Delving Into Google Health's Privacy Concerns 121
SecureThroughObscure writes "Security researcher Robert 'RSnake' Hansen discusses numerous concerns with Google's new Google Health application, which aims to integrate user's medical records online. We discussed Google Health's opening to the public earlier this week. RSnake mentions that Google has found a loophole allowing them to provide this service without having to follow HIPAA regulations, which, combined with Google's track record of having numerous flaws leading to private information disclosure, draws serious concern. Security researcher Nate McFeters of ZDNet's Zero-Day Security Blog also commented on the article, mentioning several past vulnerabilities: ownership of content issues, Google Docs theft, a cross-domain hole, Google XSS, and a Google Picasa protocol handler issue leading to the theft of user images. He and fellow researcher Billy Rios disclosed these issues to Google, including the ability to steal GMail contact list information. McFeters says it's likely that similar unpatched bugs would allow an attacker to view medical records if a user was also using Google Health. Both McFeters and Hansen tend to agree that Google's vulnerability disclosure/notification is non-existent and really needs to be improved. Currently, Google does not report vulnerabilities it has fixed to its user base, for the obvious reason of trying to hide the fact that user data could have been stolen."
Not me (Score:5, Insightful)
Microsoft's HealthVault.com policies comparison (Score:5, Insightful)
Let's examine Microsoft's HealthVault.com policies and how they compare to Google Health.
Re:Not me (Score:4, Insightful)
Rough Analog (Score:3, Insightful)
To me, this would be akin to plastering my personal medical records on a bulletin board in a busy public place with a single coversheet on each item that says "Private Medical Information: Please don't read this."
Thanks to the military, I had an introduction to very early "on-line" medical records. Yes, you guessed correctly. Those records are "no longer available." Fortunately, I requested copies of every contact and kept those in a personal copy of my medical records.
Oh Geeze...stop hyperventilating (Score:3, Insightful)
Quite frankly I'm tired of people complaining on my behalf. Especially when I don't use whatever is being complained about and when the people complaining don't use it either.
Also..it IS a BETA (test). Once they are out of BETA they might actually have to apply HIPPA.
Want access to thousands of Google accounts? (Score:2, Insightful)
1. Start a website requiring users to sign up with email addresses and passwords
2. Go through your DB and get a list of all the gmail ones
3. Try logging in with the gmail usernames and the passwords they gave your site
4. Over half of them will probably work
5. PROFIT!!!!!!
Last time I tried this, I picked about 10 at random. Six worked. I have thousands of gmail accounts in my users table. Lucky I'm not a black hat.
Security? What's security? People just don't think about it or take even the most basic precautions. This Health Records service seems like a very bad idea from a "what could possibly go wrong" perspective but I don't know if Google is to blame for that
FTC regulations cover them which is likely better (Score:3, Insightful)
Also, I believe an organization which changes a policy must ask their members to re-accept their policies under FTC regs.
Thanks for a real and EDUCATED response! (Score:3, Insightful)
I responded above how actually the word is now that these PHRS and their privacy policies are under FTC regulations. My understanding is that the FTC regulations recourses are actually stronger than the HIPAA ones anyway. All the PHR vendors have privacy and data use policies that are STRONGER than HIPAA anyway.
Slashdot users are funny in how they think they know everything. I bet most here had to look up how to spell HIPAA.
Re:Not me (Score:5, Insightful)
1) Insurance companies: "Thank you for choosing Overabarrel Insurance, Co. Your policy is enclosed. Because your father and uncle had colon cancer, your monthly premium will be $10,000/month."
2) Employers: "You're a great programmer, but we can't bring you on full-time. Your records show that your father and uncle had colon cancer, and we can't afford to take on the risk of our insurance premiums going through the roof if you get it."
Essentially, health status can be a significant driver of discrimination in many different forms. The less someone knows about your health status (or your relatives health status), the hard it is for them to discriminate against you.
Re:Safe Now With Windoze? (Score:4, Insightful)
It's basically common knowledge, what GP is saying. I clearly remember watching both what my dentist's and my GP's secretaries used to type in my data, and it was obviously a client running on a Windows box. In the case of my dentist, there's a whole Windows dental information suite that he runs, which shows him x-rays and everything. He has multiple rooms with dentist's chairs, and each contains an apparently-identical computer; he can view x-rays and records at any of them, so they are obviously networked. How likely is it that this network is separated from the Internet by anything more than a consumer-grade router? Not very.
How much of a threat really is this, relative to tapes left in cars overnight, or the sloppy (or malicious) use of thumb drives? My gut says, "not a huge one," but I don't really know.
The necessary results of a fragmented system (Score:3, Insightful)
Re:Not me (Score:2, Insightful)
Re:Loophole? (Score:3, Insightful)
(It's not funny, it's pretty much how Google operates.)
Re:Safe Now With Windoze? (Score:2, Insightful)
Security concern becomes of a whole different order of magnitude when dental, medical, and mental health information all get chunked into the same system, then it becomes kind of like a Real ID for health; convenient one-stop shopping for all your privacy-invading needs.
Re:I'm Your Insurance Company (Score:2, Insightful)
Re:Loophole? (Score:3, Insightful)
And then they will have to buy their own information just to find out what it is. Doesn't matter that you gave it up for free; if you want to know how it is being used or presented, it will cost you.
It will be kind of like the credit bureaus: you can get a free credit report from them (once a year) but if you want your All-Powerful Credit Score, you gotta pay. Sure, it's not a lot of money, but it's still You Paying For Your Own Info.
They don't care (Score:1, Insightful)
Exactly! Medical Records in my Wallet! (Score:2, Insightful)
>> Allow Google to store your ePHI is no different than asking a friend to hold onto your paper medical records.
I keep a list of my wifes allergies and medications in my wallet in case of an emergency. Yeah on a piece of paper in my wallet. So having them available online is just convienent. So I guess someone could steal my wallet too.
Also, as if a gave a crap who knows my medical history. You people have 12 deadbolts on your doors too? Paraniod much???
You people are paraniod!! (Score:2, Insightful)
Oh my god!!
And, No I don't have a built in 100,000volt security system around my ass incase sometries to steal it.