Delving Into Google Health's Privacy Concerns

SecureThroughObscure writes "Security researcher Robert 'RSnake' Hansen discusses numerous concerns with Google's new Google Health application, which aims to integrate user's medical records online. We discussed Google Health's opening to the public earlier this week. RSnake mentions that Google has found a loophole allowing them to provide this service without having to follow HIPAA regulations, which, combined with Google's track record of having numerous flaws leading to private information disclosure, draws serious concern. Security researcher Nate McFeters of ZDNet's Zero-Day Security Blog also commented on the article, mentioning several past vulnerabilities: ownership of content issues, Google Docs theft, a cross-domain hole, Google XSS, and a Google Picasa protocol handler issue leading to the theft of user images. He and fellow researcher Billy Rios disclosed these issues to Google, including the ability to steal GMail contact list information. McFeters says it's likely that similar unpatched bugs would allow an attacker to view medical records if a user was also using Google Health. Both McFeters and Hansen tend to agree that Google's vulnerability disclosure/notification is non-existent and really needs to be improved. Currently, Google does not report vulnerabilities it has fixed to its user base, for the obvious reason of trying to hide the fact that user data could have been stolen."

Not me

[strikeleader]

Why would anyone want to put their health info anywhere if HIPAA does not apply. I know that HIPPA is not perfect, but it at least has recourse if info is released or stolen.

Re:Not me

[Chicken04GTO]

Because people are dumb.

Safe Now With Windoze?

[Erris]

Most hospitals now use some form of Windoze client like Impact. The staff surf the web with IE on the same machines. Do you think HIPA means anything in an environment like that? You might as well let Google serve records to people's home PCs because there's no difference between home and hospital now.

Re:

[BlowHole666]

Do you have proof of this or are you just saying this because you do not like Windows? How do you know the computers not locked down where the users can not surf the web? Where is the proof?

Re:

[Anonymous Coward]

The healthcare org I work at the machines with Impact (amazingly enough) are very much locked down through ScriptLogic, so they relock themselves each time someone logs into them. We believe them to be secure and as far as I'm aware we haven't had security problems with them (at least in the past 3 years)

Also we are currently testing out the Microsoft solution for this, as Electronic Health Record stuff is getting to be a very big deal and we don't want to be left behind...

More and more vendors are doing IE

Re:Safe Now With Windoze?

[TerranFury]

It's basically common knowledge, what GP is saying. I clearly remember watching both what my dentist's and my GP's secretaries used to type in my data, and it was obviously a client running on a Windows box. In the case of my dentist, there's a whole Windows dental information suite that he runs, which shows him x-rays and everything. He has multiple rooms with dentist's chairs, and each contains an apparently-identical computer; he can view x-rays and records at any of them, so they are obviously networked. How likely is it that this network is separated from the Internet by anything more than a consumer-grade router? Not very.

How much of a threat really is this, relative to tapes left in cars overnight, or the sloppy (or malicious) use of thumb drives? My gut says, "not a huge one," but I don't really know.

Re:

[Schlage]

Of course, your insecurely networked dentist only has access to a small portion of your medical records, while Google Health would (presumably) eventually be caching your entire medical history.

Security concern becomes of a whole different order of magnitude when dental, medical, and mental health information all get chunked into the same system, then it becomes kind of like a Real ID for health; convenient one-stop shopping for all your privacy-invading needs.

Re:

[dedazo]

It's basically common knowledge, what GP is saying.

No, it's not "common knowledge" at all. My company did a HIPAA-compliant [wikipedia.org] solution for a large provider in 2004-2006 (think Kaiser Permanente-level scale). I wasn't in charge of the client side (which were rich client apps) but I know the developers had a hell of a time trying to get everything to work because the terminals were so locked down. For starters, they didn't have a connection to the internet, and IE wasn't even available. The login provider was

Re:

[TerranFury]

Mod up! Good info here. I'm curious about this now; I wonder if small doctors' offices like the ones I was talking about maintain a similar level of security? I'm sure they hadn't modified the hardware (as different from your case); the computers I've seen each time I've looked have clearly just been vanilla Dell models. I wonder if they at least leave them off the internet as AC suggested? There are hints that they don't, but now I need to investigate this more to know for sure.

