Why Google Health and HealthVault are not covered by HIPAA

May 24, 2008

Fred Trotter sent out this note to several health IT bloggers recently.

Recently slashdot referenced two uninformed comments on Google Health offering.

http://science.slashdot.org/article.pl?sid=08/05/23/0520223

The problem here is that HIPAA should NOT cover Google Health or HealthVault. This issue now dominates this debate, and I wanted to specifically point out some of the problems with this thinking.

http://www.fredtrotter.com/2008/05/23/in-all-fairness/

Fred does a great deal of wonderful healthcare and IT writing. His latest argument for why HIPAA does not cover Google’s or Microsoft’s PHR offerings makes a lot of sense and is well worth reading. Vendors of technology are generally not covered entities unless they are somehow participating in the care process and I think everyone’s making a big deal about "Google is not HIPAA compliant" or "Microsoft has privacy problems" for very little reason.

  • http://pardalis.squarespace.com/blog/2008/5/22/personal-health-records-data-portability-and-the-continuing.html Steve Holcombe

    Shahid,

    Even if Google Health, Microsoft HealthVault, Dossia, etc. WERE covered by HIPAA the question would still go begging …

    Is there to be a critical mass of internet users who will actually put their medical profile online under the current privacy paradigm?

    I believe the answer is proving itself to be a clear and resounding ‘no’.

    There must be a shift from the prevailing privacy paradigm (whether enforceable through HIPAA or the contractual Terms of Service provided by Google Health, etc.) toward a paradigm of technological data ownership.

    When that happens, then I’ll say, “Now you’re talking!”

  • http://www.hisecure.net Dr. Brown

    Few people are talking about the risks of sending emails through unsecure connections and the possible legal implications of someone intercepting or accidentally receiving protected health information (PHI).

    There are free secure email encryption services out there like http://www.hisecure.net.

    Nice Blog!

    Some info on hisecure.net:
    up to 4096 bit encryption
    all email communications take place over a secure connection (https://)–>Not just the login!
    secure sever, climate controlled, only authorized staff has access to server
    firewall, anti-virus, logs of any/all attacks
    secure off-site backups, fail over email system, redundant power, RAID HDs

  • David Szabo

    Trotter’s column misses the point entirely, and clearly does not understand privacy law. The reason to put Google under the HIPAA privacy and security rules is not to control Trotter’s ability to use and disclose the information. The purpose is to control Google’s ability to use and disclose the information. Under current law, Google can change its privacy policy at any time. Under current law, no minimum standards of IT security apply to Google as a matter of law. This situation will adversely impact on Google’s ability to get a critical mass of users for this service.

  • http://cpexchange.org/ Privacy

    I found your blog on google, and read a few of your other posts. I just added you to my Google News Reader. Keep up the good work. Look forward to reading more from you in the future.

Previous post:

Next post: