Med. 349, 352 (1999)Google ScholarPubMed.

252 E.g., 47 U.S.C. § 230 (1994) (providing arguable ISP/Web publisher immunity). See Jane Doe One v. Oliver, 755 A.2d 1000,1002 (Conn. Super. Ct. 2000).

253 Terry, supra note 251, at 354-55.

254 Prager, Linda O., Doctors May Face Liability Sites, AM. MED. NEWS, Sept. 4, 2000Google Scholar, available at http://www.ama-assn.org/sci-pubs/amnews/pick_00/prsa0904.htm

255 45 C.F.R. § 164.502(b)(1) (2001) (“When using or disclosing protected health information or when requesting protected health information from another covered entity, a covered entity must make reasonable efforts to limit protected health information to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request.”).

256 45 C.F.R. § 164.502(b)(2) (2001).

257 45 C.F.R. § 164.502(a)(2) (2001).

258 OCR has been given enforcement jurisdiction. See Statement of Delegation of Authority to the Office for Civil Rights, 65 Fed. Reg. 82,831 (Dec. 28, 2000).

259 45 C.F.R. § 164.512 (2001).

260 45 C.F.R. § 164.506 (2001).

261 45 C.F.R. § 164.508 (2001).

262 45 C.F.R. § 164.506(a) (2001).

263 See 45 C.F.R. § 164.508 (2001).

264 “The consent document may be brief and may be written in general terms.” Guidance/Q&As, supra note 37.

265 A consent document is brief (may be less than one page). It must refer to the notice and must inform the individual that he has the opportunity to review the notice prior to signing the consent. The Privacy Rule does not require that the individual read the notice or that the covered entity explain each item in the notice before the individual provides consent. We expect that some patients will simply sign the consent while others will read the notice carefully and discuss some of the practices with the covered entity.

Id.

266 A patient's written consent need only be obtained by a provider one time …. A health care provider needs to obtain consent from a patient for use or disclosure of PHI only one time. This is true regardless of whether there is a connected course of treatment or treatment for unrelated conditions. A provider will need to obtain a new consent from a patient only if the patient has revoked the consent between treatments.

Id.

267 45 C.F.R. § 164.506(b) (2001).

268 45 C.F.R. § 164.506(c)(4) (2001).

269 4 5 C.F.R. § 164.508(b)(4) (2001).

270 45 C.F.R. § 164.508(b)(3) (2001).

271 45 C.F.R. §§ 164.506(b)(5), 164.508(b)(5) (2001).

272 45 C.F.R. § 164.506(c) (2001).

273 45 C.F.R. § 164.506(b)(4) (2001).

274 See, e.g., 45 C.F.R. § 164.508(c)(2) (2001).

275 45 C.F.R. § 164.508(b)(3) (2001).

276 45 C.F.R. §164.508(c)(d)(e)(f) (2001).

277 See supra text accompanying note 234.

278 45 C.F.R. § 164.510 (2001).

279 See generally Nicolas P. Terry, Apologetic Tort Think: Autonomy and Information Torts, 38 ST. LOUIS L.J. 189, 189-90 (1993) (contending that that the doctrine of informed consent does not, as commonly assumed, have a fully developed ethical structure).

280 See generally Miller, Frances H., Health Care Information Technology and Informed Consent: Computers and the Doctor-Patient Relationship, 31 Ind. L. Rev. 1019, 1032 (1998)Google ScholarPubMed (discussing how “the theoretical basis for a physician's negligent failure to secure an informed patient consent to therapy has come a very long way from the original battery rationale for requiring patient consent to medical touching”).

281 Terry, supra note 279, at 192.

282 See. e.g.. Restatement (Second) OF TORTS § 892B (1997). See, e.g., Micari v. Mann. 481 N.Y.S.2d 967 (N.Y. Sup. Ct. 1984). Although no physical force was employed, the court found a teacher’s requirement of sexual acts during class a form of sexual abuse which warranted punitive damages. Id. at 970.

283 See, e.g., Trogun v. Fruchtman, 207 N.W.2d 297, 311-13 (Wis. 1973):

See also Matthies v. Mastromonaco, 733 A.2d 456, 461 (N.J. 1999) (“The rationale for basing an informed consent action on negligence rather than battery principles is that the physician's failure is better viewed as a breach of a professional responsibility than as a nonconsensual touching”).

284 See, e.g., McNeil v. Brewer, 710 N.E.2d 1285, 1288-89 (111. App. Ct.1999):

See also Brzoska v. Olson, 668 A.2d 1355, 1363-64 (Del. 1995) (holding that “the incidental touching of a patient by an HIV-infected dentist while performing ordinary, consented-to dental procedures is insufficient to sustain a battery claim in the absence of a channel for HIV infection.”); Gaskin v. Goldwasser, 520 N.E.2d 1085, 1095 (111. App. Ct. 1988) (finding that removal of patient’s lower teeth was without consent and thus sufficient to support a battery theory of recovery).

