Public standards and patients' control: how to keep electronic medical records accessible but private