Re:

[dedazo]

I really don't know what the guidelines are for small providers. I would think they are the same, though probabl not implemented with the same zeal. But I was serious in my recommendation to report them if you see things like that happening. After all, it's your medical records that are on the line.

Re:

[D'Sphitz]

Why do people think anyone cares about their health info? Worst case scenario is someone finds out you have VD, well sorry to inform you an overwhelming percentage of the planet don't care about you or your STD's.

Re:

[Archimagus]

My Sentiment exactly. First off I don't know who would want to look at my medical record and second, I don't really care if someone does.

Re:

[larry bagina]

Says the guy posting under a fake name, not revealing his email address.

Re:Not me

[MrMarket]

My Sentiment exactly. First off I don't know who would want to look at my medical record and second, I don't really care if someone does.

Here are two types of organizations that would be very interested in you and your family's medical history:
1) Insurance companies: "Thank you for choosing Overabarrel Insurance, Co. Your policy is enclosed. Because your father and uncle had colon cancer, your monthly premium will be $10,000/month."
2) Employers: "You're a great programmer, but we can't bring you on full-time. Your records show that your father and uncle had colon cancer, and we can't afford to take on the risk of our insurance premiums going through the roof if you get it."

Essentially, health status can be a significant driver of discrimination in many different forms. The less someone knows about your health status (or your relatives health status), the hard it is for them to discriminate against you.

Re:

[OverlordsShadow]

Exactly. Not to mention there could be more targeted spam, via email, flyers or phone calls. Someone sees you got burnt years back, call you up with the newest of the new plastic surgery techniques. Woman has breast cancer, gets an email from an implants company. Kid loses leg, gets a call, and multiple emails about cheeta prostetics and such. The list goes on. Someone will have a cure for anything they can find wrong with you. Not to mention targeted Google ads?

Re:Not me

[ShieldW0lf]

You don't understand insurance in the slightest, or you wouldn't make statements like that.

1) When you get insurance as an individual, if you have a previously existing medical condition, and you manage to conceal it, they won't dig hard. They'll just take your money. When it comes time to make a claim, it WILL come out then, and they will refuse to cover you, even though they took your money. Transparency in medical records will protect people from doing this to themselves.

2) When you get group insurance, personal medical records don't come into it at all. Not at all. They calculate the risks based on the probability that any employee will require treatment based entirely on their demographic. That is what makes group insurance plans so appealing in the first place.

I used to sell the stuff for a brief period of time, until I learned how it really worked and realized I wouldn't be able to look myself in the mirror if I didn't get out of that industry. I know what I'm talking about.

Re:

[base3]

When it comes time to make a claim, it WILL come out then

How will they prove it was preexisting if it was never documented anywhere (e.g. MIB, Google's big brother database, or what have you)?

Re:

[ShieldW0lf]

When it comes time to make a claim, it WILL come out then

How will they prove it was preexisting if it was never documented anywhere (e.g. MIB, Google's big brother database, or what have you)?

Because the medical records are there, and have always been there. They aren't actually hard to find, it just takes time, so they don't bother to do it when you apply. They wait till they've gotten 10,000 of your money and are going to have to pay out 1,000,000 to care for you, then they pay someone to spend

Re:

[base3]

Ah--but it *does* have to be documented, then. So if someone manages to find out they were, say, diabetic or HIV positive through an anonymous test (don't know if this is even possible) but kept it under their hat until insured, and was never treated for the condition before having become insured, the insurance company still gets to pay. I was thinking that it might be possible for them to make the argument that the illness had to have been present before the date of insurance, even if they couldn't find do

Re:

[MrMarket]

Then, you would know that most group contracts are up for renewal every year or so. If a group had a big bump in claims in a given year, the next time the contract is up for renewal the premiums will increase. This is particularly a problem for small companies where risk cannot be spread widely -- if one person in a ten-person group has a catastrophic episode and files $1,000,000+ in claims, the company's premiums will sky-rocket. If the company has an ASO contract (like GM for example), the company underwr

Re:

[ShieldW0lf]

It doesn't work like that.

If you open a hair salon with 20 hair stylists, they don't assess the 20 stylists for risk.

