Can We Abandon Confidentiality For Google Apps?

An anonymous reader writes "I provide IT services for medium-sized medical and law practices. Lately I have been getting a lot of feedback from doctors and lawyers who use gmail at home and believe that they can run a significant portion of their practice IT on Google Apps. From a support standpoint, I'd be happy to chuck mail/calendar service management into the bin and let them run with gmail, but for these businesses, there is significant legal liability associated with the confidentiality of their communications and records (e.g., HIPAA). For those with high-profile celebrity clients, simply telling them 'Google employees can read your stuff' will usually end the conversation right there. But for smaller practices, I often get a lot of push-back in the form of 'What's wrong with trusting Google?' and 'Google's not interested in our email/calendar.' Weighing what they see as a tiny legal risk against the promise of Free IT Stuff(TM) becomes increasingly lopsided given the clear functionality / usability / ubiquity that they experience when using Google at home. So my question to the Slashdot community is: Are they right? Is it time for me to remove the Tin Foil Hat on the subject of confidentiality and stop resisting the juggernaut that is Google? If not, what is the best way to clarify the confidentiality issues for these clients?"

Comments

No

[jpyeron]

No, keep the hat, and demand better.

Re:No

[Shakrai]

Confidentiality is very, very important to businesses and individuals, even more so in the Internet age. One of the reasons to continue to operate your own infrastructure, no matter what the current hype is.

More to the point, some of his reasoning seems questionable. "Google Apps is easy to use from home" Yeah, and your point is? Never heard of a VPN? Never heard of remote desktop/terminal services/Citrix? It's not like they are particularly complicated these days. Hell, if you choose a vendor neutral solution with an accepted standard (IPSec) you might not even need to install any extra software on the clients.

Re:No

[Anonymous Coward]

Google Apps does offer solutions using their Postini product that should offer email archiving. This is not free. IANAL, and I don't use Google's apps for much, but I would consult an attorney who is versed at this form of law practice to sign off and ensure that there are no glaring holes that someone could sue or regulators could find criminal charges to press.

However, for CYA value if something does happen, I'd consider a commercial solution, such as a hosted E-mail provider that is familar with Sarbanes Oxley, HIPAA, FERPA, or other laws. For internal apps, I'd avoid being reliant on Web based stuff, just in case of a downed network. For CYA value, I would go with a commercial app solution. Microsoft Office is one solid solution. Another is Sun's StarOffice. The reason for a commercial solution is the ability to point a finger should something happen and say "Blame the software maker". There isn't anything wrong with OpenOffice, but having an ability to pass the buck is important.

If I were doing a basic professional office that is under these regulations, I'd be starting from the ground up with all commercial solutions from the ground up. Not because Dell makes a better desktop than I can do with decent parts, but because I can have a documentation trail that I can hand regulators if something happens (client makes a complaint, a security breach). This doesn't mean MS Windows only, because for most day to day use (and excluding specific databases or applications), a shop can happily run on RedHat, OS X, Solaris, or AIX workstations.

Disclaimer: IANAL.

Re:No

[CopaceticOpus]

Wouldn't Google be more likely to keep on top of software updates and security threats than a small, local hosting company who are figuring it out as they go? Hosting one's email with a local company or at one's own office may open a person up to more risk of being hacked than simply letting Google manage it.

Re:No

[Orange Crush]

^Great, now convince a 60 year old doctor with his own small practice and 8 to a dozen employees why he needs to spend thousands getting that all set up.

Re:No

[commodore64_love]

Agreed. Also online aps are more-expensive longterm. For example I purchased Microsoft Office 97, and I'm still using it 12 years later, which is an annual cost of just ~$12. Online aps have significantly higher fees than that.

There's also the advantage of owning the software. If for example you develop a design, you can archive both the design and the tools so they can still be used 15-20 years from now and "resurrected" from the basement. You can't do that with online aps which are constantly updated with no way to "freeze" a tool at a certain point.

Re:No

[nomadic]

"Google Apps is easy to use from home" Yeah, and your point is? Never heard of a VPN? Never heard of remote desktop/terminal services/Citrix? It's not like they are particularly complicated these days.

And as easy as those things are, Google Apps is still far easier.

Re:No

[geniusj]

That doesn't really hold up when you talk about running a service like mail. Someone has to maintain the spam filter, anti-virus filter, email accounts/storage, etc. I used to run my own mail servers and then ditched them. Spam filter in particular a real pain to get right. Google does an admirable job with it, however. If I need it to be private, I just use PGP. Perhaps not an option for a dr's office though.

Re:No

[commodore64_love]

That would never work for our military projects. Everything has to stay within the building's walls, including email.

Re:No

[edmicman]

So you don't send or receive email from anywhere then?

Re:No

[alexburke]

Agreed. Also online aps are more-expensive longterm. For example I purchased Microsoft Office 97, and I'm still using it 12 years later, which is an annual cost of just ~$12. Online aps have significantly higher fees than that.

.

Do you really think it's wise or responsible to be using a piece of closed-source software (and one not known for its security, to say the least) so many years after the vendor has stopped supporting or releasing patches for it, and for which known exploits are in the wild?

.

In what way does, for example, Google Apps Standard Edition ($0/year), cost more -- either up-front or in the long term?

.

Do you not think using current tools at the time to produce a file, then ensuring the file is stored in an industry-standard open file format (such as ODF, RTF, plain text, HTML, TeX, or PDF -- or even better, more than one), is an acceptable archive, without needing to also archive a copy of (or later run) a dated (and bug-ridden and proprietary, in this case) application along with it -- which may not even run on machines "15 or 20 years" later, as you mention?

Re:No

[asdf7890]

They probably don't send/receive internal email from anywhere, no. At least not directly. Someone needed to send what could be considered an internal (internal to the department/unit/what-ever) mail from an external location would do so via a sufficiently paranoid VPN setup.

Re:No

[hjf]

whooossssshh!

