Do you plan to take my medical records home with you? This might become a more popular question after the recent discovery of VA Tech shooter Seung-Hui Cho's medical records. As it turns out, the records had been gathering dust at the home of Dr. Robert C. Miller, former director of Tech's Cook Counseling Center. Could this situation have been avoided with EHRs?

Incredibly, the records were not discovered during the criminal probe following the shooting in April, 2007. It was not until Dr. Miller was to be questioned in a civil suit that the files appeared, after having been removed from the center and never returned.

In the fall out of this discovery, it has become apparent that the removal of patient records, often to finish up on extra work outside of office hours, is fairly commonplace, even in states where such actions are in direct violation of HIPAA. Meanwhile, the argument over paper versus electronic security continues to fester.

Would the situation have been different if the Cook Counseling Center had been using EHRs? If so, the records would have been accessible by credentialed staff and law-enforcement investigators. Dr. Miller could still have had access to the records at home via an encrypted VPN connection.

What is more at risk, an electronic record database susceptible to malicious hackers, or a paper record that can be stolen or destroyed? Both methods of storing confidential patient information have their respective flaws and benefits.

Are more security guidelines the answer? A recent study points out that privacy laws in some states are so restrictive as to prevent adoption of EHRs.

Much of the ARRA incentive discussion has focused on certification criteria and work flow design. Will standards for privacy and security fall through the cracks, taking a back seat to information sharing and "meaningful use"?

As it is, Cho's records may soon become public information thanks to ongoing lawsuits. But the victim's families should not have had to wait 2 years.