Discussion on:

Are you prepared to Google your medical records?

With Google Health, the search giant expects to make user portability of medical records as simple as an Internet connection and a password. But is that the right direction? Eric Schmidt, CEO of Google thinks that Google Health will not only ease portability issues but will also give record transparency to the user so that an individual can be more aggressive in maintaining their own health.

The concerns around privacy and security are enormous. On the privacy front, it is still to be determined if doctor/patient privilege will pertain or if a new standard would have to be set. On the security front, it would be necessary to understand exactly how Google plans to safe-guard data from intrusion.

Health care data is considered to be the most valuable data there is. Patient records not only contain things like name and address. They contain banking and credit information as well as private information detailing individual vulnerabilities.

Obviously, any system that is strong enough to house medical information would also be a system that Google could leverage to extend to financial institutions as well.

What do you think? Would you use Google to store your medical records?



Edited to add: I ran across this unrelated story that you may want to have a look at. It discusses the challenges of medical IT.

http://www.pcworld.com/article/id,142926-c,techindustrytrends/article.html

Makes you think.

I am a Diabetic and use Medic Alert to list all my medical aliments and prescriptions on line. Wearing my identification medal, I can at least hope that if something happens to me the medical staff will know something about my medical history, Doctors etc. The Google site should only have the medical information that I want, whatever I leave out becomes my problem

Coming from a medical background, you don't always have time to call the doctors office to get all information regarding the patient. If the patient can not speak or comes in alone, how do you get the information you need? I believe this could save lives!

I agree with what you have said. It should be the patients decision as to what needs to be put out there and should be discussed with your doctor.

HIPAA standards will need to be revised to accommodate the internet.

Switching to a single payer health care plan in this country could remove some of the worst consequences of a breach of privacy. Single payer is where we would all pool our money to pay for health care for anyone in the country. All other industrialized nations have it in some form. They pay half what we do for health care and are healthier.

With single payer your health insurance is no longer tied to your employer so in the worst case if your health records get leaked you won't lose your job or your health insurance because everyone's covered no matter what.

For 14.95 any one can get a report about you, your home, your financial status, your medical history. All the person needs is a little info about you. It is provided by a company on the internet.

Check our MotionPHR on iPhone or mymedbox on Google markets for the G! both PHR have all data encrypted with a password on the app. No one but you have access to the data

J

How many times have you heard on the news that a major bank or financial institution has had their database hacked? Are you ready for your medical records to be stolen and used against you? I am not, no way.

and a doctor's office can't be hacked? an employee of the doctor's office can't use your information against you? it happens.

Its the semi-legal that Google and M$ will empower.
Your potential employer will not hack the doctors office. But it will sure Google any information it can. A company has no right to this information. Neither does any entity other than you and your doctor.

.. but come potential employers already google your name to see what they can find.

no your potential employer will not hack a doctors office, but someone else can.

i do understand what you and others are saying. i'm enjoying reading all the posts for the individual ideas. keep em coming!

I don't think that any personal information e.g. SS#, banking info, or medical records should be available through Google.

I work at a hospital. Government security regulations associated with patient medical records put forth by HIPPA is the number 1 focus of our IT department.

Working within patient record software programs that list records, xrays etc. requires the use of test accounts. ALL activity within these programs is logged. You aren't even allowed to view your own records in this capacity. Failure to comply is subject to reprimand and even termination.

I've never had any issues associated with having my medical records transferred from my physician to a specialist. The risks associated with this are huge with very little, if any, gain.

If Google did it right; only you would give permission to see the files. This has been the problem all along. You spend thousands of dollars of your money(in my case)and the doctor's office treats it as if THEY own it.

This is not a problem in the Army; where YOU own your medical records and are responsible to physically transfer them to the next TMC. When a soldier ends his/her tour of duty the records are released to the individual who is responsible for the deposition.

If I want Google to maintain a medical record repository with the attending security requirements; that should be my business. If HIPAA needs to be amended to allow this then so be it.

I live in the UK where there is a programme underway to hold health records online accessible across our NHS - National Health Service - unlike the UK Government Google hasn't had to own up to losing 25 million personal records, so maybe the question should be - should I allow my government to hold my health records instead of holding them on Google??

I certainly don't trust Google- or anyone else that's already proven that they'll betray if pushed by the government. Nonetheless, your point is very well taken- There is absolutely no one as untrustworthy as the Government. Presumably because they no longer have to account to the People for anything. Thank you for the reminder.

One of the biggest losers of records and personal info, including medical info, has been the VA. They protect our data so well that large amounts of it were allowed to be carried out by "regular" employees (not even specialists). Others are the INS (which fortunately no longer exists as such), the Opst Office (whose data is so faulty that it is beyond concern, almost), and if you have the patience, the Freedom of Information Act.