Re:No

[Darinbob]

If this is medical data for US patients, then you need to keep the data private AND secure, by law. This includes even data such as a scheduled appointment with a patient name. You can not let Google handle this unless the patients agree in writing. It doesn't matter if Google has a privacy policy or not, or if they can be trusted.

If the customers object, then go into Grampa Simpson mode and shout "HIPAA!!" over and over.

Re:No

[Chyeld]

SAS 70 Type II for Google Apps
Tuesday, November 04, 2008 at 3:46 PM
Posted by Eran Feigenbaum, Director of Security, Google Apps

Ever since the first Gmail users began trusting Google with their private information, keeping people's data safe has been one of our top priorities. Today, more than a million businesses, plus thousands of schools and organizations using Google Apps rely on us to safeguard their critical information.

We've published some of the ways we keep sensitive information where it belongs, but we wanted to go farther and have external independent security specialists audit our systems and procedures. Here's the outcome: an independent public accounting firm has verified the effectiveness of our technical processes and controls for Google Apps, and Google Apps has satisfactorily completed a SAS 70 Type II audit.

Our commitment to keeping customer information safe - whether they're consumer users or our largest enterprise customers - is part of our DNA, and we protect this information as rigorously as we protect our own sensitive corporate information. In fact, we use the very same services that we offer to our users for our own email, documents, project team sites and calendars.

which leads to

Statement on Auditing Standards No. 70: Service Organizations

Statement on Auditing Standards No. 70: Service Organizations, commonly abbreviated as SAS 70 and available full-text by permission of the AICPA, is an auditing statement issued by the Auditing Standards Board of the American Institute of Certified Public Accountants (AICPA), officially titled "Reports on the Processing of Transactions by Service Organizations". SAS 70 defines the professional standards used by a service auditor to assess the internal controls of a service organization and issue a service auditor's report. Service organizations are typically entities that provide outsourcing services that impact the control environment of their customers. Examples of service organizations are insurance and medical claims processors, trust companies, hosted data centers, application service providers (ASPs), managed security providers, credit processing organizations and clearinghouses.

There are two types of service auditor reports. A Type I service auditor's report includes the service auditor's opinion on the fairness of the presentation of the service organization's description of controls that had been placed in operation and the suitability of the design of the controls to achieve the specified control objectives. A Type II service auditor's report includes the information contained in a Type I service auditor's report and also includes the service auditor's opinion on whether the specific controls were operating effectively during the period under review

Re:No

[betterunixthanunix]

What you forget is the number of IT guys at Google, who could potentially be bought, especially if the information is very high-profile. I do not know Google's security policies, but I doubt that they are impossible for a corrupt IT worker to defeat, and if it is worth it to pay off an IT worker to leak some data, that is what will happen. A doctor or lawyer may have files that appear to not be worth that much at the time they are created, but any moment, that could change; why chance it by entrusting it to some third party? Keep it in house, and hire a security expert to design an appropriate MLS policy and auditing system; at the very least, you will be able to keep track of everyone who was ever involved with the data.

As Bruce Schnier said, "Only amateurs attack machines; professionals target people."

Re:No

[s4m7]

pgp is fine for a small practice to use between say the receptionist and the doctor. the problem with using pgp to obtain your confidentiality with respect to HIPAA is that emails sent from outside sources (e.g. patients) are subject to HIPAA as well, and unless you can convince all their customers to use pgp, that'll never work.

My advice for the original asker is to take a firm stand with your clients. If there is any way that they can pin the liability on you for recommending use of google apps or other online services they will when the lawyers come knocking. I suggest you strongly recommend against it, in writing, and keep that recommendation on file.

Re:No

[Blain]

People who haven't heard of a VPN or remote desktop/terminal services/Citrix? There's a phrase for that set of people: Almost everyone in the world.

I agree that there are off-the-shelf solutions that work better than this, but OP wasn't talking about /. readers, he was talking about normal people whose eyes glaze when you start using technical terms like "browser" and "client" and don't understand what all this fuss is about when they don't feel like they have anything to hide.

Almost everybody in the US has some access to the internet, but almost none have any appreciable understanding of how it works and what dangers they can face by trusting anything that comes by or all the people who can come into contact with their information. I don't know how you change that, but I'm pretty sure it's not from an appeal to geek-speak.

Re:No

[Anonymous Coward]

Everything has to stay within the building's walls

I think you mean "between?" Otherwise wouldn't that mean you're trapped in a wall?

Re:No

[Anonymous Coward]

Oh, so now we have to make it convenient for the poor old senile doctor instead of insisting on confidentiality of data that's way more important than some thousands of dollars.

Get your fucking priorities straight.

Re:No

[Anonymous Coward]

pgp is fine for a small practice to use between say the receptionist and the doctor. the problem with using pgp to obtain your confidentiality with respect to HIPAA is that emails sent from outside sources (e.g. patients) are subject to HIPAA as well, and unless you can convince all their customers to use pgp, that'll never work.

That explains why my doctor doesn't use a normal email address (they use an online form that sends the message instead), thanks.

Re:No

[Anonymous Coward]

People who haven't heard of a VPN or remote desktop/terminal services/Citrix? There's a phrase for that set of people: Almost everyone in the world.

Right, and the rest are the ones the doctors should be hiring to handle those issues for them. Why do you go to a doctor in the first place? Just ask Slashdot or google it and go pick some herbs. That should be enough, shouldn't it?

Google makes a decent search engine, that's about it. There's no need to shift data to them needlessly, especially not confidential data.

Expert issues to the experts, we don't need any more idiocy.

Re:No

[vux984]

Do you really think it's wise or responsible to be using a piece of closed-source software (and one not known for its security, to say the least) so many years after the vendor has stopped supporting or releasing patches for it, and for which known exploits are in the wild?

Word/Excel/Powerpoint? I really wouldn't worry about it, as long as they meet his needs. (Although, I'd consider giving OO.o a try.)