285 See, e.g., Cobbs v. Grant, 502 P.2d 1, 8 (Cal. 1972). See also Lugenbuhl v. Dowling, 701 So. 2d 447,456 (La. 1997) (holding that doctor failed to obtain adequate informed consent when he failed to discuss with a patient the risks of mesh use in hemia repair); Pema v. Pirozzi, 457 A.2d 431, 440-41 (N.J. 1983) (holding that a patient who consents to surgery by one surgeon, but is actually operated on by another, has an action for malpractice against the former and for battery against the latter).

286 See. e.g., Campbell v. Palmer, 568 A.2d 1064, 1067 (Conn. App. 1990)

287 See generally Jay Katz, the Silent World of Doctor and Patient (1984) (discussing the obstacles between meaningful physician patient interaction); see also Jay Katz, Informed Consent— A Fairy Tale? Law's Vision, 39 U. PlTT. L. REV. 137 (1977).

288 The classic case remains that of Canterbury v. Spence, 464 F.2d 772 (D.C.Cir.1972). See also Pluger v. Physicians Ins. Co., 549 N.W.2d 286 (Wis. Ct. App. 1996); Largey v. Rothman, 540 A.2d 504 (N.J. 1988). See generally the appendix in Ketchup v. Howard, 543 S.E.2d 371 (Ga. Ct. App. 2000), providing a summary of the law on the issue of informed consent. Some legislatures have also entered the fray:

Del. Code Ann. tit. 18, § 6801(6J (2000). Cf. Tenn. Code Ann. § 29-26-118 (2000):

289 Morgan v. MacPhail, 704 A.2d 617, 618 (Pa. 1997) (holding that informed consent was not required in cases involving non-surgical procedures).

290 The relationship is not accidental. Plaintiffs are less likely to complain about deficient informed consent procedures if the treatment is completed satisfactorily. Equally, plaintiffs attorneys are unlikely to finance informed consent cases on a contingency fee basis in the absence of severe damage.

291 Cf. Carson v. Fine, 867 P.2d 610, 617 (Wash. 1994):

292 The classic exposition of this issue in the legal literature is Marjorie Maguire Shultz, From Informed Consent to Patient Choice: A New Protected Interest, 95 YALE L.J. 219 (1985).

293 “Consent may be what can be called a transition concept, one that appears on the scene as an apparently progressive innovation, but after a period of experience turns out to be only useful as a transition to a more thoroughly revisionary conceptual framework.” Robert M. Veatch, Abandoning Informed Consent, Hastings Ctr. Rep., Mar./Apr. 1995, at 5. Veatch’s work is further discussed infra text at note 305.

294 See, e.g., Matthies v. Mastromonaco, 733 A.2d 456, 464 (1999):

295 See, e.g., Arato v. Avedon, 858 P.2d 598, 599-600 (Cal. 1993) (declining to require mandatory disclosure of life expectancy in case where doctor allegedly failed to discuss the low life expectancy of a patient suffering from pancreatic cancer).

296 See, e.g., Truman v. Thomas, 611 P.2d 902, 907 (Cal. 1980) (holding that doctor had a duty to provide the decedent with all information material to her decision whether or not to undergo pap smear diagnostic test). Cf. Vandi v. Permanente Med. Group, Inc., 9 Cal. Rptr. 2d 463, 467 (Cal. 1992) (holding that the duty of disclosure is predicated upon a recommended treatment or diagnostic procedure and the failure to recommend a procedure must be addressed under ordinary medical negligence standards).

297 See, e.g., Johnson v. Kokemoor 545 N.W.2d 495, 498 (Wis. 1996). Cf. Arato v. Avedon, 858 P.2d 598, 599-600 (Cal. 1993).

298 See, e.g., Johnson v. Kokemoor 545 N.W.2d 495, 498 (Wis. 1996). Cf. Duttry v. Patterson, 771 A.2d 1255, 1259 (Pa. 2001):

299 See, e.g., Moore v. Regents of Univ. Cal., 793 P.2d 479, 482 (Cal. 1990) (holding that physician must disclose his proprietary and financial interests in stem cells extracted from a patient).

300 Wis. Stat. Ann. § 448.30 (West 2001).

301 Miller, supra note 280, at 1042.

302 Ohio Rev. Code Ann. § 2317.54 (West 2001). See also FLA. STAT. ANN. § 766.103(4)(a) (West 2001) (“A consent which is evidenced in writing … if validly signed by the patient or another authorized person, raise a rebuttable presumption of a valid consent”).

303 For a summary of consent within different physician-patient models, see Habiba, Marwan A., Examining Consent within the Doctor-Patient Relationship, 26 J. Med. Ethics 183 (2000)CrossRefGoogle Scholar.

