More on Google Health: two reasons to be wary

(For the impatient: if you read nothing else of this, be sure you read David Hamilton's Seven Reasons Google Health Is Overblown.)

As the Google Health story has fleshed out in recent days my view has become clearer and stronger. Then, yesterday at work I saw a demonstration of Google ethics that annoyed the crap out of me.

The crux of it is trust and trustworthiness. The Federal HIPAA law puts strict penalties on a provider who leaks your data, but Google's not subject to HIPAA. And their password security is really weak, unlike bank web sites.

A) Bloggers' views

• The best commentary I've seen is David Hamilton's Seven Reasons Google Health Is Overblown.
• The discussion on the e-patient blog continues.
• Hamilton's second post,
Google Health Privacy: All Talk, No Teeth?, includes the tip that Google Health's terms of service say you will defend or settle any lawsuit by a third party, e.g. your state's attorney general, about your use. And Google's penalties in any case are limited to $1,000.

B) What happened at work

My company gives Google thousands of dollars a month for Pay Per Click (PPC) advertising. (We bid to have our ads displayed when someone "googles" specific phrases, such as 'online appointment software'.) Every time someone clicks one of our ads, we pay Google, regardless of whether it turns out to be a legitimate buyer. If carefully managed, it's worth the risk, and we put a spending cap on it, which we rarely reach.

Well, yesterday my PPC consultant noticed that Google just added a feature without telling anyone that will spend our unused budget to display ads for phrases we didn't bid on.

Details in this post.

I'm all in favor of modernizing healthcare, particularly making it easier to do what I want with my data. But I think it should be done by a non-profit entity, using open source software.

The Launch of Google Health

There's a lot of talk this week about the launch of Google Health. As much as I love everything online, I have grave concerns about this. I wrote about it here in January, speaking on general principle. But now that the thing is finally launched, the full terms of service are out (the fine print), and my concerns are even greater.

#1 on my list is that due to some legalese (Google itself isn't a healthcare provider), Google Health is not subject to HIPAA privacy regulations. Google isn't required to observe HIPAA protections to keep your data private, and there are no legal consequences if they don't.

Of greater concern is that the whole point of Google Health is that they send your information to others you select, at which point the data is completely out of Google's control.

And that doesn't begin to get into the sociological / political concerns I raised in January - questions of what to do when Google says "Really, just trust us" in the absence of any policing.

If you want to know more, explore these posts (and comments):

• The e-Patients blog: Google releases Google Health
  
  
• Slashdot (a well known tech blog): Google Health opens to the public. Those people are no fools, they have lots of experience with Google (for better and worse), and they have fun attitude. Some of them are pointing out that HIPAA obviously needs a major overhaul.
  

I'm so concerned about this that I've written my concerns on the blogs of my hospital's CEO and his CIO (top computer guy). The CIO is on the advisory council for the whole Google Health initiative, and I really want to know why they think the privacy issue (which is enforced on everyone else who touches your data) isn't a concern with Google.

Let's hope it turns out there's actually no privacy concern. Then all we'd have to worry about is whether to trust Google in the first place, given their track record as I've described below.