Outlook - yeah, I'd suggest he pony up for a new copy, or switch to something else.

In what way does, for example, Google Apps Standard Edition ($0/year), cost more -- either up-front or in the long term?

Lost productivity.

1) Lost productivity when the local ISP or some some intermediate router is down? Multiply by each user. (In a lot of places that's pretty significant. Lots of places suffer multiple hours of network down time / flaky internet every month.)

2) Lost productivity as your employees are clicking on google ads and browsing online when they should be working on that spreadsheet or word document, or simply lost productivity as the ads become insufferably intrusive and distracting.

Think about it... you are getting standard edition for "free". Google wouldn't do unless some non-trivial number of users is READING and CLICKING on those ads. If your secretary is working on a budget spreadsheet, and gets distracted by an google ad in the corner of her spreadsheet, gets distracted and clicks on it, and goes browsing for 20 minutes as a result... that costs you money. And THAT is PRECISELY what your beloved partner google is counting on. THAT is their entire business model. Give you the app for free, and then extract a profit by luring your staff to click ads instead of work.

Now you might counter that google ads are unobtrusive and easily ignored. That's true to a point, but I find adds in my productivity apps VERY distracting; far more than I do on the web. I personally won't use ad supported software, but don't find them nearly so distracting on the web. Maybe its just me... But face facts google is a multi-billion dollar advertising company as direct result of people not ignoring those ads. So the ads =DO= work. Maybe YOU don't click them, but SOMEBODY is. And every time they work on someone in your company they cost you money.

I don't object to google apps for home and noncommercial use, and their 'premium' stuff is ad free, as you are now paying them directly for service.

But a business owner who gets his staff to use standard edition? Its idiotic... what's next? Will you switch to "free" printer toner from the Jehova's Witnesses, and in exchange they'll have witnesses wander around your office to spread the good news?

Do you not think using current tools at the time to produce a file, then ensuring the file is stored in an industry-standard open file format (such as ODF, RTF, plain text, HTML, TeX, or PDF -- or even better, more than one), is an acceptable archive, without needing to also archive a copy of (or later run) a dated (and bug-ridden and proprietary, in this case) application along with it -- which may not even run on machines "15 or 20 years" later, as you mention?

What makes you so confident ODF will be readable in 20 years by Google Apps, or that a google apps will even exist? All ODF being a standard ensures is that you WILL be able to write something that can read it 20 years from now, because the specification is documented and public. There is no gaurantee google apps or anything else will run it 20 years from now. And if you are looking to archive ODF, you should probably make a point of storing something that can actually read it too, ideally along with its source, unless you want to gamble on having to implement something yourself from scratch 20 years from now.

Google apps doesn't enable you to avoid making your own backups, and if anything google apps, makes it slightly more complicated. Google apps could disappear tomorrow (unlikely in the immediate future, but possible, and who knows what the more distant future holds; companies have been shut off before), so not only do you need backups, but you should have some means of reading them too... because you can't rely on google apps being available or supporting the files.

Re:No

[Anonymous Coward]

Dude I work for a government agency subject to HIPAA and we get emails all day long from mail providers who do not and cannot follow hippa. I am talking everything from AOL and Hotmail to mom & pop ISP in Guam. The only requirement is we can NOT respond back with HIPPA information unless it is a direct answer to a direct question, we have the email on file for the record and we include a huge ass disclaimer (lots of times longer than the email). HIPPA does NOT affect what you can send to me or a doctor, only what they can send back and how it must be stored.

Re:No

[Runaway1956]

Your walls mean nothing to us.

Re:No

[Swampash]

operate your own infrastructure, no matter what the current hype is

Exactly. You should be digging trenches, laying fibre, and setting up entirely separate networks so that no email you send ever passes through a machine or a network or a cable accessible by a third party.

Re:No

[CopaceticOpus]

Perhaps it depends if the legal cases are of local or national interest. If the cases are local and the people interested in breaking in are local, they are more likely to have connections or influence with the local hosting company's employees.

Realistically, though, how would someone find a corrupt Google worker with the skill and clearance to get at the desired data? I would imagine Google doesn't give employees carte blanche access to user data. Even a Gmail developer might do most of their development using only test data.

Re:No

[Fallen Seraph]

Lost productivity.

1) Lost productivity when the local ISP or some some intermediate router is down? Multiply by each user. (In a lot of places that's pretty significant. Lots of places suffer multiple hours of network down time / flaky internet every month.)

2) Lost productivity as your employees are clicking on google ads and browsing online when they should be working on that spreadsheet or word document, or simply lost productivity as the ads become insufferably intrusive and distracting.

You forgot the other side of the coin:

1. Lost productivity due to forgetting the thumb drive with your work at home
2. Lost productivity due to your company's internal network going down
3. Lost work due to a hard drive failure
4. Lost work AND productivity due to computer theft
5. Lost work AND productivity due to accidental overwrite of a shared file on a network drive
6. Lost work AND productivity due to malicious code (viruses, trojans, et al)
7. Lost productivity due to most software's inability to provide a decent collaborative environment

Many people seem to believe that using something like Google Docs is just like using MS Office, but the reality is that it's fundamentally different in many ways. Nearly ubiquitous accessibility, collaborative tools, change history, backups, etc. The amount of productivity and work that saves alone is WAY more than any time you could lose due to advertising in my estimation. Your comparison is absurd and poorly thought out as well, because "getting toner from Jehovah's Witnesses does not give you any benefit other than getting it for free. Using cloud authoring software compared to personal software is COMPLETELY different for the reasons I listed above and others.

The fact is that neither one is REALLY better than the other, it all depends on the task at hand, as both approches have their strengths and weaknesses. If I'm just writing a quick letter, then I'm going to use Word or OO, but if the file itself is going to be used over an extended period of time, and especially viewed or contributed to by others, I find it makes more sense to use Google Docs.

Plus, I can't count how many times I've worked with a team on something and wound up using a Google Doc as what essentially amounts to a massive whiteboard to outline our plan of attack and add our ideas and solutions to the task at hand, as well as comment on others.

Re:No

[demonlapin]

From a physician's point of view, this is fairly simple: if a patient emails you, you send back an email requesting them to come into the office - any time, no appointment needed - and sign this little form acknowledging that unencrypted email is completely insecure and that anyone with an interest could easily eavesdrop on any email conversation, and that they are accepting that any such disclosure would be permissible.

HIPAA only keeps you from sharing protected health information WITHOUT CONSENT.

Re:No

[jon3k]

You have classified and unclassified networks. Classified networks don't touch the Internet, ever, in any way.

Re:No

[jon3k]

HIPAA requires ePHI to be protected both in transit and at rest (on disk). Google will tell you flat out that your data is not sufficiently protected (eg encrypted) at rest to qualify as being HIPAA compliant. Obviously you can use SSL during transit but that doesn't solve the whole equation. Google apps, flat out, are not HIPAA compliant, and google will be the first to tell you that.

Re:No

[betterunixthanunix]

Someone has to have the job of managing backups and replacing faulty hardware. Those would be the first class of employees I would look for: the people who actually walk through Google's server farms. If not them, then I would next look at the people who have any sort of login privileges on those servers (e.g. a sysadmin), who could potentially open a covert channel. A moderate payment of $200000 to have one of those guys make an extra copy of some data or leak it into an account I control? Certainly worth it in a multimillion dollar case.

Even in a local case, if it is worth enough money, I would not count out a corrupt party paying off a Google IT worker. Keeping everything in-house is not a cure-all, and there have certainly been cases of corrupt employees within law firms, but just the number of IT workers at Google, even the number who might have access to the data from Google Apps, is cause for some alarm. There are just too many employees, and too little in the way of data security, to have much faith in Google's ability to guard high profile data.

One step Google should take is allowing someone to designate certain data as requiring extra protection -- they could charge a small fee for this to prevent people from doing so when there is no such requirement -- and create some sort of MLS system that only allows higher-ranking (and presumably more trustworthy) IT staff to handle that data or access the systems that store it, and encrypts the data on disc. That would go a long way toward building trust in their ability to securely store high profile data, as long as you trust Google to properly implement such a system.

Re:No

[Shakrai]

^Great, now convince a 60 year old doctor with his own small practice and 8 to a dozen employees why he needs to spend thousands getting that all set up

You must be working for the Government if you think it costs thousands of dollars to set up a small office VPN.

Re:No

[margaret]

Confidentiality is very, very important to businesses and individuals, even more so in the Internet age. One of the reasons to continue to operate your own infrastructure, no matter what the current hype is.

IAAD and I agree that confidentiality is extremely important, and health care professionals have a responsibility to safeguard PHI. However, I also think that IT admins have a responsibility to create an infrastructure that doesn't suck and that takes into account the needs of the people that actually need to use it. Because if it sucks bad enough, people will find a way to circumvent some of the safeguards in order to get their work done. Because it's human nature that getting one's work done is a more immediate need than theoretical concerns about privacy and confidentiality. So if you're going to develop an internal system, looking at what makes "the current hype" so popular might not be a bad idea.

For example, I work at a large county hospital/university system that has adopted groupwise. We are told that PHI is secure if sent through groupwise. However, besides the fact that groupwise is inherently sucky, they've made it extremely inconvenient for residents to use it. We cannot run the real client because we aren't allowed to have VPN access, so we have to use the web client, which has a horrible interface. It has a tiny storage allotment. They will not install the software that will allow it to work on the iphone. So, most people forward their groupwise email to their personal gmail or yahoo mail or whatever. Thus defeating the purpose of having the secure system.

Yes, it's wrong for the doctors to circumvent the security. However, I think it's just as wrong for the IT people to implement a system so crappy that people are driven to do this. Most doctors are thinking along the lines of "I have patients to take care of, I don't have all this time to spend fiddling with this crappy groupwise thing" not "let me violate HIPAA because I'm lazy."

Re:No

[tsm_sf]

Google apps, flat out, are not HIPAA compliant, and google will be the first to tell you that.

And your insurance company and their lawyers will be the second.

Actually, this is hardly surprising. HIPAA compliance is for the geeks to worry about, not the HARDCORE ER STAFF who's job is SAVING LIVES you INSIGNIFICANT LITTLE NOBODY! Did you ever SAVE A LIFE with your applebook? Huh? Didn't think so. Now get out of my way while I manage to infect our network with spyware and trojans even after repeatedly being warned about russian ring-tone sites.

Re:No

[BikeHelmet]

There's also the advantage of owning the software. If for example you develop a design, you can archive both the design and the tools so they can still be used 15-20 years from now and "resurrected" from the basement. You can't do that with online aps which are constantly updated with no way to "freeze" a tool at a certain point.

Conversely, an online tool will constantly be updated, and the format constantly migrated forward, so you will have no compatibility issues ever. (except perhaps when exporting to an offline file) The archived offline tool won't run on a new OS in 15 years, and if you're a business, you'll have to pay someone a shit ton of money to get a virtualized OS up and running with those old tools, pushing the "$12" cost significantly higher.

Re:No

[mischmasch55]

I work for the Navy, most people sitting on the bases are on the non-classified network, which does have (albeit limited) access to the internet. The classified networks are used for internal use only, obviously.

Re:No

[vux984]

1. Lost productivity due to forgetting the thumb drive with your work at home
2. Lost productivity due to your company's internal network going down
3. Lost work due to a hard drive failure
4. Lost work AND productivity due to computer theft
5. Lost work AND productivity due to accidental overwrite of a shared file on a network drive
6. Lost work AND productivity due to malicious code (viruses, trojans, et al)
7. Lost productivity due to most software's inability to provide a decent collaborative environment

2,3,4 & 6 all affect using google apps too, to precisely the same degree assuming you have even a half decent backup solution.
1 is offset by the internet / google going down
5 not an issue assuming you have a decent backup solution on the network drive
7 most documents aren't collaborative and what you gain in collaboration you lose in script and automation/workflow support

Using cloud authoring software compared to personal software is COMPLETELY different for the reasons I listed above and others.

