Two key issues dominate the health care privacy agenda for 2008—(1) the ongoing debate about electronic medical records and health information technology and (2) employer efforts to build effective wellness programs as a means of reducing employee health care costs.

Health Information Technology Challenges

At the big-picture level, the ongoing development of health information technology presents an enormous challenge to the overall health care regulatory structure. The marketplace for health information technology is evolving far faster than the regulatory system. There are enormously complicated regulatory challenges (including some of the privacy and security issues that I am involved in through the AHIC Confidentiality, Privacy and Security Work Group), but the difficulty of resolving these critical issues threatens to delay realistic progress in developing health information technology. There's also the "real world" risk that a failure to act quickly enough to form a regulatory framework will mean that the marketplace will develop without appropriate regulatory controls.

The primary challenge now is to find a realistic and widely approved means of encouraging swift development and adoption of health information technology, while, at the same time, developing a realistic regulatory structure, even if it is not a perfect regulatory structure. At the same time, the privacy and security issues that are arising in the context of electronic records— mainly, the question of whether we can develop appropriate privacy and security controls while still achieving the goals of anintegrated health information exchange environment—are so significant, and raise so many questions about the current state of health care privacy laws, that this evaluation of privacy and security issues for electronic medical records and personal health records will drive a wholesale re-evaluation of the overall privacy and security rules for the health care system.

Wellness Plans and Cost Control

We also are seeing that the current push towards broader employee wellness plans is raising significant issues about the employer's role in the health care system. It is clear that the current private health care system—where most of the private insurance is obtained through the workplace—is under fire. On the one hand, some states, like Massachusetts, are forcing employers to be more involved in providing health care to employees. On the other hand, constant cost pressures create real economic tensions with many employers (even large employers, such as the auto manufacturers, where health care costs are deal breakers with the unions). This seems to be a system approching chaos.

On the privacy front, real legal issues arise from employers' attempts to actually reduce costs through modifying employee behavior. Employers are interested in wellness programs, for example, that are pushing better employee behavior, but face real limitations, arising from the privacy laws and elsewhere, on the effectiveness of these programs. All of this seems to be putting pressure on the concept of "one size fits all" employer-sponsored coverage, where all employees, within the range of choices, pay the same price. If there are realistic means of reducing costs by making employees with problematic behaviors pay more, I think we will begin to see during 2008 a serious debate on whether employers can use health information to achieve such goals. The constant cost pressures, coupled with the legal landmines in this area, will lead to a serious debate and real pressure to permit employers to be more active in this area, as a means of preserving an employer-sponsored system that seems on the verge of collapse.