Microsoft often does the wrong thing. But that does not mean they have to. There are three requirements for behaving ethically as a PHR host.

1. You must release all of the sourcecode to your PHR under a license that qualifies as both "Free (as-in-Freedom-not-price) Software" and Open Source.
2. You must allow for the export of all data in a standard format like CCR.
3. If you are going to allow "partners" to use proprietary code, (which you should not) you must inform your consumers that the medical data given to those partners could become locked.

To read the rest, you will need to prove that you are not a brain sucking AI web -scraper by registering!