304 Braddock, Clarence H. et al., Informed Decision Making in Outpatient Practice: Time to Get Back to Basics, 282 JAMA 2313, 2313-14 (1999)CrossRefGoogle ScholarPubMed.

305 It is increasingly clear if one studies the theory of clinical decision making that there is no longer any basis for presuming that the clinician can even guess at what is in the overall best interest of the patient. If that is true, then a model in which the clinician guesses at what he or she believes is best for the patient, pausing only to elicit the patient's concurrence will no longer be sufficient. Increasingly we will have to go beyond patient consent to a model in which plausible options are presented (perhaps with the professional's recommendation regarding a personal preference among them, based on the professional's personally held beliefs and values), but with no rational or “professional” basis for even guessing at which one might truly be in the patient's best interest.

Veatch, supra note 293, at 5.

306 See, e.g., discussion accompanying supra note 240.

307 Veatch, supra note 293, at 10.

308 Id.

309 As Veatch notes:

Id. at 11.

310 For background, see Ted Kemp, Personalization Isn't a Product, at http://www.intemetweek.com/newslead01/lead060101.htm (May 31, 2001).

311 Terry, Nicolas, Access vs. Quality Assurance: The e-Health Conundrum, 285 JAMA 807 (2001)Google ScholarPubMed.

312 See generally Allen Buchanan, Trust in Managed Care Organizations, 10 Kennedy Inst. Ethics J. 189 (2000) (discussing the nature of trust in the physician-patient relationship).

313 Howe, Edward G., Leaving Laputa: What Doctors Aren’t Taught about Informed Consent, 11 J. Clinical Ethics 3, 11 (2000)Google ScholarPubMed.

314 See generally supra text accompanying note 58.

315 See Am. Med. Ass’n,, Principles of Medical Eythics, IV, at http://www.ama-assn.org/ama/pub/category/2512.html (last visited Nov. 23,2001) (“A physician shall respect the rights of patients, colleagues, and other health professionals, and shall safeguard patient confidences and privacy within the constraints of the law.”).

316 See, for example, URAC's health web site accreditation program, at http://www.urac.org/websiteaccreditation.htm (last visited Nov. 23, 2001). URAC’s Health Web Site Standards, Version 1.0, are available at http://www.urac.org/programs/technologyhws.htm (last visited Nov. 23, 2001).

317 See, e.g., Janet Wells, Wrong MDs Got Patient Records; Psychiatric Privacy Violated, S.F. Chron., Dec. 30, 2000 at A13; O’Harrow, supra note 235. See generally Cal. Healthcare Found., Report on the Privacy Policies and Practices of Health Web Sites, at http://ehealth.chcf.org/index.cfm?section=Privacy (last visited Nov. 23, 2001).

318 See generally Gostin, supra note 68, at 513-16.

319 Internet Healthcare Coalition, eHealth Code of Ethics (2000), at http://www.ihealthcoalition.org/ethics/ehcode.html; Health on the Net Foundation, HonCode, at http://www.hon.ch/HONcode/Conduct.html (1997); Hl-Ethics, INC., Health Internet Ethics: Ethical Principles For Offering Internet Health Services to Consumers, at http://www.hiethics.org/Principles/index.asp (last visited Nov. 12, 2001).

320 See cases discussed at supra note 58.

321 592 A.2d 1251 (N.J. Super. Ct. 1991).

322 Id. at 1271.

323 Id. at 1273-74.

324 Standards for Privacy of Individually Identifiable Health Information, Final Rule, 65 Fed. Reg. 82,462, 82,474 (Dec. 28, 2000) (emphasis added).

325 Guidance/Q&AS, supra note 37.

326 See, e.g., 45 C.F.R. §§ 164.506(b)(3), 164.506(b)(4), 164.508(b)(l)(ii), 164.508(b)(3) (2001).

327 45 C.F.R. §§ 164.506(c), 164.508(c)(2) (2001).

328 45 C.F.R. § 164.506(c)(5) (2001).

329 45 C.F.R. § 164.508(c)(v) (2001).

330 Cf. Schreiber v. Physicians Ins. Co., 588 N.W.2d 26, 31-32 (Wis. 1999):

We reject the notion that the onset of a procedure categorically forecloses a patient's withdrawal of consent. To be sure, at some point in virtually every medical procedure a patient reaches a point from which there is no return.

However, that point need not be arbitrarily created at the commencement of treatment. Rather it varies with the nature and circumstances of the individual procedure and continues so long as there exist alternative viable modes of medical treatment.

In this case, a cesarean delivery at all times remained a viable medical alternative to the VBAC [vaginal delivery] and ultimately that is how [the defendant] delivered [the baby]. Unlike the circuit court, we determine that since alternative viable modes of medical treatment existed, [the plaintiff] was still able to withdraw her consent to the VBAC. Having determined that [the plaintiff] had withdrawn her consent to the VBAC, we must now examine the effect, if any, of that withdrawal. The [plaintiffs] contend that her withdrawal both removed [the defendant’s] authority to continue with the VBAC and obligated him to conduct another informed consent discussion. We agree.