And contains pitfalls as well as benefits. We didn't talk about any of the pitfalls of cloud apps:

1) No change control of applications or ability to handle training in advance. If google rolls out a new theme and re-arranges the buttons your help desk and IT department find out about the same time users do.

2) If the service provider removes or alters a feature you rely on - tough. Especially if you are using 'free' SAAS.

3) Legal liabilities. No control over googles security policy. No control over googles retention policy. No control or ability to discover intrusions or data theft. No control over their response in the event of a subpoena.

4) Loss of productivity due to the issues that result from running your office suite in your browser. Things are getting better, but I'd rather pull my hair out with Office 97 than do anything serious with Google Docs.

Plus, I can't count how many times I've worked with a team on something and wound up using a Google Doc as what essentially amounts to a massive whiteboard to outline our plan of attack and add our ideas and solutions to the task at hand, as well as comment on others.

There are even better whiteboard solutions out there. Wikis come to mind for 'massive only collaboration document' while actual honest to goodness whiteboard software works great for when you actually need an online whiteboard.

Plus, I can't count how many times I've worked with a team on something and wound up using a Google Doc

This seems more like a 'when have a hammer, every problem looks like a nail." situation.

The fact is that neither one is REALLY better than the other, it all depends on the task at hand, as both approches have their strengths and weaknesses.

I can agree with that, to a point, based on pure productivity/cost. But when you factor in legal implications, change control, training, and so forth, I don't think its sane for most businesses to use cloud apps in the vast majority of situations.

Re:No

[bschorr]

...and no way to audit Google's data center(s) to establish compliance which is a very big deal in a lot of industries.

Re:No

[bschorr]

Lost productivity due to forgetting the thumb drive with your work at home

That's why we use a VPN to work on documnts from work rather than relying upon a flash drive.

Lost productivity due to your company's internal network going down

If my company's network goes down (which it rarely does) I can troubleshoot it and get it back on it's feet. If Google goes down I can send them an e-mail (assuming I'm NOT using GMail) and get an automated response or maybe I can call them and hear that the next avaialble agent will be with me shortly.

Lost work due to a hard drive failure

If you don't back it up then you don't deserve to have it.

Lost work AND productivity due to computer theft

If my computers get stolen then how do I log into Google?

Lost work AND productivity due to accidental overwrite of a shared file on a network drive

See: Backups.

Many people seem to believe that using something like Google Docs is just like using MS Office, but the reality is that it's fundamentally different in many ways. Nearly ubiquitous accessibility,

I wouldn't have had access to my Google Docs on the flight I just got off.

it all depends on the task at hand, as both approches have their strengths and weaknesses.

Well that I certainly agree with. Google Docs has its place. But that place will never include mission-critical or confidential work product. Not unless some drastic changes are made.

Re:No

[dkf]

I can agree with that, to a point, based on pure productivity/cost. But when you factor in legal implications, change control, training, and so forth, I don't think its sane for most businesses to use cloud apps in the vast majority of situations.

You're thinking like a techie, and probably a sysadmin there, and not like a businessman.

1. You're massively overweighting the relative value of legal implications for documents in development (finalized docs are something else, but they're best in another format, such as Dead Tree). So long as there is reasonable security and access control, the legal side should be covered.
2. A lot of businesses use no change control for anything. Moreover, Google Docs keep version history (or did the last time I checked, which admittedly is some time ago).
3. Training costs are pretty much a continual load. Really. Especially for larger businesses. How to type into a wordprocessor or spreadsheet is one of the more easily mastered things.
4. You're undervaluing opportunity costs. This is a classic mistake (along with getting involved in a land war in Asia) of sysadmins. They spend their time looking at the down-side, say "No way!" (a la Mordac), and either the business suffers or the users - and the management - ignore the sysadmin and do what they want anyway.
5. A lot of companies are not run in a sane way.

The only way to hold off cloud apps is to provide something better. For a lot of users, Word is not better and Excel is not better. They like doing things on the Web; it lets them be more productive. Fighting against that is a bit like being King Canute, telling the tide to stop coming in.

Re:No

[codeguy007]

First of all the mail coming from your clients is already unsecure long before it even reaches your mail server. Using googleapps email is no more a risk that using email from another webhost. There is nothing stopping you from downloading sensitive email from google and deleting just like you would from another email service. Just because it offers online storage doesn't mean you have to use it. I am sure a lot of small doctors offices don't have their own mail servers and use their ISP or a web hosting company. The question really comes down to whether you trust the company offering your mail service or not.

Re:No

[codeguy007]

1) Lost productivity when the local ISP or some some intermediate router is down? Multiply by each user. (In a lot of places that's pretty significant. Lots of places suffer multiple hours of network down time / flaky internet every month.)

Google Chrome supports offline use of google apps.

2) Lost productivity as your employees are clicking on google ads and browsing online when they should be working on that spreadsheet or word document, or simply lost productivity as the ads become insufferably intrusive and distracting.

Only the standard free version is ad based. If you upgrade to the premium the ads are gone. For anything serious like outlook integration, you need google apps premium.

Re:No

[Helldesk Hound]

> Actually, this is hardly surprising. HIPAA compliance is for the geeks
> to worry about, not the HARDCORE ER STAFF who's job is SAVING LIVES

_Actually_, the only people who worry about using Google Apps are the bean counters who don't care at all about protecting the confidentiality of their business's data or intellectual property, and only care entirely about shaving cents from the cost of operating their business.

Nobody else would even contemplate using Google Apps in a commercial context.

Re:No

[speedtux]

Actually, this is hardly surprising. HIPAA compliance is for the geeks to worry about, not the HARDCORE ER STAFF who's job is SAVING LIVES you INSIGNIFICANT LITTLE NOBODY!

