Search all of the Society for Participatory Medicine website:Search
The Journal for Participatory Medicine's website has moved. Please check out the new website for the latest articles.


Summary: Patients are increasingly using new electronic tools such as personal health records and mobile applications to track details about their health, and sharing those details with their physicians. However, some physicians are reluctant to receive digital data from patients due to professional liability concerns. In Project HealthDesign, a research program funded by Robert Wood Johnson Foundation, clinical care teams tested the incorporation of patient-generated, digital information into clinical care. The research teams documented the professional liability concerns voiced by physicians and other clinicians during the study and the steps they took to manage them. The approach they took to managing these concerns could be helpful to providers seeking to engage patients in their care using technology.
Keywords: HIT, PHR, mobile applications, health apps, liability, legal issues, e-patient.
Citation: McGraw D, Belfort R, Pfister H, Ingargiola S. Going digital with patients: managing potential liability risks of patient-generated electronic health information. J Participat Med. 2013 Dec 18; 5:e41.
Published: December 18, 2013.
Financial Disclosure: This paper was funded by a grant from Project HealthDesign, which is a Robert Wood Johnson Foundation-funded research project. The authors were under contract with Project HealthDesign to serve as the Project’s regulatory counsel. Project HealthDesign staff members reviewed and provided feedback on the paper and were involved in the decision to submit the paper for publication to the Journal of Participatory Medicine.
Competing Interests: The authors have no competing interests to disclose.


Patients are increasingly using new electronic tools like personal health records (PHRs) and mobile applications (apps) to track details about their health and, when relevant, are sharing those details with their physicians — often in real time and wholly separate from the traditional office visit. However, some physicians are reluctant to receive digital data from patients due to professional liability concerns. The vast amounts of information that patients could potentially share electronically leaves many physicians wondering whether they could keep up with, and appropriately respond to, important clinical issues that may be presented by the data.

Project HealthDesign, a program of the Robert Wood Johnson Foundation’s Pioneer Portfolio, recently studied the collection of information by patients in personal health apps. The most recent phase of this program involved the incorporation of this patient-generated, digital information into clinical care. The Project HealthDesign research teams documented the professional liability concerns voiced by physicians and other clinicians during the study and the steps they took to manage them. They are presented here for those physicians whose liability concerns may be preventing them from adopting technological approaches to achieve greater engagement with their patients.

Although Project HealthDesign was a research project, it is likely that care models incorporating electronic patient-generated data will become the norm in the near future, as pressures to improve outcomes at lower costs continue to increase. Indeed, achievement of the “triple aim” of health care (i.e., improving the experience of care, improving the health of populations, and reducing per capita costs of health care) depends on patients — with the guidance of their physicians — becoming more engaged in managing their health.[1]

Overview of the Research Project

Project HealthDesign consisted of five research teams that created personal health apps to help patients better manage their health and keep track of observations of daily living (ODLs).[2]ODLs are patient-recorded feelings, thoughts, behaviors and environmental factors that are personally meaningful and provide health cues; they can include information about an individual’s mood, what they ate, levels of pain they experienced, medication they took, and their sleep patterns, among others.

Project HealthDesign tested the hypothesis that capturing ODLs in real time enables patients to provide their physicians and other clinicians with more specific information about their health — the kind of information that could become one of the clinician’s most important tools for engaging patients as partners in their health. The theory is that clinicians who can rely on standard clinical measurements like hemoglobin A1C as well as information on medication adherence, sleep, diet, and exercise will be more able to guide patients in managing their chronic illnesses and achieving improved health outcomes.

Liability Concerns

The physicians (and other clinicians) participating in Project HealthDesign raised the following liability-related concerns:

  • Timeliness and Adequacy of Response: When do physicians become liable for clinical issues related to critical or emergent information generated through a PHR or mobile health app? What if no one sees the information right away? What if a physician does not follow up on the information — either by seeking additional information or attempting to verify it? Do physicians have an obligation to share information with specialists or others who treat the patient?
  • >Who Should Respond: Are physicians liable for the failures of support staff to respond to or accurately interpret electronic health data from patients?
  • Volume of Data: What if the data that comes in through the PHR or mobile health app are not structured (and therefore cannot be automatically populated into clinically relevant fields) and/or are so voluminous as to be overwhelming and, thus practically impossible to respond to in a timely manner?
  • Accuracy: How can physicians trust the accuracy of patient-generated data? How can they ensure that data are not accidentally deleted or that the integrity of the data is not compromised after a patient transmits it?