What they do is consult their actuary tables and determine the likelihood that someone will become ill or die based on their records for all hair stylists from all companies they have done business with in that industry over the last hundred years.

That is how they determine risk in groups. It doesn't have anything to do with the individual group, but on the demographic of the group.

Re:

[MrMarket]

It is how it works. [nytimes.com]
After a long bout with emphysema an employee at Varney's, a family-owned business in Manhattan, Kan., died several years ago. But for Varney's health insurer, her legacy lived on.
The next year, 2002, the insurer raised Varne's premiums by 28 percent â" even though most of the other three dozen employees were significantly younger and healthier than their departed colleague, who had been in her mid-70â(TM)s. And Varney's premiums continued to climb.
âoeIt was as if her

Re:

[ShieldW0lf]

Ugly. I stand corrected. Sucks to be American, I guess... it doesn't work that way in Canada.

Re:

[Crazyswedishguy]

1. If they can prove you knowingly had colon cancer when you signed up for insurance, they'll refuse to cover you. You're right about that. But if you were healthy at the time you signed up, they're under a contractual obligation to cover you.
However, several factors go into calculating your "risk" from which your insurance rate is derived: race, age, sex, are the basic ones. Any factor, including family history (not only your personal medical history) if available, will affect this rate. So if they accep

Re:

[ShieldW0lf]

1) If you have a family medical history, you are required to divulge it. If you don't divulge it, and it comes up later, they will refuse to honour your coverage because your application was fraudulent, despite having taken your money. So, you're wrong.

2) In my experience, that is an outright falsehood. Cite a source.

Re:

[Crazyswedishguy]

I can only speak for the US, so if you're in another country, this whole argument may be pointless.

1. I've been looking for evidence of this, but so far I haven't seen anything that says you have to disclose family history. What you have to disclose is medical history and pre-existing conditions for yourself and whoever is covered under your policy, but unless your parents and grandparents are under your policy, I have seen nothing that requires you to share their medical history. This might be in some p

Re:

[Crazyswedishguy]

On another note, but related to tfa, in the news:
Bush signs genetic discrimination bill [msn.com]

Not a huge surprise.

I'm Your Insurance Company

[fast turtle]

and we see that you have a pre-existing medical condition that we will never cover. We also see that you tend to engage in risky behavior (smoking/STD's) so we are now terminating all insurance policies as we don't want people who increase our risk of loosing money. Goodbye

I'm sorry Joe but based upon your Google Health Records, we have to let you go. We simply can't afford the loss of insurance coverage for everyone else in the company. No hard feelings.

That's just a couple of reasons for HIPPA. Do you rea

Re:

[Archimagus]

A lot of you seem to be assuming that Google is trying to make your health information freely available to the public. That is not the case. This article talks about the possibility of your information getting STOLEN from google. Which, last I checked is illigal. So if your insurance compay got there hands on your information they would be contributing to illigal activities and run the risk of being shut down or at least sued to Hell and back. Right from the Google Health Web site.

Google stores your information securely and privately. We will never sell your data. You are in control, you choose what you want to share and what you want to keep private.

Also it is not like g

Re:

[MrMarket]

No, we are arguing that the security of this information affects peoples' livelihoods and that users should be aware that the information in Google Health does not fall under the legal protections that HIPAA provides for privacy and security when deciding to use it.

Re:

[Crazyswedishguy]

I bet your insurance company would be interested.

We're slowly approaching an age where genetic profiling is becoming more widely available. I have a family member who got his genetic information mapped, and it's possible that this is going to become common practice within ten years.
At that point, your doctor will be aware of your genetic profile and will be able to better assess your risk of contracting specific diseases, which would improve your ability to prevent them. This is something we could all

Re:Not me

[hal9000(jr)]

Google isn't doing this out of the goodness of their hearts. They want to monetize it, so how will they do that? Sell ads? Ok, where and when will they show up? Only when you are searching your health information or whenever you happen to be searching?

what about selling health information to other entities. Maybe they don't sell the identifying bits, but even regional data can have an enormous impact on your ability to get health and life insurance, the premiums you pay, etc. Insurance carriers already track regional trends, but more data means better predictions.