Maybe you can still "save" some people's lives temporarily in the ER, but the root causes are much earlier: stress, poor nutrition, lack of exercise, lack of protective gear, addiction, etc. Much of ER medicine is pointless and frustrating because people will continue their self-destructive behaviors and just be back in a few months... or go to the slab directly.

So, I wouldn't put up ER medicine on a pedestal as the kind of medicine that "saves lives". GPs--doctors who know and work with families and people over a long time--are probably the most important doctors in terms of saving lives, but even more important are friends, partners, and colleagues.

Re:No

[teh kurisu]

Lost productivity.

1) Lost productivity when the local ISP or some some intermediate router is down? Multiply by each user. (In a lot of places that's pretty significant. Lots of places suffer multiple hours of network down time / flaky internet every month.)

We can route our network through a mobile 3G dongle if our company network goes down. It's extremely unlikely that both of these would go down at the same time.

There's also the possibility of using Google Docs offline.

2) Lost productivity as your employees are clicking on google ads and browsing online when they should be working on that spreadsheet or word document, or simply lost productivity as the ads become insufferably intrusive and distracting.

As opposed to the lost productivity when your employees are playing solitaire and minesweeper? Your productivity problem here is with your employee, not with your technology.

And the ads aren't at all intrusive. Avoiding Google Docs because they might become intrusive is like avoiding siting your business in a building because it might burn down.

Re:No

[Anonymous Coward]

"ignore the sysadmin and do what they want anyway." and usually get busted by their idea and blame the sysad for not being enough convincing.

Re:No

[silanea]

1. Lost productivity due to forgetting the thumb drive with your work at home - Most larger companies will have you grilled for taking work-related material home on a thumb drive, and have you crucified for even bringing your personal thumb drive to work. And rightly so. If you need to work from your home the company should give you a preconfigured laptop.
2. Lost productivity due to your company's internal network going down - no internal network = no access to online apps
3. Lost work due to a hard drive failure - Any company whose file server can lose data when ONE hard drive fails deserves to lose productivity. Other than that I do not see what you mean with this argument.
4. Lost work AND productivity due to computer theft - This argument makes even less sense than the previous one. If you are referring to lost data on stolen laptops and thelikes: There is this thing called full disk encryption which should by now be standard procedure for any corporate laptop. Again, who does not do this deserves to lose data. And since you synced your work to the company's file server all you have to do to continue working is go to any computer hooked up to your company network. If you are referring to the most current version of your work being lost when the laptop is stolen: You can only use Google Apps when you have Internet connectivity. When you have Internet connectivity you can access your company's VPN and sync your work aginst their file server.
5. Lost work AND productivity due to accidental overwrite of a shared file on a network drive - Google did not invent versioning. Even Microsoft offers something in this regard, namely Shadow Copy. So no, this is not a valid point unless your company hired a butt monkey as their server admin.
6. Lost work AND productivity due to malicious code (viruses, trojans, et al)Oh, right. You access Google Apps on nothing but thin air and three Hail Marys. You don't need a computer with an operating system and a browser for that. Oh dear.
7. Lost productivity due to most software's inability to provide a decent collaborative environment - That depends on what degree of collaboration you need. I would guess that for most office jobs versioning is fully sufficient, and more specialised jobs require specific tools that Google Apps cannot compete with anyway.

Google Apps bring little benefit for most work environments that I have seen so far, but they come with lots of additional headaches.

Re:No

[sgbett]

Google is paid by the advertisers. Saying that its business model is to waste your employees time is a bit of a stretch.

Re:No

[Anonymous Coward]

Glenn Beck, and anyone that listens to him, is retarded. And yes, I'm going to leave your antiquated thinking on this submission alone.

Re:No

[Anonymous Coward]

Google Apps has satisfactorily completed a SAS 70 Type II audit

Great.

This was done to Google's satisfaction and according to their appetite for risk. Your organization's risk tolerance may differ substantially.

What were the outcomes of the audit? What have they fixed? What remains a problem? Who did the audit?

Re:No

[Scuff]

Think about it... you are getting standard edition for "free". Google wouldn't do unless some non-trivial number of users is READING and CLICKING on those ads. If your secretary is working on a budget spreadsheet, and gets distracted by an google ad in the corner of her spreadsheet, gets distracted and clicks on it, and goes browsing for 20 minutes as a result... that costs you money. And THAT is PRECISELY what your beloved partner google is counting on. THAT is their entire business model. Give you the app for free, and then extract a profit by luring your staff to click ads instead of work.

There are no ads in google docs.

Re:No

[vux984]

Premier edition has ads, standard is "free, ad supported". Your right, I don't think they actually show ads on spreadsheets and documents, at this time... yet.

Re:No

[s4m7]

how it must be stored.

exactly.

Re:No

[s4m7]

The incoming mail being insecure was not my point, but there's no way to satisfy HIPAA's storage security standards without those mails being kept in an encrypted format since they're on a third party service that the provider has access to.

Under HIPAA you can't just "delete" what you can't secure. You're obligated to maintain records ofcertain types of communications for specified periods.

you do make a valid point about google not being all that different from other ISP's except for one thing: google expressly requires you to give them consent to read your mail at the time of account creation.

Re:No

[SherpaDave]

Under certain circumstances, Google does offer the option to have all domain level emails/data stored on US servers... meaning that any data related to a particular domain is only stored on servers within the US, and will not replicate to server outside the US. I've seen this deployed first-hand with new Google Domains that require data be stored within the US, such as for Government or Military related contracts/vendors/subsidiarities.

Re:No

[commodore64_love]

If you designed an FPGA using Google Ap 2008, and ten years have passed, how do you know Google Ap 2019 will give you the exact-same output?

You don't.

The software has different algorithms and will produce a different output. That's why you need the ability to archive the original 2008 tool so the output is reproducible to the exact-same specs, even if it's now the year 2020. Except you cannot archive online aps; you can only archive a product that you've purchased and physically own on a CD.

