The Administration, Congress, foundations, and the private sector have undertaken various initiatives to promote the adoption of electronic health records (EHRs) as part of the national health information infrastructure. An electronic personal health record (EPHR) is a database of medical information collected and maintained by an individual. Commercial suppliers, health care providers, health insurers, employers, medical websites, and patient advocacy groups offer EPHRs. Congress has held hearings on electronic personal health records, and legislation has been introduced (S. 1456), ordered to be reported (H.R. 2406), and reported (S. 1693). Electronic personal health records are controversial among privacy advocates and patients, who are concerned about health information privacy and security, and misuse of individually identifiable health information. The extent to which electronic personal health records are protected by the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule is discussed herein. This report will be updated. Background. In 2004, the President and the Department of Health and Human Services (HHS) launched an initiative to make electronic health records available to most Americans within the next ten years, and to transform the health care system by lowering costs, reducing medical errors, and improving quality of care.1 The President called on HHS to ...