331 See, e.g., Wells v. Storey, 792 So. 2d 1034, 1044 (Ala. 1999); Bryant v. HCA Health Servs., 15 S.W.3d 804, 807 (Tenn. 2000). See also Giese v. Stice, 567 N.W.2d 156, 162-65 (Neb. 1997) (discussing how other courts have addressed the issue).

332 The doctrine is based on Darling v. Charleston Cmty. Mem'l Hosp., 211 N.E.2d 253 (III. 1965) and its progeny.

333 Krane v. St. Anthony Hosp. Sys., 738 P.2d 75, 77 (Colo. App. 1987).

334 See, e.g., Cross v. Trapp, 294 S.E.2d 446, 459 (W. Va. 1982) (holding that absent agency relationship with physician, hospital had no duty to obtain patient's informed consent to surgery).

335 See, e.g., Kus v. Sherman Hosp., 644 N.E.2d 1214, 1214 (111. App. Ct. 1995); Friter v. Iolab Corp., 607 A.2d 1111,1113 (Pa. Super. Ct. 1992).

336 Butler v. S. Fulton Med. Ctr., 452 S.E.2d 768, 772 (Ga. Ct. App. 1994).

337 See generally 46 C.F.R. §§ 46.101-46.124 (2001) and 21 C.F.R. §§ 56.101-56.124 (2001) for the obligations of institutional review boards supervising human experimentation.

338 Recall the discussion above as to institutional liability generally, supra text accompanying note 240.

339 45 C.F.R. §§ 164.506(b)(6), 164.508(b)(6) (2001).

340 45 C.F.R. § 164.508(d)(2) (2001).

341 See generally Rosoff, Arnold J., Informed Consent in the Electronic Age, 25 Am. J.L. & Med. 367 (1999)Google ScholarPubMed (discussing how technology is impacting doctor-patient relations).

342 See Hall, Mark A., A Theory of Economic Informed Consent, 31 Ga. L. Rev. 511 (1997)Google ScholarPubMed; Wolf, Susan M., Toward a Systemic Theory of Informed Consent in Managed Care, 35 Hous. L. Rev. 1631 (1999)Google Scholar

343 Cf. Wolf, supra note 342, at 1639.

A systemic theory of informed consent must place treatment decisions in a broader framework. Questions of disclosure and consent arise at a number of points: when a worker takes a job offering a certain health care package, when the worker selects or reselects among health plans and enrolls in one, when the subscriber then chooses a primary care physician or clinic, and finally, when the patient consents to treatment. To reduce the informed consent problem to the question of what should happen at the last of these points fails to recognize the profoundly systemic nature of the problem of information transfer and consent.

344 “The covered entity may choose to obtain and store consents in paper or electronic form, provided that the consent meets all of the requirements under the Privacy Rule, including that it be signed by the individual. Paper is not required.” GUIDANCE/Q&As, supra note 37.

345 See supra text accompanying notes 264-268.

346 Id.

347 Id. at 384.

348 Id.

349 See generally Daar & Spencer Koerner, Judith F., Telemedicine: Legal and Practical Implications, 19 Whittier L. Rev. 3 (1997)Google Scholar (providing a brief history of the development of telemedicine, as well as a discussion of its current and potential future uses). See also Rensberger, Jeffrey L., Choice of Law, Medical Malpractice, and Telemedicine: The Present Diagnosis with a Prescription for the Future, 55 U. MIAMI L. REV. 31 (2000)Google Scholar.

350 See, e.g., Ariz. Rev. Stat. § 36-3602(A) (2000). See also Ky. Rev. Stat. Ann. § 311.5975 (2000); Neb. Rev. Stat. § 71-8505 (2000); OKLA. STAT. Ann. tit. 36, § 6804 (West 1999).

351 Cal. Bus. & PROF. CODE § 2290.5(c) (West 2001).

352 O’Neal v. Hammer, 953 P.2d 561, 568 (Haw. 1998):

353 See, e.g., Hailey v. Birbiglia, 458 N.E.2d 710, 715 (Mass. 1983) (holding that physician could not be held liable under informed consent doctrine for injuries sustained by infant where physician was not the admitting or attending physician, was not the physician who formally ordered the arteriogram and was not one of the medical personnel who spoke with the infant's parents and assured them of safety of test).

354 Prooth v. Wallsh, 432 N.Y.S.2d 663, 665 (N.Y. Sup. Ct. 1980) (citations omitted).

355 See generally Margaret J. Radin, Humans, Computers, and Binding Commitment, 75 IND. L.J. 1125, 1152 (2000) (discussing the effect of new types of contracts on our understanding of contractual commitment and on the law that determines which commitments are binding).