First, I can see there is a need for a national database of secure medical records, this would assist doctors and hospitals. This could also be secured to their (doctors & hospitals) servers.

Second, it should only have the doctor's permission for anyone to view, including the individual for whom the record is about.

Now, if the doctor has you take a test, he can decide if (the doctor) needs to talk to you about the results before you see them. That is the preference of most doctors. Then he could assign a temp id & pw to see results online.

Being able to renew presciptions and make doctor appts online could be an advantage. I currently use a subscription service for a medication, I go on their site, log on and can use the subscription service easily.

Without truly well thought out safeguards, a disaster will surely happen.

As long as the guidelines of HIPPA are kept in mind, I don't have a problem with it.

http://www.hhs.gov/ocr/hipaa/

Miss use of the acronym will make it harder to search for information.

I think the Google idea is a very clear violation of HIPAA.

Even if a person openly reveals this information it is not valid to retransmit it.

Sheesh this is a good one. There is absolutely no doubt that electronically shareable medical records will be a boon for doctors, hospitals and yes, individuals. I'm sure there are thousands of 'if only we'd known...' cases that would have been helped by such a system.

But if it is publicly accessible on a vehicle like Google (no no no) then yes, it is well open to abuse. If it's owned by someone like Microsoft (oh god, no) then yes, it's open to abuse.

But to be useful it does need to be on some kind of universally accessible system, and despite the UK government gleefully throwing $25billion of taxes at companies who can recognise incompetents-with-money, such a system does not exist.

I feel the ONLY way a system like this could work would be if the ONLY way data could be accessed at any time would be if the person to whom the records belong (that is, the subject of the data) was at the point of delivery (and alive!!). Finger print recognition alone would not be good enough (crooks could easily cut fingers off, although of course that would mean the data were wrong) so a combination of finger print recognition and retina scans plus perhaps a DNA sample would be necessary to get a glimpse of the data.

But no system is infallible.

I wouldn't actually have any problem with my employer knowing I'd had this removed or that fixed (despite it being none of his/her business) but what would worry me, would be the refusal of Life Insurance because of a wart I had removed 30 years ago.

Whilst I think that such a system would be very valuable to many people, and may even save a life or three, it is very dangerous ground due, unfortunately, to the fact that crooks are Humans too, which means of course that anyone can be a crook, even if they label themselves 'government' or 'respectable institution'.

Sheesh, this is a good one.

This is not a bad option - but that is not unattainable any more. Samples are being taken by "authorities" at every opportunity, and these have to be stored by some identity coding, which can be hacked. Besides, those of us that are old enough to remember the public introduction of DNA anayysis should also remember the insurance companies' first response to it - anogher way to identify people "predisposed to future medical conditions" for elimination or over-charging.

The only real questions I see are, 1. How much are we willing to risk to prevent another risk and, 2. Are those chrged with the responsibility of "protecting us", namely Govt., willing and able to do the necessary things to make theft of this info as difficult and painful as possible. Since they (Congress) are almost all lawyers, and lawyers are a significant part of the problem, that seem unlikely.

something like this Google repository. The most gut wrenching part of health care as I have experienced it has been the constant fight to get MY information to the repective medical provider.

Many ridiculous repetitive test become necessary because of this obsolete system where I can't get MY information to my provider. A huge waste of my money as I am not insured(uninsurable).

If everyone treated their insurance accounts like it was their money, all hell would break loose at the waste in the system. The facts is - it is OUR money! One way or the other!

Looks like the FDA already approved an implantable chip to deal with this. Check it out.
http://www.webmd.com/news/20050727/chip-implants-better-care-privacy-scare

Sorta like leaving the door standing open when you know there's a burglar in the neighborhood. No thanks.
Privacy Protection- Don't throw your rights away! Thanks.

One area of real concern is not the medical info itself but the fact that they are registered - or contain - Social Security numbers! There is rampant identity theft in progress, as we all know, and how do we avoid providing another "easy route" to our identity key?

When the Social Security System was originated, the SSN was "supposed" to be almost sacred - not to be used by ANYONE but the System, and perhaps some other government agencies - for ANY purpose. Then banks were let in, then insurance companies got in, then states used it for driver's license numbers, the FAA for pilot's license numbers (they did drop the leading zeros though) and on and on. Even the military now use it for their serial numbers, after starting out with a different 8-digit system.

How do protect ourselves from YET ANOTHER vulnerability to identity theft?

