Slashdot Mirror
Delving Into Google Health's Privacy Concerns
SecureThroughObscure writes "Security researcher Robert 'RSnake' Hansen discusses numerous concerns with Google's new Google Health application, which aims to integrate user's medical records online. We discussed Google Health's opening to the public earlier this week. RSnake mentions that Google has found a loophole allowing them to provide this service without having to follow HIPAA regulations, which, combined with Google's track record of having numerous flaws leading to private information disclosure, draws serious concern. Security researcher Nate McFeters of ZDNet's Zero-Day Security Blog also commented on the article, mentioning several past vulnerabilities: ownership of content issues, Google Docs theft, a cross-domain hole, Google XSS, and a Google Picasa protocol handler issue leading to the theft of user images. He and fellow researcher Billy Rios disclosed these issues to Google, including the ability to steal GMail contact list information. McFeters says it's likely that similar unpatched bugs would allow an attacker to view medical records if a user was also using Google Health. Both McFeters and Hansen tend to agree that Google's vulnerability disclosure/notification is non-existent and really needs to be improved. Currently, Google does not report vulnerabilities it has fixed to its user base, for the obvious reason of trying to hide the fact that user data could have been stolen."
Why would anyone want to put their health info anywhere if HIPAA does not apply. I know that HIPPA is not perfect, but it at least has recourse if info is released or stolen.
When you get syphilis all the websites you visit will be carrying convenient advertisements for the necessary treatments.
Does Microsoft's HealthVault.com, which came before Google Health, receive the same amount of critique?
Let's examine Microsoft's HealthVault.com policies and how they compare to Google Health.
So the only thing protecting personal health information at Google Health is internal policy and "Don't be evil"? I guess that means they'll protect your PHI--as long as you're not a dissident in China.
If you haven't been down-modded lately, you aren't trying.
Sacred cows make the best hamburger.
I think I found a information disclosure problem with Google Calendar, but after a trying to contact Google twice I have given up.
If anyone is interested please read: http://bramp.net/blog/google-calendar-exploit
and hopefully if this is a bug it can get passed on to Google.
Well given that Google can be pressured by evil governments or evil companies into doing evil things, as history has shown. I think it is given that they will use this information for evil purposes, maybe they are planning to sell this information to insurance companies.
To me, this would be akin to plastering my personal medical records on a bulletin board in a busy public place with a single coversheet on each item that says "Private Medical Information: Please don't read this."
Thanks to the military, I had an introduction to very early "on-line" medical records. Yes, you guessed correctly. Those records are "no longer available." Fortunately, I requested copies of every contact and kept those in a personal copy of my medical records.
Invenio via vel creo
Most hospitals now use some form of Windoze client like Impact. The staff surf the web with IE on the same machines. Do you think HIPA means anything in an environment like that? You might as well let Google serve records to people's home PCs because there's no difference between home and hospital now.
DMCA, Hollings, Palladium. What might have sounded like paranoia is now common sense.
If you are afraid of your data getting stolen, DON'T USE IT.
Quite frankly I'm tired of people complaining on my behalf. Especially when I don't use whatever is being complained about and when the people complaining don't use it either.
Also..it IS a BETA (test). Once they are out of BETA they might actually have to apply HIPPA.
I want to now now
I tend to tune out any argument that uses the word "theft" to describe unauthorized access. Did the Google Docs flaw deprive the owner of the document any access to the document, while keeping it for themselves? Did the Picasa flaw deprive the owner of the image any access to the image, while letting others have it? I suspect the answer in both cases is NO, the original owner had plenty of access to their own copies, and thus the inaccurate use of the word "theft" seems crafted to shock or mislead or conflate the actual issues.
[
I love when people regurgitate common knowledge and try to sell it as something new and interesting in order to bolster their popularity.
I'd rather die.
Seriously, I really don't understand all of the fuss people are making here about Google Health. Perhaps I have a different perspective as I have worked in the Healthcare IT space for a major HIPAA Covered Entity and built their HIPAA Security program. Let me clear up any illusions you may have... HIPAA Covered Entity != Secure. HIPAA is designed to address the privacy and security of Protected Health Information, aka "PHI", as it relates to treatment (This is a generalization, but is fairly accurate). Since Google is not involved in the treatment of patients, HIPAA does not apply. You would be astounded to who has access to your electronic medical records during the course of treatment. Even something as routine as a blood test would have electronic PHI (ePHI) transmitted between many organizations: Hospitals, Clinical Laboratories, Health Plans, VANs, Independent Physician Associations, and Physicians. Do you honestly think that the IT practices of your local Physician with a $600 Dell PC running Vista Home, no virus protection and a DSL line is protecting your data in a more sophisticated manner than Google? Why do people lose their senses when operating in an electronic world? Allow Google to store your ePHI is no different than asking a friend to hold onto your paper medical records. Your friend isn't bound by HIPAA either. If you don't want your friend to peer at your records, then don't let him hold onto them. Google is offering a convenience service. Like all convenience services, it comes with risks. If the risks are too high for you, don't take them. Google hasn't done anything wrong and they certainly have not found a loophole. Healthcare organizations deal with non-covered entities all of the time. Do you think that the company that prints the invoices for your local doctor, hospital or laboratory is a covered entity? I will admit there is one difference however, since the patient is the one making the request for the records to be transferred, there is no "Business Associates" agreement (another HIPAA term) between Google and the covered entity. Quite honestly, these aren't work the paper they are printed on anyway.
I for one will not be using Google Health for my own records, but that's just me.
TECMATIC - Intelligent Technology News
I always had a problem with a company with the value statement of 'Do no evil' who doesn't spell out what that means in detail. I was listening to Stafford's Entrepreneurial Thought Leaders series this weekend and Google.org was discussing using their engineering talent to recognize epidemics before anyone else. My guess is this is how Google plans to do it. It is clear Google intends to use this data, but I think has done a poor job defining exactly how. Add in the fact that Google has bowed to governments for information on their citizens and I end up with a cold chill. Working in the health care industry, I see the value of patient records that are easy to transfer for the patient, but I am not sure this is the way. The little security analyst in me is screaming bloody murder.
In God we trust, all others require data.
If you need Google to list all of the health records, you should be worried about more than just someone finding out some information...
[%] Cingular Ringtones
Do you want to access people's google accounts without even needing to come up with an attack?
...
1. Start a website requiring users to sign up with email addresses and passwords
2. Go through your DB and get a list of all the gmail ones
3. Try logging in with the gmail usernames and the passwords they gave your site
4. Over half of them will probably work
5. PROFIT!!!!!!
Last time I tried this, I picked about 10 at random. Six worked. I have thousands of gmail accounts in my users table. Lucky I'm not a black hat.
Security? What's security? People just don't think about it or take even the most basic precautions. This Health Records service seems like a very bad idea from a "what could possibly go wrong" perspective but I don't know if Google is to blame for that
Enough with the HIPAA scare. Most of these PHR vendors privacy policies are STRONGER than HIPAA and are governed by the FTC which is (from what I understand) MUCH stronger than HIPAA rights.
Also, I believe an organization which changes a policy must ask their members to re-accept their policies under FTC regs.
who gets access to all this health data on people? doctors? lawyers? potential employers?
we're sorry Mr. JoeSixpack we Googled your health record and shows you are not qualified for the position and we already filled the position with a sterilized android...
Politics is Treachery, Religion is Brainwashing
Great response. Most of the people responding do not work in health IT and have absolutely no idea what they are talking about related to what HIPAA actually does -- which is about NOTHING since it just made all the lawyers money.
I responded above how actually the word is now that these PHRS and their privacy policies are under FTC regulations. My understanding is that the FTC regulations recourses are actually stronger than the HIPAA ones anyway. All the PHR vendors have privacy and data use policies that are STRONGER than HIPAA anyway.
Slashdot users are funny in how they think they know everything. I bet most here had to look up how to spell HIPAA.
Slashdot is pathetic. Google will never come under hipaa -- please look it up at wiki to learn what is a covered entity.
:)
Besides, see my other 2 posts on this page explaing why HIPAA doesn't matter anyway.
My goodness, you were modded insightful with such mis-information?? way to go mods!
The real problem here is that your health care data is scattered across many processing and medical records systems from all the insurers and care givers that you have ever been involved with. This results in doctors not having the needed information, costly redundant care, misdiagnoses, etc. Couple that with the growing trend to have people/patients manage their health care costs, and it becomes clear that solutions like Microsoft's and Google's are necessary and the potential benefit outweighs the privacy risk (trust me: no one cares about your anal fissures) This is far less of a problem in more centralized models where a longitudinal view of a patient is much more readily available (kind of like how the IRS has your tax history).
HIPAA only applies to the US. Health is a much bigger issue. Google Health just doesn't go far enough with what kind of information you can enter and what partners one can get information from.
I'm sorry Joe but based upon your Google Health Records, we have to let you go. We simply can't afford the loss of insurance coverage for everyone else in the company. No hard feelings.
That's just a couple of reasons for HIPPA. Do you really want to loose your job because the insurance company can deny you coverage and enforce it through employers? How about having a diabetic child, spouse, autism, other disability. Each and everyone of them could then be listed as a pre-existing medical condition and legally denied coverage for.
I know damn well that here in the states that unless we get a universal medical care (EU/Canada/UK) this is a piss poor idea though now that someone has figured out a loophole to HIPPA it looks like the insurance companies are going to push to kill it as fast as they can.
Mod me up/Mod me down: I wont frown as I've no crown
Yeah seriously. I don't need privacy. I don't have anything to hide. I'm a healthy, white, male, heterosexual, non-terrorist, US citizen.
People that worry about privacy are either stupid or hiding something.
You would have to be stark-staring insane to put or allow ANY of your medical information on a system like this. The health insurance companies would love this, and would use it against you. In the Single Payer system, you are REQUIRED to give them access to EVERY bit of medical information that exists about you in order to even be considered for coverage.
You are MUCH better off to have changed doctors periodically, and have your medical information dispersed and much more difficult to find.
Never give doctors offices or pharmacies your correct Social Security Number either.
The health care system in the United States is a HUGE mess; they want your money, all of it, and if you don't have employer-provided health insurance or can't afford expensive medical care on your own, you just shouldn't get sick.
If you would have read the WSJ and NYT articles, you would see people in the pilot were NOT concerned about others seeing their medical information. For them, the benefits outweighed the risks. It is THEIR decision, and it doesn't jive with yours, you're not forced to use it.
Sorry, that was CFR 160.102 and CFR 160.103. You can view it here.
Great post!
>> Allow Google to store your ePHI is no different than asking a friend to hold onto your paper medical records.
I keep a list of my wifes allergies and medications in my wallet in case of an emergency. Yeah on a piece of paper in my wallet. So having them available online is just convienent. So I guess someone could steal my wallet too.
Also, as if a gave a crap who knows my medical history. You people have 12 deadbolts on your doors too? Paraniod much???
I keep a list of mine and my wifes allergies and medications on a PIECE OF WHITE PAPER in my WALLET!!!
Oh my god!!
And, No I don't have a built in 100,000volt security system around my ass incase sometries to steal it.
This sounds like the exact same way Apple handles their security. And Firefox. And Linux.
It's obviously worked out really horribly for all of them, huh?
Any moment now the gaggle of sockpuppets is going to descend on this thread to argue the merits of creative spelling and make lame jokes. Brace yourselves for an onslaught of righteous evangelism.
If you live long enough, or if you get cancer early, you'll find yourself dealing with multiple medical professionals who aren't very good at sharing records with each other. Being able to point one doctor to the test results from another doctor can at the least save time and money and at best improve quality of care.
There's also the issue of the sorts of things people use MedicAlert bracelets for. I knew someone who was short on clotting factors and went to the hospital with chest pains. They told him something usually appropriate for a heart attack: they told him to take aspirin. Oops. Shared, readily accessible records could have prevented this accident.
That's the upside, the downside is obvious.
Not only that, HIPAA doesn't give you recourse to the civil courts. There's no private right of action under HIPAA. There's been one attempt to sue for negligence on the theory that HIPAA sets a standard of care: dunno how that turned out.
(My doctor's office has documents with labels that say "HIPPA". I've given up on ever having it spelled correctly.)
Yes, HIPAA is full of loopholes that make it the ENEMY of privacy. Under HIPAA, the "covered entity" is free to use your data as long as the purpose is "treatment, planning, or healthcare operations." You can imagine how easy it would be for a HIPAA-covered entity to sell your data and call it "operations."
It would be a mistake to regulate Google Health under HIPAA, unless HIPAA were to be reformed.
Hi,
I have written extensively criticizing the HealthVault model. (which also applies to the Google Health model in some places)
However, in this case. Google is in the right. They are not and should not be covered by HIPAA. The purpose of HIPAA is to ensure that your healthcare providers to not abuse their information privileges (i.e. knowing you have AIDS before you do) by improperly disclosing that information.
Anything that Google Health does, is theoretically an extension of what you, the patient want to do with the data. The idea that the rules for both of these cases should be "HIPAA " is silly.
I have done a full analysis here
If you choose to reply, please read the whole article....
-FT
What is the crisis? If people choose to personally and voluntarily upload their health information to some internet website it is their problem as to what happens next. Caveat emptor or some other Latin phrase so I look intelligent here ;p .
If it were doctors deciding to upload all their patient info without consent, THEN I'd be up in arms.
Here are the details.
The problem is not about HIPAA or not HIPAA. The problem is centralizing the medical information of millions of patients in a database. Do you know how much value has that database?
When you have a very valuable thing you need more and more efforts to protect the thing. But there is no 100% secure system.
As a family doctor I am really concerned about the privacy threats of the Personal Health Records.
I led a PHR project: http://www.keyose.com/
It is the first totally anonymous personal health record. No name, no email or other identification data required.
By providing a anonymous database we solve the privacy equation: not by rising the security costs but decreasing the potential value of our database for non-authorized intruders.
You may take a look...
"Confessors will not ask your name. Why do we?"