356 See, e.g., ProCD, Inc. v. Zeidenberg, 86 F.3d 1447 (7th Cir. 1996).

357 See, e.g., Caspi v. Microsoft Network, L.L.C., 732 A.2d 528 (N.J. Super. Ct. 1999). See also Hotmail Corp. v. Van Money Pie, Inc., No. C98-20064 JW, C-98 JW PVT ENE, 1998 U.S. Dist. LEXIS 10729, *1 (N.D. Cai. Aug 16, 1998); In re RealNetworks, Inc. Privacy Litigation, 2000 U.S. Dist. LEXIS 6584, at *1 (N.D. 111. May 11, 2000).

358 see e.g., America Online, Inc., v. Superior Court of Alameda County, 108 Cal. Rptr. 2d 699 (Cal. Ct. App. 2001); Williams v. America Online, Inc., No. 00-0962, 2001 Mass. Super. LEXIS II, at *1 (Mass. Sup. Feb. 8,2001).

359 Netscape argues that the mere act of downloading indicates assent. However, downloading is hardly an unambiguous indication of assent. The primary purpose of downloading is to obtain a product, not to assent to an agreement. In contrast, clicking on an icon stating “I assent” has no meaning or purpose other than to indicate such assent. Netscape's failure to require users of SmartDownload to indicate assent to its license as a precondition to downloading and using its software is fatal to its argument that a contract has been formed.

Specht v. Netscape Communications. Corp., 150 F. Supp. 2d 585, 589 (2001).

360 See generally Silverman, Ross D., Regulating Medical Practice in the Cyber Age: Issues and Challenges for State Medical Boards, 26 Am. J.L. & Med. 255 (2000)Google ScholarPubMed (examining the effect computers and the Internet have on the ability of state medical boards to regulate the practice of medicine, and the responses at the state and federal level to these technological developments).

361 Cal. Bus. & PROF. CODE § 2290.5(c) (West 2001).

362 Spielberg, Alissa R., On Call and Online: Sociohistorical, Legal, and Ethical Implications of E-mail for the Patient-Physician Relationship, 280 JAMA 1353, 1353 (1998)CrossRefGoogle ScholarPubMed.

363 Beverly Kane & Daniel Z. Sands, Guidelines for the Clinical Use of Electronic Mail with Patients, 5 J. Am. Med. Informatics Ass’n 104, 106 (1998).

364 Indeed, there is a growing consensus that regular, unsecured email should not be used for anything but the most routine of physician-patient communications. See Press Release, MEDEM, “A void Standard Un-Secure E-mail for Online Communications with Patients,” Says Nation's Leading Medical Societies and the AMA, Top Malpractice Carriers and Medem Groups, Apr. 30, 2001, available at http://www.medem.com/Corporate/press.

365 A third species of false negative may be caused by a failure in the plaintiff’s substantive case, such as a failure in expert testimony to prove that the defendant failed to comply with professional standards. This is less of a system error and generally will be remedied by allowing the plaintiff more latitude in proving negligence, such as by the utilization of practice guidelines. See supra text accompanying note 208.

366 See sources cited supra note 94.

367 See generally Christopher D. Mount et al., An Integrated Electronic Health Record and Information System for Australia?, 172 Med. J. Ayustl. 25 (2000) (contending that an integrated health record and information system would provide benefits for clinicians and patients through better clinical care, and for the healthcare system through better data for policy development and resource allocation).

368 Terry, supra note 188, at 723.

369 See, e.g., Ybarra v. Spangard, 154 P.2d 687, 691 (Cal. 1944) (holding res ipsa charge proper despite plaintiffs inability, due to anesthesia, to specify what instrumentality, under exclusive control of which defendant, caused the injury). For a recent summary of jurisdictional attitudes towards the application of res ipsa loquitur in medical malpractice cases, particularly those requiring expert testimony as to the standard of care, see Seavers v. Methodist Med. Ctr., 9 S.W.3d 86, 93-95 (Tenn. 1999).

370 See, e.g., Sindell v. Abbott Labs, 607 P.2d 924, 937 (Cal. 1980) (finding that pharmaceutical manufacturers composing a “substantial percentage” of the drug market could each be liable for an amount proportionate to its market share, absent proof that it could not have produced the DES consumed by plaintiffs mother). See also Summers v. Tice, 199 P.2d 1, 3-4 (Cal. 1948) (holding that the exculpatory burden applied where plaintiff could not prove which of two hunters’ bullets had injured him).

371 Barker v. Lull Eng’g Co., 573 P.2d 443, 455 (Cal. 1978) (adopting a risk-benefit analysis test for strict products liability design defect cases with the burden of proof allocated to defendant manufacturer).

Id. See generally Terry, supra note 188, at 726-30.

