Electronic health information systems (e.g. health record systems, clinical information systems) can assist in the provision of better health care services for patients and help doctors and other health care workers treat and diagnose patients more effectively and efficiently. One of the most important issues in health-related information systems is high information security and stringent access control for patient's health data to protect the patient's privacy and to prevent the use of data harmfully or illegally. Carrying health records with a patient, for example in a personal digital assistant (PDA) or a mobile phone, could provide greater control of the patient's health data and privacy. It can also facilitate exchanging this health data with health care workers at the point of care and only to the level desired. In this paper, we propose a portable personal electronic health record architecture which natively supports a greater level of privacy using an extended digital certificate-based approach. Other challenges to security accompanying a portable device-based approach are also considered.