Prepared by Robert Gellman for the World Privacy Forum, “This document offers a legal and policy analysis of the privacy consequences for consumer health information stored on or by Personal Health Records systems that are not subject to the HIPAA health privacy rule.” The document is dated February 20, 2008. It is 17 pp. long (PDF), and is available here.
Maybe patients can use contract law to enhance the privacy of their health records. http://hack-igations.blogspot.com/2008/02/contracts-for-patient-privacy.html