372 See Rubin, Luiza A.B. Camacho & Haya R., Assessment of the Validity and Reliability of Three Systems of Medical Record Screening for Quality of Care Assessment, 36 Med. Care 748, 748 (1998)Google Scholar.

373 See Am. Health Info. Mgmt. Ass’n, Practice Brief: Definition of the Health Record for Legal Purposes, at http://www.ahima.Org/journal/pb/01.10.2.html (last visited Nov. 20, 2001). See generally Palmer, Robert Gray, Altered and ‘Lost’ Medical Records, 35 TRIAL 31 (1989)Google Scholar (contending that evidence of spoliation of records in medical negligence actions can strengthen a client’s case).

374 Moskovitz v. Mt. Sinai Med. Ctr., 635 N.E.2d 331, 344 (1994) (finding evidence regarding physician's alteration of patient’s records supported award of punitive damages).

375 Gordon v. Willis Knighton Med. Ctr., 661 So. 2d 991, 993 (La. Ct. App. 1995) (noting that while the entry in the hospital's emergency room records indicate when the patient arrived, the entry had been altered in such a manner that no one could determine the original entry).

376 Dimora v. Cleveland Clinic Found., 683 N.E.2d 1175, 1182 (1996) (holding that evidence submitted was sufficient to raise a factual question requiring determination by a jury as to whether progress and discharge notes were falsified or inaccurately reported to avoid liability for medical malpractice). See also Robinson v. Singing River Hosp. Sys., 732 So. 2d 204 (Miss. 1999). See generally Marks, Lynn Wilson, Medical Malpractice: Case Management and Other Guidelines, 7 J. Forensic Document Exam. 11 (1994)Google Scholar; Prosser, Robert L., Alteration of Medical Records Submitted for Medicolegal Review, 267 JAMA, 2630, 2630 (1992)CrossRefGoogle ScholarPubMed (“Issues related to alterations of medical records have surfaced in four of the 10 medicolegal cases I have reviewed in the last 12 months.”).

377 Computer-Based Patient Record, supra note 137, at 2-3.

378 See, e.g., Shadrick v. Coker, 963 S.W.2d 726, 731 (Tenn. 1998). See also Furrow, Barry R., Doctors’ Dirty Little Secrets: The Dark Side of Medical Privacy, 37 Washburn L.J. 283 (1998)Google ScholarPubMed (discussing physician duties regarding patient privacy rights).

379 See generally Kimberly D. Richard, Note and Comment, Electronic Evidence: To Produce or Not to Produce, That is the Question, 21 WHITTIER L. REV. 463 (1999) (examining the impact new technology has on clientsi attorneys, courts and the legal system in general).

380 See supra text accompanying note 125.

381 The CPR is hearsay under Federal Rule of Evidence 801, but admissible under the business records exception in Rule 803(6), subject to compliance with conditions therein. See, e.g., Welsh v. Galen of Va., Inc., 2001 WL 502123, *1 (Ky. App. May 11, 2001); Powell v. Catholic Med. Ctr., 749 A. 2d 301 (N.H. 2000); Patterson v. Hutchens, 529 N.W.2d 561 (N.D. 1995).

382 Security and Electronic Signatures; Proposed Rule, 63 Fed. Reg. 43,241, 43,266 (Aug. 12, 1998) (to be codified at 45 C.F.R. § 142.308(a)).

383 Security and Electronic Signatures, Proposed Rule, 63 Fed. Reg. at 43,267.

384 Security and Electronic Signatures, Proposed Rule, 63 Fed. Reg. at 43,268.

385 See, e.g., Diane Levick, Insurers At Risk Online, Study Says, Hartford Courant, Sept. 7, 2001, at E2.

386 Security and Electronic Signatures, Proposed Rule, 63 Fed. Reg. at 43,266.

387 Security and Electronic Signatures, Proposed Rule, 63 Fed. Reg. at 43,266.

388 Security and Electronic Signatures, Proposed Rule, 63 Fed. Reg. at 43,268.

389 Security and Electronic Signatures, Proposed Rule, 63 Fed. Reg. at 43,268.

390 Security and Electronic Signatures, Proposed Rule, 63 Fed. Reg. at 43,268.

391 See, e.g., Verisign, Healthcare p://www.verisign.com/enterprise/healthcare/authentication.html (last visited Nov. 10, 2001). See also AM. MED. ASS’N, AMA Internet ID: Protecting Your Identity Online, at www.ama-assn.org/intemetid (last modified Oct. 25, 2001).

392 Currently, this regulation is to be codified at 45 C.F.R. §143.310, but likely will be spun off into a separate rule.

393 45 C.F.R. § 164.502(a)(l)(i) (2001).

394 45 C.F.R. § 164.512(e) (2001).

395 45 C.F.R. § 164.524(a)(1) (2001).