Look, corporate entities, and never, ever forget that Google is a corporate entity, have to make money and think about how they will do that.

Re:

[bberens]

I doubt they'll sell your health information to other people. It'll be more like "If someone has a history of back problems, show them an ad for my pain relief drug." Of course, I've been wrong before... I personally have no intention of using Google Health, but I wouldn't particularly mind that kind of thing.

Re:

[CrashPoint]

Why do people think anyone cares about their health info?

Because they do.

idiot.

[redxxx]

Yeah seriously. I don't need privacy. I don't have anything to hide. I'm a healthy, white, male, heterosexual, non-terrorist, US citizen.

People that worry about privacy are either stupid or hiding something.

FTC regulations cover them which is likely better

[Blahbooboo3]

Enough with the HIPAA scare. Most of these PHR vendors privacy policies are STRONGER than HIPAA and are governed by the FTC which is (from what I understand) MUCH stronger than HIPAA rights.

Also, I believe an organization which changes a policy must ask their members to re-accept their policies under FTC regs.

Re:

[eggstasy]

Why would anyone want to put their health info anywhere? I think most people would simply write down "uhh... healthy?".
Do people really have so many diseases it takes a computer program to organize them? :D

Unless you're really old, in which case you probably don't even own a computer. Would you need one to write down "don't forget take your blood pressure pills" or "remember to check your pee for diabetes"?
Or maybe you had a weird accident, in which case you would write "healthy, except for that nasty missi

The use case for online health records

[Beryllium Sphere(tm)]

If you live long enough, or if you get cancer early, you'll find yourself dealing with multiple medical professionals who aren't very good at sharing records with each other. Being able to point one doctor to the test results from another doctor can at the least save time and money and at best improve quality of care.

There's also the issue of the sorts of things people use MedicAlert bracelets for. I knew someone who was short on clotting factors and went to the hospital with chest pains. They told him some

Re:

[asdavis]

I'm sorry, but you are not correct on this. First of all, HIPAA is the Health Insurance Portability and Accountability Act. Please notice the single "P" and double "A"s. Secondly, please attempt to count successful HIPAA prosecutions on a single hand. I bet you have a lot of fingers left. I'd also wager you'd be surprised to know that the budget for governmental HIPAA surveillance is approaching nil. Your recourse with most things healthcare are the civil courts, not HIPAA.

Limits of HIPAA

[Beryllium Sphere(tm)]

Not only that, HIPAA doesn't give you recourse to the civil courts. There's no private right of action under HIPAA. There's been one attempt to sue for negligence on the theory that HIPAA sets a standard of care: dunno how that turned out.

(My doctor's office has documents with labels that say "HIPPA". I've given up on ever having it spelled correctly.)

Re:

[EMeta]

Because currently health information of regular people is not accessable for research or analysis. If I had a range of odd, undiagnosed symptoms, I would want to share that and be able to read others' accounts of similar symptoms. The fact that there are probably 500 people in this country sharing some rare ailment means none of them will ever find a doctor who knows anything about it. If just 10 of them didn't care about their own privacy as much as getting their problem fixed, they could compare notes a

Re:

[tkohler]

HIPAA applies to providers and insurance companies. If YOU give out your information, than too bad. Most hospitals have you sign a form that allows them to transmit much of your info anyway, which is often preferable (like from XRay tech to Radiologist to your doctor) than having to sign four different releases. Also, while much of HIPAA is about privacy, remember the "P" stands for portability, not privacy. The right to obtain your records. Google, MS and others are providing a place for you to keep them.

But think of the benefits...

[Anonymous Coward]

When you get syphilis all the websites you visit will be carrying convenient advertisements for the necessary treatments.

Re:

[Anonymous Coward]

"When" I get syphilis?!? I'm asexual you insensitive clod!

Microsoft's HealthVault.com policies comparison

[Anonymous Coward]

Does Microsoft's HealthVault.com, which came before Google Health, receive the same amount of critique?

Let's examine Microsoft's HealthVault.com policies and how they compare to Google Health.

Re:

[jeiler]

Does Microsoft's HealthVault.com, which came before Google Health, receive the same amount of critique?

