Google Health Isn’t Alone. Who Exactly WILL Have Your Online Health Record?

With the “official” announcement of Google Health, which was hinted at back in January, Google is highlighting an ongoing trend of putting absolutely everything online. But what does it really mean for patients?

While it doesn't seem to have gotten the insane amount of press that Google has, Microsoft was actually first out of the gate, announcing HealthVault back in October of last year. With buy-in from corporate partners, HealthVault can link up your data with services from these partners. Your Omron blood pressure monitor and pedometer can interface with the service, letting your doctor know how much you are REALLY exercising. Your Johnson & Johnson blood glucose monitor can let your doctor know when you broke down and had that huge slab of birthday cake.

New York City and Wal-Mart are also moving to e-health records, with New York putting records online for 200,000 patients and Wal-Mart requiring all providers for their co-branded in-store clinics to also utilize the same service that New York City is using: eClinicalWorks.

We now have three large players with online health records systems in the game, with more waiting in the wings to get their own piece of this enormous pie with some very obvious questions that haven't even been touched upon: who will regulate this highly personal data?

Google has said that they won't sell ads to monetize Google Health, but Microsoft's model is already showing that there is another way to get corporate support in a more subtle fashion. What are the privacy rules surrounding that potion of the application? Would Johnson & Johnson get a feed of how many blood glucose readings I've taken, sending me an alert when they think I might need more supplies? Other companies help track and recommend fitness goals; would they then partner with local gyms to “facilitate” my goals?

Chris Saad, CEO of Faraday Media and the face of Data Portability, vocalizes concerns that Google's announcements misuse the concept of data portability, describing it only as moving your health records between doctors using their system, and might hold your data hostage in their system, but that's the very least of what we should be concerned about. None of these companies, you see, are covered under the U.S.'s Health Insurance Portability and Accountability Act (HIPAA), as Steven Levy points out:

“Covered files are strictly controlled, can't easily be subpoenaed, can't be exploited for profit and have to be stored securely. But Microsoft and Google aren't health-care providers.”

In other words, if your doctor signs up for any of these services, you lose the legal protections afforded by HIPAA. They have no legal binding to NOT provide your information to third parties for marketing. And while these companies claim that their security measures meet or exceed those required by HIPAA, what happens when they get their first subpoena from an employer over a Worker's Comp case? Or an auto insurance company who wants to blame an accident on a possible medical condition?

While health care is a huge market, there are ethical concerns regarding putting this information online that should be addressed before this becomes so prevalent in the industry that it becomes impossible to rein back in.