396 45 C.F.R. § 164.524(a)(l)(i) (2001). The PIHI regulation uses the term psychotherapy notes, as defined in 45 C.F.R. § 164.501 (2001).

397 45 C.F.R. § 164.524(a)(1) (2001).

398 45 C.F.R. § 164.501 defines the “designated record set” as:

A group of records maintained by or for a covered entity that is:

• (i) The medical records and billing records about individuals maintained by or for a covered health care provider;

• (ii) The enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan; or.

• (iii) Used, in whole or in part, by or for the covered entity to make decisions about individuals.

Presumably the only (thin) argument that could be raised by the individual is the whether the peerreview material could be included under (iii). Presumably, a provider could be at risk it fails to segregate out its records as suggested by the designated set language.

399 45 C.F.R. § 164.524(c)(4) (2001). Undefined in PIHI, the reasonable fee under the Montana health privacy statute is addressed as follows:

Mont. Code Ann. § 50-16-540 (2000).

400 45 C.F.R. § 164.524(b)(1) (2001).

401 See, e.g., 45 C.F.R. § 164.524(c)(3) (2001).

402 See supra text accompanying note 174.

403 The window will close to an extent as litigation looms closer because 45 C.F.R. § 164.528(1 )(ii) allows the provider to deny a request to access “Information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding.”

404 45 C.F.R. § 164.528 (2001) (“An individual has a right to receive an accounting of disclosures of protected health information made by a covered entity in the six years prior to the date on which the accounting is requested.”).

406 45 C.F.R. § 164.526(a)(1) (2001).

407 45 C.F.R. § 164.526(a)(2) (2001).

408 45 C.F.R. § 164.526(d)(1) (2001).

409 45 C.F.R. § 164.526(d)(2) (2001).

410 CAL HEALTH & SAFETY CODE § 123100 (West 2001).

411 Mont. Code Ann. § 50-16-502(2) (2000).

412 See generally AS C.F.R. §§ 160.203-160.205 (2001).

413 45 C.F.R. § 160.202(2) (2001).

414 See Health Privacy State Rep., supra note 53, at 10.

415 Uniform Health-Care Info, act (1985), available at http://www.law.upenn.edu/bll/ulc/fnact99/1980s/uhcia85.htm. The National Conference of Commissioners on Uniform State Laws has recently released a discussion draft, Proposed REVISIONS of Uniform Health Care Info, act (2000), available at http://www.law.upenn.edu/bll/ulc/uhcia/hci0600.htm. According to the Commissioners:

416 Mont. Code Ann. §§ 50-16-501 to 50-6-504 (2000).

417 Wash. Rev. Code §§ 70.02.005 to 70.02.904 (2000).

418 See, e.g., CAL. CIV. CODE § 56-56.37 (West 2001); R.I. GEN. LAWS § 5-37-22 (2000); Wis. STAT. §§ 146.83, 610.70(3) (2001).

419 Mont. Code Ann. § 50-16-541(1) (2000).

420 Mont. Code Ann. § 50-16-541(2) (2000).

421 “[I]n many ways, the state laws defy summarization C (sic)they are detailed, specific, and intricate.” Health Privacy State Rep., supra note 53, at 10.

422 See Press Release, Am. Med. Ass’n., AMA Survey Regard for Internet, May 9, 2001, available at http://www.ama-assn.org/ama/pub/category/1616.html.

423 45 C.F.R. § 164.501 (2001).

424 Guidance/Q&AS, supra note 37.

425 This is known as TCP/IP telephony. See generally Microsoft, Microsoft Windows 2000 Server Documentation: IP Telephony Concepts, at http://www.microsoft.com/windows2000/en/server/help/default.asp (last visited Nov. 12, 2001).

426 For a primer, see Michelle L. Truckor, Comment, The Loss of Chance Doctrine: Legal Recovery for Patients on the Edge Of Survival, 24 Dayton L. Rev. 349 (1999).

427 This percentage is still below the summary judgment standard for “more probable than not” under a conventional causation standard. See, e.g., Bell v. United States, 854 F.2d 881, 883 (6th Cir. 1988).

428 See, e.g., Shady Grove Psychiatric Group v. Md., 736 A.2d 1168, 1173 (Md. 1999) (noting that under extant Maryland law a health care provider is required to disclose a medical record to a prosecution agency pursuant to a subpoena issued in a criminal investigation, but only if the prosecution agency first proves that it has written procedures to protect the confidentiality of that record).

429 Cal. Health & Safety Code § 123105(d) (West 2001).

430 See generally Robin Toner, After Patients’ Rights: Vast Needs, Higher Hurdles, N.Y.TfMES, July 2, 2001, at All (discussing the multitude of issues confronting Congress after passage of the Patient’s Bill of Rights).