Yes [slashdot.org], and for much the same reasons.

Re:Microsoft's HealthVault.com policies comparison

[Sporkinum]

This is an email exchange I had with Microsoft on this very subject.

From: HSG Privacy [mailto:[e-mail]]
Sent: Wednesday, December 19, 2007 4:22 PM
To: XXXXXXXXX
Subject: RE: Health Vault Privacy

  Dear Mr. XXXXX,

Our sincere apologies for the long delay in providing you a response to your inquiry.

Because HIPAA applies to organizations and not products, HealthVault and HealthVault Search do not fall under its purview. Microsoft is not waiting for regulations to define our privacy and security practices. Microsoft made the decision early on to set rigorous privacy policies for these products.

Health information technology is evolving rapidly and privacy remains a central concern. Core to Microsoft's privacy principles is our belief that health information is most effectively protected when consumer are at the center of the healthcare system and in control of their information.

Microsoft supports a comprehensive federal approach to privacy legislation. We believe federal privacy legislation should include four key elements to help protect consumer privacy, and to support businesses' privacy policies and compliance efforts. First, there should be a uniform baseline standard that applies across all organizations and industries. Second, any legislation must increase the transparency regarding collection, use and disclosure of personal information. Third, individuals must have meaningful control over the use and disclosure of personal information. Finally, we believe there should be minimum-security requirements around the storage and transit of personal information.

Best regards,

HSG Privacy Team

From: XXXXXXXXXXXX
Sent: Thursday, October 04, 2007 10:36 AM
To: HSG Privacy
Subject: Health Vault Privacy

I noticed while going through the privacy statement there was no reference to HIPAA. With something as personal as one's medical records, HIPAA compliance is a must! http://www.hhs.gov/ocr/hipaa/ [hhs.gov]

Also, I would not be surprised to see a company offer some sort of beneficial tracking program, and then use the data they get through authorization to deny insurance or raise premiums. With advertising being the primary reason for the service, the probability of misuse would be relatively high, I would think.

Re:

[hal9000(jr)]

IANAL, but CFR 164.104(3) A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter and the comments to CFR 160, 162, and 164, indicate otherwise.

Both Google and Microsoft are engaged in transmitting healthcare information.

Correct Citation

[hal9000(jr)]

Sorry, that was CFR 160.102 and CFR 160.103. You can view it here [hhs.gov].

Re:

[gatekeep]

But neither is 'A health care provider'

Re:

[hal9000(jr)]

Good point. It also applies to an entity that is a business associate of a covered entity. It also applies to "healthcare clearing house."

Both seem to apply here.

Loophole?

[jeiler]

Google has found a loophole allowing them to provide this service without having to follow HIPAA regulations

So the only thing protecting personal health information at Google Health is internal policy and "Don't be evil"? I guess that means they'll protect your PHI--as long as you're not a dissident in China.

Re:

[ShieldW0lf]

This is good. Game-changing type of good.

By the time this has all panned out, there won't be any illusions of privacy, only an ever increasing number of people getting their information bought and sold and revealed all over the place until they finally demand to be in on the "knowing whats going on" like everyone else and demand a social order that doesn't revolve around secrets and leverage.

Go Google! Gather it all and screw up keeping control like you usually do!

Re:

[Dekortage]

...an ever increasing number of people getting their information bought and sold and revealed all over the place until they finally demand to be in on the "knowing whats going on" like everyone else...

And then they will have to buy their own information just to find out what it is. Doesn't matter that you gave it up for free; if you want to know how it is being used or presented, it will cost you.

It will be kind of like the credit bureaus: you can get a free credit report from them (once a year) but if y

Re:Loophole?

[funnyguy]

Well, not so much a loophole as HIPAA was not designed to protect data at healthcare record storage companies chosen by the patient. I don't think google "found" this as it has always been known to all of the healthcare community (at least security professionals). You are only covered by HIPAA if you are a "Covered Entity" (CE) which includes health plans (insurance), healthcare providers (doctors) or a healthcare clearinghouse (converts non-standard healthcare data into standardized healthcare formats like X12 format).