Get it?

Re:No

[Orange Crush]

Maybe high hundreds, but depending on the particulars of his existing setup, it could easily get in to the thousands. The Doc has to pay someone to set it up for him, mind you.

Re:No

[onemorechip]

"Between" implies there are only two; I'd like to see that building. Maybe "among"? But seriously, look at definition 6 from dictionary.com:

within
preposition
6. in or into the interior of or the parts or space enclosed by: within city walls.

Re:No

[Anonymous Coward]

Nearly ubiquitous accessibility, collaborative tools, change history, backups....

MS Office is not ubiquitous or accessible? I would say it's accessibility is better since you don't even NEED a network connection of any kind for most of it (Outlook included if you're looking for an old email).
MS has a few decent collaboration tools, not great but decent.
Change history, you really listed this as a benefit of Saas ? Word 2003: Tools -> Track Changes , same thing for Excel 2003.... I use this as an example because it is installed.
Backups.... Umm if your IT group is doing their job, backups are covered internally and more readily accessible than calling up Google to get it done.

AC FTW !!!

Re:No

[Anonymous Coward]

Google apps, flat out, are not HIPAA compliant, and google will be the first to tell you that.

And your insurance company and their lawyers will be the second.

Actually, this is hardly surprising. HIPAA compliance is for the geeks to worry about, not the HARDCORE ER STAFF who's job is SAVING LIVES you INSIGNIFICANT LITTLE NOBODY! Did you ever SAVE A LIFE with your applebook? Huh? Didn't think so. Now get out of my way while I manage to infect our network with spyware and trojans even after repeatedly being warned about russian ring-tone sites.

Yes I have !!! I used it to aid in CPR, it worked great for taking out same rage while doing chest compressions....

Re:No

[Anukis]

Quote -> "you can archive both the design and the tools so they can still be used 15-20 years from now "

Subject, of course, to having the Operating System upon which the tool will run.

Maybe archiving a Virtual Machine image file will help.

Subject, of course, to having the VM software that will recognise the VM image.

I should think "freezing" a tool at a certain point is a lot harder than we think here.

Re:No

[Fallen Seraph]

For a lot of my points, the reasoning is "If your computer goes down, grab a different one and nothing is lost." Hell, you can ever go to a public terminal like a cyber-cafe and access your data if need be. This is way more versatile than carrying your apps and data around with you.

On a side note, I find it amusing how many of the ones arguing that my points are invalid are GROSSLY overestimating the IT capabilities of many businesses and companies, especially start-ups or small ones, whose business model does not revolve around the internet or tech.

I just returned from a quick side-job of mine where all of the empoyees use old P4 Dell Optiplex machines, with about 256MB of RAM, and all of them sign into a generic account called 'user'. Now, I wasn't the one who set this all up, but they asked me to help maintain their network and do some light desktop support for them. If one of their hard drives fries, it's gone, and no one wants to pay for a backup or even a central server, they all share everything through email, and trying to change a company's method of doing things, especially when you only work for them part-time, because they don't have enough staff to justify a full-time IT guy, can be pretty damn difficult until something disastrous happens.

Oh, and also Google Docs is completely cross-platform, which means it's only competitor in that respect is OO :P

Re:No

[Jake Griffin]

I don't think that the GP was referring to within the US, but within the institution. I work for a government contractor and there is no way that any of our (internal) email would be allowed to be put on any server outside of our facility. And to send email externally, we have to first send it through to someone so that they can first review it for sensitive information.

Re:No

[tsm_sf]

Haha, yeah, I was just kind of riffing on this guy I know's "I can't be bothered to not infect our machines" attitude. Veterinarians in all-animal hospitals are a lot more impressive, IMHO.

Re:No

[silanea]

For a lot of my points, the reasoning is "If your computer goes down, grab a different one and nothing is lost."

I know, IT is seldom done as it should be especially in smaller shops, but this is exactly what you ought to be able to do on any well-designed and maintained corporate network. Replacing a broken machine with a new one that mirrors the user's last state minus the last 10 minutes takes us about 20 minutes and one network boot. And our budget is really low.

Hell, you can ever go to a public terminal like a cyber-cafe and access your data if need be. This is way more versatile than carrying your apps and data around with you.

Yes, but for this to work you would have to store your company data directly on the Google servers. We could not do this for legal reasons even if we wanted to. Besides, we do not want our employees to be able to access just any file from anywhere. We are required both by law and by contract to keep certain information on our own network. So we have to maintain our own infrastructure anyway. Why should we bother with Google Apps on top of that?

Google Apps is good for home users, and it may be good for certain SOHO setups and non-profits where confidentiality is not regulated too strictly. But using it for anything larger? I for one certainly would not do that.

yes..

[Anonymous Coward]

..the google apps contract is fine. IAAL and i use google apps for all my stuff. i DO maintain a separate backup but everything goes on google. the bar is also fine with it.

Re:yes..

[Anonymous Coward]

Good thing you posted anonymously. That means you won't lose clients and we don't have to take you seriously.

Re:yes..

[TheMMaster]

If you had read the entire article you would've seen that it is written by "Brett Burney is principal of Burney Consultants, based in Cleveland." Finding his website, it turns out that mr Burney is not a lawyer, he provides some legal services FOR lawyers.

So, that article is just some guy saying how convenient those tools are. Not some sort of legal analysis of the use of web-based applications for sharing private data.

Here in Europe using stuff like that is absolutely not allowed for sensitive data, doctors, lawyers and governments are most certainly NOT allowed to use a hosted app like that.

Re:yes..

[IshmaelDS]

I love AC's that call out other AC's.

Re:yes..

[jonnyj]

I can't give a legal answer for US companies, but its my job to consider questions like this for a UK based financial services business. Google's applications are essentially the same as any other outsourced services, and UK law is based on the premise that you can outsource activity but you can't outsource responsibility.