431 See Milt Freudenheim, A Changing World is Forcing Changes on Managed Care, N.Y. Times, July 2, 2001, at A1 (discussing how managed care is evolving under pressure from doctors, patients, consumer advocates and employers).

432 E.g., Bipartisan Patient Protection Act, S. 1052, 107th Cong (2001).

433 See, for example, recent evidence-based research commissioned by AHRQ that studied documented methods of improving patient safety and identified eleven essentially clinical measures as having the most potential impact. MAKING HEALTH CARE SAFER, supra note 126, at v-vi.

434 See Robert McCarthy, Health Care Dragged, Clicking and Beeping, Into the Digital Age, 13 Drug Benefit Trends 20, 25 (2001); Craig Stoltz, Welcome to the #?!!*&*! Future of Medicine, Wash. Post, Jan. 9, 2001, at T8; Bill Scanlon, The Net is a Prescription for Medicine, Zdnet Interactive Week (Mar. 19, 2001), at http://www.zdnet.com/intweek/stories/news/0,4164,2696791,00.html.

435 Jennifer Steinhauer, In a Health Revolution, a Hospital's Baby Steps, N.Y. Times, at http://www.nytimes.com/library/tech/00/10/biztech/technology/ (Oct. 25, 2000).

436 The latest AMA survey suggests some movement here. Although the proportion of physicians having a Web site has leveled off, the survey discloses significant increases in physician use of the Web for research and as a resource for patient education. Furthermore, roughly one-quarter of online physicians communicate with their patients via email. See Press Release, Am. Med. ASS’N, AMA S or Internet, May 9, 2001, available at http://www.ama-assn.org/ama/pub/category/1616.html. See also Tyler Chin, Tech Effect: Better health Care Tug. 13, 2001, available at http://www.ama-assn.org/sci-pubs/amnews/pick_01/tesa0813.htm; Harris Interactive, New Data Show Internet, Website and Emaileb. 26, 2001, available at http://www.harrisinteractive.com/news/newsletters_healthcare.asp.

437 There are, of course, exceptions. S into Internet Age, USA TODAY, at http://www.usatoday.com/life/cyber/tech/2001-03-27-hospital.htm (Mar. 27, 2001); Press Release, Healthsouth, HELTHSOUTH, Oracle to Build Groundbreaking Digital Hospital, Mar. 26, 2001, available at http://www.healthsouth.com.

438 Gartner’s second quarterly survey on compliance with the regulations of the Health Insurance Portability and Accountability Act (HIPAA) completed in February 2001, showed that only 18 percent of healthcare payer organizations and 4 percent of healthcare providers had at least begun planning the remediation for all of their application software.

See Wes Rishel, Gartner Research Inc., The Y2K. Lesson for Hipaa: Nail Down Your Vendors Early 1 (2001), available at http://www3.gartner.com/l_researchanalysis/focus/health_fa.html.

439 See, e.g., S.C. Med. Ass’n v. HHS, D.S.C., No. C/A 3-01-2965 (D. S.C. July 16, 2001) (challenging the constitutionality of section 264 of HIPAA as violative of separation of powers). See also Mike Stobbe, SCMA Fights New Patient Information Rules, The State, July 16, 2001, available at http://web.thestate.com/content/columbia/2001/07/16/local/medrulesl6.htm; Press Release, Ass’n Am. Physicians and Surgeons, AAPS Doctors Sue to Sto se Survey of Doctors on HIPAA Rules, July 31, 2001, available at http://www.aapsonline.org.

440 See, e.g., Health Data Mgmt., Legislators Ask Thompson to Fix Privacy Rule, Provide Funds, available at http://www.healthdatamanagement.com/html/hipaa/hipaa.cfm (July 19, 2001) (discussing letters to Secretary Thompson from 165 House and fifteen Senate members urging changes to privacy rule and financial assistance for providers). See also S. 1684, 107th Cong. (2001) (providing a one year extension of the date for compliance with EDI, but not the privacy aspects of the HIPAA regulations).

441 See, e.g., Guidance/Q&As, supra note 37. Specifically, the Guidance answered the following question:

Q: What changes might you make in the final rule?

A: We continue to review the input received during the recent public comment period to determine what changes are appropriate to ensure that the rule protects patient privacy as intended without harming consumers’ access to care or the quality of that care.

Examples of standards in the Privacy Rule for which we will propose changes are:

• Phoned-in Prescriptions …

• Referral Appointments …

• Allowable Communications …

• Minimum Necessary Scope ….

In addition, HHS may reevaluate the Privacy Rule to ensure that parents have appropriate access to information about the health and well-being of their children.…

Other changes to the Privacy Rule also may be considered as appropriate.

See also the Aug. 6, 2001 letter to DHHS Secretary Thompson from eighty-six healthcare and employer organizations urging the Secretary to “move as expeditiously as possible” to modify the privacy regulations, available at http://www.hipaadvisory.com/news/2001/hlc0806.htm.