Although a detailed analysis of the laws governing professional liability is beyond the scope of this paper, it is helpful to know generally that to succeed in a professional liability claim, a plaintiff must prove that the physician failed to meet the applicable “standard of care,” which is generally determined by professional custom. Models of care in which physicians rely on patient-generated health information that is collected and communicated electronically are only beginning to gain acceptance. As a result, professional custom in this area is still forming, leaving physicians with little clear guidance and no “standard of care” regarding how to address these concerns.

Strategies for Managing Risk

In the absence of clear guidance, each of the five Project HealthDesign research teams developed their own strategies for managing what ODLs would be sent to the clinical care team and how they would be handled once they became part of the clinical care “ecosystem.” In short, each team set reasonable and clear expectations on the part of both the clinical care team and the patients that addressed the “who, what, when, where and how” for the electronic information sharing involved in the study:

  • Who: Who on the team will receive information from the patient? To what extent will the information be shared with others? With whom will the information be shared if the information indicates a medical emergency?
  • What: What specific information will the patient share with the clinical care team?
  • When: When (how often and at what times) will a physician or other clinician receive and review the information?
  • Where: Where exactly will the information be collected (eg, will the information remain on the patient-controlled mobile device until it is accessed by the care team)? Under which circumstances, if any, will the information flow into the physician’s electronic health record?
  • How: How will the information be formatted so that the care team can act on it? How will patients be educated about their rights and responsibilities?

Under each research project, it was clear what type of ODLs patients would be communicating and how, where the ODLs would be stored and displayed, and who would review the ODLs, under what circumstances and how often. Consequently, the “data flows” were not uncontrolled but instead were tightly managed. Below are examples of how two of the research projects managed their patient-generated data flows.


The BreatheEasy research team worked with asthma patients to capture ODLs and share them with their primary care physicians (and their clinical care teams) in order to make lifestyle and treatment adjustments to better manage their asthma symptoms. One of the principal investigators on this team is a family physician, so workflows typical of a busy family practice were part of the study design. Patients used smartphones to collect ODLs including peak flow rates, controller medication adherence, rescue medication use and reason for use, asthma symptoms and triggers, mood, physical activity, and smoking habits.

In this project, the ODL data from the patients’ smartphones first passed through a nurse triage system, where nurses, who were guided by clinic-directed protocols, determined if patterns were normal, or if further follow-up with the patient or additional review by a physician was needed. The nurses reviewed the ODL data at least once a week using a “Clinician Dashboard,” which graphically depicted patient ODL trends over time in a customizable web-based interface. Physicians then reviewed the ODL data with the patients using the “Clinician Dashboard” when alerted by the nurse or during patient encounters. For one patient, the Clinician Dashboard enabled the patient’s care team to recognize the patient was using her maintenance medication to address acute episodes, and the rescue medication for maintenance. This review allowed the care team to correct this problem with the patient by using the Dashboard as a visual aid.

The BreatheEasy researchers reported that professional liability concerns were low among the project’s participating physicians. They attributed this to the study’s design, in which they purposefully made the data flows track traditional workflows in a primary care practice (ie, a nurse reviews a patient’s ODL Dashboard and reports significant issues to the physician, just as if the nurse had a discussion with the patient over the phone).


The Chronology.MD team helped patients with Crohn’s Disease create visual narratives of their conditions using ODL data, including measures of abdominal pain, energy level and medications, which they could share with their physicians to help determine the appropriate course of treatment. The team employed the use of an “ODL Prescription” to guide the types of ODLs that each patient shared with his or her physician under the project. The ODL Prescription was developed jointly by the participating patients, their physicians, and the entire clinical care team to ensure the most efficient and effective use of physicians’ time.

Physicians only reviewed the ODLs identified in the ODL Prescription when patients came in for an office visit. Physicians or other clinical staff did not review the ODLs at any other time (patients used this data in between visits to help make adjustments to every day behaviors that can impact Crohn’s Disease symptom management). Thus, the value for physicians of ODL collection under the Chronology.MD project was in the transformation of the raw ODL data into charts and graphs that presented visual “narratives” for the physicians and patients to jointly use in making treatment decisions.