If Google or any healthcare records storage comapany is being used by a CE and has a contract with that CE, they are a Business Associate. BAs of CEs are subject to the HIPAA Security Rule (the section of HIPAA that is in question and largely referred to about protecting healthcare data).

Re:

[Hoplite3]

"Don't be Evil" is localized to the local value of evil.

(It's not funny, it's pretty much how Google operates.)

Re:

[Trojan35]

Hmmm.. so if you're a dissident in China, they can now easily check if you have working Kidneys for sale?

Google Calendar exploit?

[bramp]

I think I found a information disclosure problem with Google Calendar, but after a trying to contact Google twice I have given up.

If anyone is interested please read: http://bramp.net/blog/google-calendar-exploit [bramp.net]

and hopefully if this is a bug it can get passed on to Google.

Re:

[Shadow-isoHunt]

Publish it on milw0rm, or post it to bugtraq. It'll get fixed.

Do evil

[kbg]

Well given that Google can be pressured by evil governments or evil companies into doing evil things, as history has shown. I think it is given that they will use this information for evil purposes, maybe they are planning to sell this information to insurance companies.

Rough Analog

[FurtiveGlancer]

To me, this would be akin to plastering my personal medical records on a bulletin board in a busy public place with a single coversheet on each item that says "Private Medical Information: Please don't read this."

Thanks to the military, I had an introduction to very early "on-line" medical records. Yes, you guessed correctly. Those records are "no longer available." Fortunately, I requested copies of every contact and kept those in a personal copy of my medical records.

Oh Geeze...stop hyperventilating

[Danathar]

If you are afraid of your data getting stolen, DON'T USE IT.

Quite frankly I'm tired of people complaining on my behalf. Especially when I don't use whatever is being complained about and when the people complaining don't use it either.

Also..it IS a BETA (test). Once they are out of BETA they might actually have to apply HIPPA.

Re:

[techpawn]

Also..it IS a BETA (test). Once they are out of BETA they might actually have to apply HIPPA.

Gmail, google maps, and google talk are still in beta but that hasn't stopped people from widely using them.

I think your first piece of advice is the best piece there blue canary. If you are worried, then don't use it. I personally want as few people as possible handling my medical records.

Oh boy another person with no idea

[Blahbooboo3]

Slashdot is pathetic. Google will never come under hipaa -- please look it up at wiki to learn what is a covered entity.

Besides, see my other 2 posts on this page explaing why HIPAA doesn't matter anyway.

My goodness, you were modded insightful with such mis-information?? way to go mods! :)

Re:

[Niten]

Also..it IS a BETA (test). Once they are out of BETA they might actually have to apply HIPPA.

Whatever factors may conflate to determine whether or not Google Health legally falls under the purview of HIPAA, I assure you that whether the product has a "Beta" in its name is not one of them.

document and image "theft"?

[Speare]

I tend to tune out any argument that uses the word "theft" to describe unauthorized access. Did the Google Docs flaw deprive the owner of the document any access to the document, while keeping it for themselves? Did the Picasa flaw deprive the owner of the image any access to the image, while letting others have it? I suspect the answer in both cases is NO, the original owner had plenty of access to their own copies, and thus the inaccurate use of the word "theft" seems crafted to shock or mislead or co

Talking heads

[twistah]

I love when people regurgitate common knowledge and try to sell it as something new and interesting in order to bolster their popularity.

Google managing my medical records?

[prxp]

I'd rather die.

Re:

[cparker15]

Let me get this straight... the options are:

1. Have Google manage your medical records
2. Die

You choose #2?

Have fun with that. I'm sure Google won't hesitate to include you as a statistic somewhere as a result.

What's all the fuss?

