What Could Possibly Go Wrong?

I was listening to Leo LaPorte's podcast the other day and he brought up Google Health on his show. I hadn't heard of it before and after listening to his description all I could think was...

"No! Bad idea!" (Leo agrees with that sentiment btw)

Then today I saw this article in the USA Today and once again I thought... REALLY BAD IDEA!  Of course this means I had to blog about it.  (UPDATE: no I won't link something I don't want you to use - it's easy enough to find it if you really want to)

So, what does Google Health do?

• Organize your health information all in one place
• Gather your medical records from doctors, hospitals, and pharmacies
• Keep your doctors up-to-date about your health
• Be more informed about important health issues

Oh goodie yet more of this "put it all in one place" push. What is it with people?

It's time to go through this point by point:

First of all, if you have a doctor - they have your records and they should be somewhat organized. Maybe they aren't, but there's nothing at all to keep you from putting something together on paper that you can carry with you to the doctor(s) if you need to (or finding a better doctor). And personally I don't want to carry a laptop to a doctor appointment.  Oh yes, they have pc's in all offices now, but do you want to log in to a private web page on a computer you know nothing about??? If so, you deserve to lose all your information. 

Secondly, your data will be on a web server, not hosted by you but hosted by a large company. You know nothing about the people who work there, nothing about the manner in which they handle the information entrusted to them, nothing about what they will do with it in the future.  Why would you trust that what they say today will apply if the going gets tough.  If Google ever has it's feet to the fire - information protection will be the first thing over the side.  It happened in China - it's happened with other large Web hosts too.  It can and will happen again.

Third if you need google to keep your doctors up to date, you are not paying attention to what type of care you are getting. You also are not communicating with your doctor - so stop right there... don't hit up google, hit up the local Community College for a course in communications - you obviously need it.

Last of all, how will they keep you informed about health care issues? From the Google Health Privacy Policy:

1. Google's servers automatically record log information about your use of Google Health (such as number of sign-ins and number of times a link was clicked). This information is temporarily stored in association with your Google Account for two weeks, at which point it is aggregated with other data and is no longer associated with your account. The log information will be used to operate and improve the service and will not be correlated with your use of other Google services.
2. Google will use aggregate data to publish trend statistics and associations. For example, Google might publish trend data similar to what is published in Google Trends. None of this data can be used to personally identify an individual.
3. Certain features of Google Health can be used in conjunction with other Google products, and those features may share information to provide a better user experience and to improve the quality of our services. For example, Google Health can help you save your doctors’ contact information into your Google Contact List.

The numbers above should be 2, 3, and 4 but the ordered list function changed them when I didn't import number 1 as it was irrelevant.

Basically what they are telling you is that they are going to scan your medical records and keep track of what links you click within Google Health. This is (of course) for advertising purposes, just think of all the lovely ads you'll have popping up at you. But it could also be misused by someone unscrupulous - just as the email scan they currently have in place could be misused.

Now, what assurance does Google give you that your information is safe? Is their site HIPAA (Health Insurance Portability and Accountability Act) compliant? No - of course it's not. If they claimed HIPAA compliance they could be in deep legal doo-doo with the first account break in.

No, they use the US Safe Harbor privacy principles. Now doesn't a department of commerce directive make you feel all warm and fuzzy about how your data is protected? I suppose I shouldn't point out that this leaves them plenty of wiggle room for whatever they want to disclose when they want to disclose it. (and it won't be to the US Government, Google has stood up to them staunchly - knowing all the time there would be no penalty for this... but watch out if it's Al Qaeda, or China, or some other not so nice bully)  You will note that they say they "follow" this directive.  Not that they MUST FOLLOW this directive.  Huge huge difference - it's in those little technicalities folks.  Really.

But the one hugely enormous elephant in the room that no one wants to acknowledge... all this private data is protected only by a username and password. Period. And that my dears should scare the crap out of you. Username and password are the least secure of any method of storing data. They don't even claim to encrypt the data!!! (encryption would mean they couldn't scan it to bring you all those lovely ads and to keep up on your current health status)

So those 2 little pieces of information are all that stand between your information and all the people on the internet who would just love to grab your life and wring it out.  That's on the outside.

What stands in the way of an insider at Google grabbing the data?  We don't know, we do know that if it's not encrypted - the ability is always there for the data to be taken or doctored.  That's just the way computers work.

Considering the relative ease with which people have had their email accounts hacked, their ad accounts hacked, and whatever else google provides that's supposed to be private.  I foresee many people losing their medical information to unscrupulous people - either in their own families (can you say divorce court), via something like a public wireless access point, a trojan horse keystroke logger embedded in that email you shouldn't have opened, etc, etc, etc.

In the end, it's all about convenience.  I know there will be thousands, maybe millions, of people will think this is the best thing since sliced bread.  They'll jump all over it and fill up their files.  Then they'll get hacked and have their data stolen.

Wow how convenient. 

No thanks, I'll take old fashioned, slow and tortuous paper and pen.  I might have to wait a while longer for medical test results, but I'll rest easier.  If you want to go for it and make your life conveniently hi-tech... don't say you weren't warned. 

BTW - I could be like this about many things but choose not to - this however is scary enough to make me write a dissertation.  My apologies on the length and if you read to the bottom - you earn a gold medal.  Heh.

Posted by: Teresa in Medical at 09:56 PM | Comments (7) | Add Comment
Post contains 1262 words, total size 8 kb.