Key Takeaways

To manage liability, the Project HealthDesign research teams took one or more of the steps described below. Physicians seeking to engage patients using digital technologies should consider whether they can implement any of these strategies.

  • Worked with patients to achieve a common understanding of the types of information patients would be sharing, how the sharing would take place, and which members of the clinical team would be reviewing the information and how often. A number of research teams included these elements in their projects’ informed consent forms, which each patient signed before participating in the project. Physicians seeking to incorporate patient-generated electronic health information outside of a research protocol may want to document this common understanding through an agreement or compact signed by the physician and the patient. It is critical that the agreed-upon terms of the “deal” between the patient and the physician are consistently honored by all of the parties. If, for example, the parties agree that the patient should only e-mail during business hours – and the patient e-mails after hours and the physician responds and does not correct the behavior – the physician may not be able to rely on the “deal” to excuse an adverse incident.
  • Designated and trained a member of the clinical care team to monitor incoming data and triage as necessary. Certain of the Project HealthDesign research teams learned that the most efficient way to incorporate patient-generated electronic health information into clinical care was to allow non-physician staff to view the information first. These staff members were able to communicate more frequently with patients, allowing physicians to review the information only when it was clinically necessary or as part of an office visit with the patient. Patients benefited from having their information monitored and from having frequent contact with staff while physicians benefited from only having to review information that was more directly relevant to the their treatment recommendations and assessments of the patient’s progress over time. However, because such physicians may be held liable for the negligence of staff members, it is important that non-physician staff be well trained to appropriately review and respond to the type of electronic patient-generated data being collected.
  • Put a medical emergency protocol in place. Some of the research teams took care to clearly instruct patients to use traditional emergency communications channels in a medical emergency and not to expect that information communicated through a PHR or other digital tool would be reviewed on a real time basis by the clinicians participating in the research projects. These teams also developed emergency communication plans that were triggered when non-physician staff members identified data indicating the possibility of a medical emergency.
  • Used appropriate judgment in deciding when patient-generated electronic health information would be included in the physician’s legal medical record. A physician’s legal medical record is “the documentation of health care services provided to an individual during any aspect of healthcare delivery in any type of health care organization.[3]” Growth in use of electronic health records and other electronic communications tools has made defining the legal medical record more complex. While there is no one-size-fits all definition, the purpose of the legal medical record is to: support decisions made in a patient’s care; support revenue sought from payers; and document the services provided by the physician as evidence of the patient’s illness or injury, response to treatment, and caregiver decisions. Patient-generated electronic health data did not automatically flow into the physician’s electronic medical record under any of the projects. Rather, the decision to include such information was either made in advance by the research teams or made by physicians and the clinical care team on a case-by-case basis.

Professional concerns about potential liability for incorporating electronic patient-generated health information into clinical workflows is understandable. There is no clear standard of care or professional custom to guide the actions of physicians engaging in this innovative activity. However, Project HealthDesign has demonstrated that physicians can take steps to mitigate their liability risk, such as setting and honoring clear expectations about the types of information patients can share, how the sharing should take place, and which members of the clinical team will review the information and how often. These and similar approaches can enable physicians to use electronic patient-generated health information to deliver more patient-centered and, potentially, more effective and cost-efficient care.


The authors wish to thank Patti Brennan, Gail Casper, Steve Downs, and the research teams of Project HealthDesign for their feedback on this manuscript. For more on Project HealthDesign visit


  1. Berwick DM, Nolan TW, Whittington J. The triple aim: care, health, and cost. Health Aff. 2008; 27(3):759-769.
  2. A brief description of each project can be found at
  3. Haugen MB, Tegen A, Warner D. Fundamentals of the legal health record and designated record set, J AHIMA. 2011;82(2)44-49.

Copyright: © 2013 Deven McGraw, Robert Belfort, Helen Pfister, and Susan Ingargiola. Published here under license by The Journal of Participatory Medicine. Copyright for this article is retained by the authors, with first publication rights granted to the Journal of Participatory Medicine. All journal content, except where otherwise noted, is licensed under a Creative Commons Attribution 3.0 License. By virtue of their appearance in this open-access journal, articles are free to use, with proper attribution, in educational and other non-commercial settings.