While I wholeheartedly embrace technology improving our lives, etc. This idea of webenabling data such as financial and health with the added benefit of making it available to the user is quite noble. But the risks are simply too great. With all the problems we have already experienced with companies loosing laptops and harddrives, etc. Heck - i just got a letter in the mail last week from one of my CC's telling me that my data MAY have been compromised because of a recent loss of data, etc. (NEVER MIND the fact that they should have called me immediately, etc) Clearly, our present design is just NOT secure enough. Why should we migrate the present "mostly secure" design to the web which as we all know too well is severely vulnerable to hackers, etc. Do you really want their fingers on your medical data? The potential for blackmarket explotation is HUGE. Somebody's health records needs to be LOCKED down so its only be accessed by the Dr. and no one else. Thats it! No one else.

I am the only one that can access it; that way even the Doctor has to have my permission ot look at it. It is not the Doctor property, IT IS MINE!!

Period!

I am not sure, due to privacy issues. It is a good idea to have your records at hand when you need them but not good for someone else to gain access to for malicious intent. I'll have to contemplate more on this one.

I'm taking a copy of my records from the current doctor, bad IDEA this letting GOOGLE or any online have them.

Online storage is for fools.

No mater how secure web sites claim to be there is nothing impossible for the computer hackers. I know for a fact that even with 128 bit encryption there is always a risk so I rather ask my doctor and hospital to provide a copy of my medical records so my privacy is maintain and most important my identity is protected. In this matter Google is all wet! And risking a lawsuit by all those people who have identity theft due to searching medical records using Google.

1) The current system offers you no privacy whatsoever..... Files are continuously sent from hospital to specialist etc. etc. This is done by couriers. Now if i am on the top of the pile, i am sure the courier won't have a quick peak, but if my name was Britney Spears.....
2)Files get lost, regularly, without backup!
3)Hospitals are totally overloaded by all the paperwork they have to handle and have to wait for or prepare. In my view, hospitals should cure people, not do their administration. I would therefore advice to have the insurance companies handle the patient/customer files, but this of course only works in countries were everybody has a health insurance.

For me I would only consider such a system if the database did not contain any information that would be link back to me. If each record was only identified by a one way key then the key could be generated by a password/biometric data.

If the database was hacked, the hacker would still not be associate the data with a specific individual. Only if the hacker found out my key (which I have control over) would they have access to my data.

1. Privacy, or the lack there of. I have a federal health insurance (TriCare), but I see no reason why my concerns would not apply to commercial insurers as well.

About 18 months ago, one of the contractor's data center was physically robbed on hundreds of thousands, if not more, insurance records. Aside from simple physical security, obviously lacking here, no one has perfected the art or science of fully protecting a data center that must connect to the outside world. Simply put, there will be breaches and, the more records are in there, the more lucrative the target and the more resources will be expended to breach it.

Because of HIPPA, the password rules for this site are draconian and virtually ensure that passwords for this site are on PostIt notes under keyboard or on monitor bezels. Despite the fact that passwords are generally regarded inherently insecure, there seems to be no interest in anything simpler and more secure.

2. Two or more sources: Google and Microsoft (and their respective agents, vendors and minions). If this is to work at all, providers can not be required to guess which repository has one's records. At a minimum, only one repository would have all the information and other repositories would make reference to it, sort of like authoritative name servers.

3. "The computer is perfect" syndrome. At the moment, providers know they are working with incomplete histories and make allowances for it. However, once those histories are in the computer, they suddenly become perfect, complete and indisputable, even in the face of evidence to the contrary. After all, computers never make mistakes.

4. Accuracy, or the lack thereof, part 1: Control of who can update information. I do not want the same insurance clerk who decided I could not have a kidney transplant removing the evidence that I needed one in the first place.

5. Accuracy, or lack thereof, part 2: who can correct information and how hard will it be to correct? If credit reports are any example, way too many sources will be able to input information and it will be way too hard to correct inaccuracies.

A local medical association that include the many hopsitals in the area started something like this. I got a card in the mail and invitation to put my data on the secure website. I took it to my doctor's office and they said they were not allowed to put any of my data on the web, even if I gave permission. Also they have never had anyone come to them and use the web to provide information. This clinic was very much against it. They said we already have ways to provide info for emergencies with cards in our wallets/purses or bracelets, such as the ones that say diabetic, epileptic, allergic to XYZ, .... So they see no need. Neither do I.

Also Government is not good at setting up and using massive and complex computer systems. Look at what happened in Los Angeles. The schools there got a new multiple million dollar system to do teacher's paychecks. When it was ready last year it messed up paychecks for most people. It is now a year later and some people are still getting too little or too much. Not to mention most of not all of the W-2s are wrong! They have dumped 40 millions more into it, but they said it will take them up to 15 years to get all the bugs out!! Geesh, by then we may not use computers like the ones we do today! Seems to me to be a lose-lose situation.
Alan

even if he says so; you paid for it, it is yours. However HIPAA regulations are so stilted I wouldn't blame anyone for refusing to do so out of concern at being in violation of the law.

This either needs to be fixed by congress or find a health provider to do all your testing that does agree to central repository requests. Only you know who has the safe reputation in your area. There are medical company/doctor referral services that supposedly rate some organizations/doctors but I don't know how believable they are.

Lets face it, we consumers need a "United Laboratories" to help us rate medical organizations; fat chance of that happening with the AMA blocking every attempt to reform the system.

There is already enough internet piracy out there right now. To trust your medical records to this venue -- HEY, ANYBODY WORKING UNDER HIPAA CONSTRAINTS???? --- is to ask for disaster.

But hey, Continuum Health Partners in Manhattan has no problems. They manage Roosevelt Hospital, St. Lukes and Beth Israel. In 2006 30 computers were stolen from room 617 in St. Lukes, one from the cafeteria of Roosevelt and there were countless invasions of spyware, worms, malware and porn across an 11,000 node network. And if you go the dumpster at their Secaucus Data Center, and dig, you can find lotsa patient records just THROWN OUT without any shredding at all!!!!!

Google is in the business of SHARING info - not PROTECTING it! Do a search for something like online drug sources and see how much SPAM you collect the next few days! However, some cases the risks of losing personal info can be worth the rewards, like life-threatening conditions.

Before getting off this subject, read the Medical Database section of the Recovery and Stimulus Act. The Gov't will have access to ALL your med. data so they can "judge the effectiveness of treatments" to "manage" the future Gov't-provided Universal Healthcare, aka Socialized Medicine, that the Administration is working hard to implement.

The Idea of somehow having access to ones own medical care is (or could be) good. But some how having Google involved would bother me. We do need a system, and it should have been established a long time ago. Normally this is where a Government Agency* would have taken the in initiative, but with some much miss-trust of any Government in these times it is probably impossible now. -d


edited to add:* in keeping with the "for the Benifit and Welfare of the People" concept. Not to be cunfused with "We should have a bigger Government". I don't advocate that at all. It would however be nice if a Government would do it's purported funtion. (and still stay out of our business.) -d

The UK Government has so far spent c.?12.5bn trying to do just this, in what is the world's biggest civilian IT project. More than half of the nation's doctors say they won't use it, citing confidentiality concerns. In addition, it seems that European privacy laws require doctors to obtain express permission from their patients before records can be transferred. Many patients will just ignore the request, some don't trust the Government to secure data properly, and some will decide the Government already knows too much about us.

It sounds like a good idea in principle, but there are a lot of practical obstacles which I think may defeat it. I just wish they'd spent the money - my money - on improving patient care.

We seem to have a new story in the news each week of confidential information getting lost. These have been tax records, bank details, even medical details, all 'lost'.

That makes initiatives like Real ID very unattractive to most people. There is no guarantee that the government can be trusted with personal information.

Another story recently released discusses some of the challenges that medical IT faces on a daily basis. Have a look at this: http://www.pcworld.com/article/id,142926-c,techindustrytrends/article.html

Obviously the concerns are very real. Google may have missed the market on this one.

I do believe that an individual should have access to their medical records however am NOT in favour of this functionality being available through Google (or Yahoo or ....). In my location for example the regional health authority should provide this service, putting in the appopriate security measures of course to adhere to privacy laws etc. Google would not necessarily be exempt from complying with any governmental request to release information as previously stated as there is no Dr/Patient priviledge, what a scary thought!

I guess (especially if Micro$oft is behind
this), in time our most
private records will be exploited. OR
potential employers might be
able to gain access to records, possibly
refusing employment because in the past, I
don't know..you may have told your doctor
you smoked marijuana?....I don't think this
is a good
idea. And what about digital identity
theft? Now a person could
obtain even more of your info. I just
think there are some things that
should not be accessible like this. But
then again, doctors, lawyers,
and even motor vehicle agencies keep all
their info on some sort of
network. So our information has been made
available to hackers long
ago. This will just make it easier.. Just
for once, can companies consider the
quality of life over the almighty dollar??

can access it how do you think the IRS and every other outfit that has information in electronic form is keeping care of it?

NOT!

At least if only ONE source has it in permanent storage; it is a lot more feasible to lock it down.

I work in Healthcare and have for 18+ years in Medical Records and in IT. I live, breathe, and have nightmares about HIPAA. Technically, Google can get away with this because it's the patient freely posting their stuff, but I guarantee that there's going to be an issue where someone's info will get out, then all hell will break loose.

I can see an employer googling a prospective employee and finding out that they have HIV, or have had Cancer and not hiring them.