The California Healthcare Foundation (CHCF) recently released a “Best Practices Guide” for employers who are considering offering a PHR to their employees.  Practical guidance in ten easy steps that covers most of the basics, though personally would have liked to have seen stronger language used, e.g., stating clearly without any “should(s)” that a PHR is a personally-controlled health record.

There is one problem though with this best practice list… 

While they do cover the issue of portability, they fail to address the very real issue of what happens to a record and its data should an employee opt-out or leave, leaving the data behind.  Where does the data go?  Does an employer erase it immediately?   Do they encrypt the record and store off-site for a given time period (held in escrow) prior to deleting?  Big omission here that I hope CHCF will correct.