Hold Off on Google Health

Google yesterday opened its Google Health site to the public.  The service holds real promise to help people take control of their health records, as does a similar offering from Microsoft called HealthVault. They could also help streamline health care and contain costs. But until two major privacy concerns are fixed, I have to suggest holding off on using either one.

The first real problem is that HIPAA, the law that strictly governs how health care companies must safeguard health records under their control, doesn't extend to Google or Microsoft for these services. So while both companies appear to be careful and correct with their privacy policies, there isn't any law ensuring they continue to do the right thing.

Second, both systems currently allow access with an existing Google or Windows Live ID account - the same one that's used for Hotmail or Gmail.  Meaning that if you take the obvious and simple route and use an existing Webmail account to sign up for either service, anyone you've ever sent e-mail already has the username, and would only have to guess your password to gain access to all your health records stored in the service.

For more information, take a look at a Privacy Watch column I recently wrote on the subject.  And if you do decide to try either service, be sure to create a separate Google or Windows Live account just for the health records.