[asdavis]

Seriously, I really don't understand all of the fuss people are making here about Google Health. Perhaps I have a different perspective as I have worked in the Healthcare IT space for a major HIPAA Covered Entity and built their HIPAA Security program. Let me clear up any illusions you may have... HIPAA Covered Entity != Secure. HIPAA is designed to address the privacy and security of Protected Health Information, aka "PHI", as it relates to treatment (This is a generalization, but is fairly accurate). Since Google is not involved in the treatment of patients, HIPAA does not apply. You would be astounded to who has access to your electronic medical records during the course of treatment. Even something as routine as a blood test would have electronic PHI (ePHI) transmitted between many organizations: Hospitals, Clinical Laboratories, Health Plans, VANs, Independent Physician Associations, and Physicians. Do you honestly think that the IT practices of your local Physician with a $600 Dell PC running Vista Home, no virus protection and a DSL line is protecting your data in a more sophisticated manner than Google? Why do people lose their senses when operating in an electronic world? Allow Google to store your ePHI is no different than asking a friend to hold onto your paper medical records. Your friend isn't bound by HIPAA either. If you don't want your friend to peer at your records, then don't let him hold onto them. Google is offering a convenience service. Like all convenience services, it comes with risks. If the risks are too high for you, don't take them. Google hasn't done anything wrong and they certainly have not found a loophole. Healthcare organizations deal with non-covered entities all of the time. Do you think that the company that prints the invoices for your local doctor, hospital or laboratory is a covered entity? I will admit there is one difference however, since the patient is the one making the request for the records to be transferred, there is no "Business Associates" agreement (another HIPAA term) between Google and the covered entity. Quite honestly, these aren't work the paper they are printed on anyway.

I for one will not be using Google Health for my own records, but that's just me.

Thanks for a real and EDUCATED response!

[Blahbooboo3]

Great response. Most of the people responding do not work in health IT and have absolutely no idea what they are talking about related to what HIPAA actually does -- which is about NOTHING since it just made all the lawyers money.

I responded above how actually the word is now that these PHRS and their privacy policies are under FTC regulations. My understanding is that the FTC regulations recourses are actually stronger than the HIPAA ones anyway. All the PHR vendors have privacy and data use policies tha

Re:

[overshoot]

You would be astounded to who has access to your electronic medical records during the course of treatment.

Or not. The whole idea is to make the records available to anyone who needs them, such as emergency personnel in the distant town you're visiting when you're unconscious. (I'm not making that one up; it's one of the favorite selling points for these access-anywhere databases.)

It's a great idea, but of course it only works if every EMT on the planet has access to your records. You can calculate

Exactly! Medical Records in my Wallet!

[AmigaHeretic]

Great post!

>> Allow Google to store your ePHI is no different than asking a friend to hold onto your paper medical records.

I keep a list of my wifes allergies and medications in my wallet in case of an emergency. Yeah on a piece of paper in my wallet. So having them available online is just convienent. So I guess someone could steal my wallet too.

Also, as if a gave a crap who knows my medical history. You people have 12 deadbolts on your doors too? Paraniod much???

Re:

[N1ck0]

I agree with you 100% on the entire HIPAA != security aspect. I work managing datacenters for a large healthcare transcription and medical records technology company, and trust me HIPAA leaks happen pretty often (we of course follow the protocol and log and inform the hospitals of such events, but its not that uncommon).

And then there is a large portion of the industry which no one really looks at anyway. Right now a good portion of medical records are shipped to part-time home workers to transcribe audio

Re:

[filthpickle]

Agree with the point about the practices of your local doctor.

I work for a clearinghouse, my job is to assist them in getting set up to use us. I handle mostly UNIX based systems, you would be astounded at how quickly they will give up their root password. So quickly that I can't help but think that they would tell anyone that called and asked.

I probably say "you really shouldn't do that, it's a HIPAA violation" 5-6 times a day. Also, everyone so quick to champion the HIPPA laws probably doesn't realize tha

Re:

[Raenex]

Paragraphs are your friends.

Google and Do Evil

[Stormcrow309]

I always had a problem with a company with the value statement of 'Do no evil' who doesn't spell out what that means in detail. I was listening to Stafford's Entrepreneurial Thought Leaders series this weekend and Google.org was discussing using their engineering talent to recognize epidemics before anyone else. My guess is this is how Google plans to do it. It is clear Google intends to use this data, but I think has done a poor job defining exactly how. Add in the fact that Google has bowed to governments for information on their citizens and I end up with a cold chill. Working in the health care industry, I see the value of patient records that are easy to transfer for the patient, but I am not sure this is the way. The little security analyst in me is screaming bloody murder.

Don't be evil spelled out in details

[Per Abrahamsen]

Here are the details. [google.com]

Re:

[Stormcrow309]

I would agree with you. I am surprised that HIMSS hasn't raised unholy hell over this. I think that I am safe to recommend that users do not trust this service and not use it. I think that an electronic way of moving data between places is a good thing, but with a requirement that every data move transaction requires patent consent. Without patent consent, which is the best standard of how we should do things in health care, then data should not be shared, with a check for consent per instance of use. In ad

Health

[certel]

If you need Google to list all of the health records, you should be worried about more than just someone finding out some information...

Want access to thousands of Google accounts?

[Anonymous Coward]

Do you want to access people's google accounts without even needing to come up with an attack?

1. Start a website requiring users to sign up with email addresses and passwords
2. Go through your DB and get a list of all the gmail ones
3. Try logging in with the gmail usernames and the passwords they gave your site
4. Over half of them will probably work
5. PROFIT!!!!!!

Last time I tried this, I picked about 10 at random. Six worked. I have thousands of gmail accounts in my users table. Lucky I'm not a black hat.

S

Re:

[cparker15]

I'd like my hash without salt, please. And I like my eggs scrambled, with cheese. Thanks.

who where when

[FudRucker]

who gets access to all this health data on people? doctors? lawyers? potential employers?

we're sorry Mr. JoeSixpack we Googled your health record and shows you are not qualified for the position and we already filled the position with a sterilized android...

Re:

[safXmal]

Close to what I'm worrying about to. What if prospective employers start asking access to your health records. They do the same with your credit ratings.

I understand that you want to own your information but there should be limits to whom you can give access to.

The same as you're not allowed to give up your rights you shouldn't be allowed to give up certain private information.

I already don't like that your health information is given to health insurance companies so why should i want to give it to Google

The necessary results of a fragmented system

[Zamfir]

The real problem here is that your health care data is scattered across many processing and medical records systems from all the insurers and care givers that you have ever been involved with. This results in doctors not having the needed information, costly redundant care, misdiagnoses, etc. Couple that with the growing trend to have people/patients manage their health care costs, and it becomes clear that solutions like Microsoft's and Google's are necessary and the potential benefit outweighs the privacy risk (trust me: no one cares about your anal fissures) This is far less of a problem in more centralized models where a longitudinal view of a patient is much more readily available (kind of like how the IRS has your tax history).

Re:

[Raenex]

it becomes clear that solutions like Microsoft's and Google's are necessary and the potential benefit outweighs the privacy risk

There's no reason why HIPAA shouldn't apply to any such solution.

trust me: no one cares

Potential employers certainly care. Financial background checks are now becoming common. You really don't want your health information sold on an open market, trust me.

Madness

[Vengance Daemon]

Those of you that comfortably have health insurance provided by your employer should be aware that the day comes later in your career when you might be forced to get your own health insurance through the "Single-Payer" system.

You would have to be stark-staring insane to put or allow ANY of your medical information on a system like this. The health insurance companies would love this, and would use it against you. In the Single Payer system, you are REQUIRED to give them access to EVERY bit of medical in

Re:

[jbailey999]

Why on earth would you ever give a doctor your social security number?

When anyone other than my employer or my bank asks me if they can have my SSN, the answer is "no".

They don't care

[Anonymous Coward]

If you would have read the WSJ and NYT articles, you would see people in the pilot were NOT concerned about others seeing their medical information. For them, the benefits outweighed the risks. It is THEIR decision, and it doesn't jive with yours, you're not forced to use it.

You people are paraniod!!

[AmigaHeretic]

I keep a list of mine and my wifes allergies and medications on a PIECE OF WHITE PAPER in my WALLET!!!

Oh my god!!

And, No I don't have a built in 100,000volt security system around my ass incase sometries to steal it.

Google Health is right. Security guy is wrong.

[tr0tt3r]

Hi,
I have written extensively criticizing the HealthVault model. (which also applies to the Google Health model in some places)

However, in this case. Google is in the right. They are not and should not be covered by HIPAA. The purpose of HIPAA is to ensure that your healthcare providers to not abuse their information privileges (i.e. knowing you have AIDS before you do) by improperly disclosing that information.

Anything that Google Health does, is theoretically an extension of what you, t