What this essentially means is that a UK business is expected both to have a legally enforceable set of data protection contract terms and to have conducted a risk assessment supported, where appropriate, by a detailed appraisal of the outsourcer's policies, procedures and practices. FWIW, the conclusion that I've drawn is that Google apps are completely unuitable for any UK business that processes customer data, as there is no guarantee that the data will remain in the EEA (European Economic Area) or another country that has equivalent data protection principles enshrined in law. UK business are not allowed to process personal data in the USA without express customer consent because its data protection laws fall short of ours.

Re:yes..

[nomadic]

IAAL too and I see nothing wrong with Google apps. Don't know about doctors, but lawyers are perfectly aware that nothing is foolproof once you get online, and we realize that some Google employee has access to our stuff. We're expected to maintain confidentiality in a reasonable matter, not approach it with the paranoia of a computer security expert.

Re:yes..

[chadplusplus]

IAAL too, and I saw nothing in there relating to whether the various state bars have given this the thumbs up. I suspect this would depend greatly upon the relative progressiveness of the pertinent state bar. I'd be interested in seeing an ethics ruling concerning this if you have any citations. (Sorry, I'm not paying Lexis to do a search just to satisfy my curiosity.)

Re:yes..

[michaelhood]

It doesn't take a "computer security expert" to know that you're unnecessarily risking your clients' confidentiality by sending your communications wholesale to a 3rd party.

Re:yes..

[jpyeron]

IAAL too, ... I'd be interested in seeing an ethics ruling concerning this if you have any citations. (Sorry, I'm not paying Lexis to do a search just to satisfy my curiosity.)

Write the query and I will do the search.

Re:yes..

[Anonymous Coward]

UK business are not allowed to process personal data in the USA without express customer consent because its data protection laws fall short of ours.

Hmmm Virgin Media must have updated their T&Cs recently without notifying me.
They announced they're outsourcing all email to google.

Re:yes..

[HangingChad]

i DO maintain a separate backup but everything goes on google. the bar is also fine with it.

The whole discussion is based on a false premise. Anyone sending unencrypted email can have it duplicated, read, summarized and indexed, both body and attachments, at potentially every relay between the sender and destination. So not using Gmail only provides a more robust false sense of security.

We use Gmail and GoogleApps at the office without any problems and most of our customers are doctors.

Unless someone has information I don't know about, the online version of Office will have the same questions hanging over it. It's a non-issue. The people working for Google are not stupid. They know getting caught browsing docs would gut their reputation in the market, virtually overnight. Let one leak get tracked back to Google.

You're not responsible for someone spying on your business, whether that spy slips a trojan on to your laptop or network or taps into your Google Docs at one of their data centers. You're the lawyer, wouldn't Google Docs provide a reasonable expectation of privacy? Someone would have to prove you were negligent using GoogleDocs. That would be a tough case.

Re:yes..

[rjh]

IANAL. My only legal credential is that I come from a family of lawyers and judges who are absolutely adamant about their moral obligation to preserve privilege.

As they have explained it to me, once you voluntarily hand information off to an uninvolved third party, the veil of privilege is breached and it can be discovered.

As they have explained it to me, anything you give to Google can be subpoenaed. Google is currently one of the most-frequently-served companies in the world, and Google gives full and enthusiastic cooperation with lawfully issued subpoenas.

If you really see nothing wrong with risking the privilege of your work product by putting it into the hands of a third party, and if you really see nothing wrong with making it discoverable via subpoena, then by all means use Google Docs. However, for my own sake, I refuse to deal with lawyers who use outsourced IT services.

Re:yes..

[kelnos]

However, for my own sake, I refuse to deal with lawyers who use outsourced IT services.

How do you find out? Do you simply ask the first time you consider doing business with them?

Re:yes..

[cyber-dragon.net]

How do you maintain a backup with apps provides no means to do so on an enterprise level?

Re:yes..

[Anonymous Coward]

I work at a tier-1 law school. Our cyberlaw professor is a practicing attorney (read: not a pure academic) and he'd own your ass in court if you lost your client's data... full stop.

Re:yes..

[niteshifter]

We're expected to maintain confidentiality in a reasonable matter, not approach it with the paranoia of a computer security expert.

So .... in the era before Google apps, at the end of the day you just left client documents laying about untended and exited the building without locking the door?

Re:yes..

[rjh]

Yes. When I was looking for a lawyer, I asked them how they contacted their clients, and where their email servers were located. The guy I eventually chose as my lawyer told me he contacts clients via email, phone and IM only to arrange face to face meetings, and then walked me down the hall to the server room. He introduced me to the sysadmin, and the law firm sysadmin answered more of my questions.

Choosing a lawyer is a big deal. You should treat it like one. Any lawyer who is not willing to fully answer your questions is not worth your time or money.

Re:yes..

[Mr. Slippery]

It doesn't take a "computer security expert" to know that you're unnecessarily risking your clients' confidentiality by sending your communications wholesale to a 3rd party.

A third party like your ISP? Your telephone company? The USPS? FedEx?

Unless you're meeting in person, or talking to someone else at the same company as you, your communications always go through a third party.

Re:yes..

[demonlapin]

IANAL, but reasonable expectation of privacy is a legal term of art that bears strikingly little resemblance to the average person's comprehension thereof. A potentially relevant case to this is that called-number logs are considered not private because, originally, you had to tell the operator which number you wanted to call - so you voluntarily gave up the privacy of who you called, even though the content was private. A good friend of mine who IS a lawyer mentioned in explaining the whole thing that you have no reasonable expectation of privacy in another person's home, even if they're not there.

Re:yes..

[Rydia]

Those groups don't have the right to look at the data, or your consent to keep it. Google, in this case, does.

Put it this way: it's not a breach of confidentiality for someone to break into your car and steal your briefcase. It is if you tell someone to go out to your car and grab you a document from your briefcase.

Re:yes..

[jon3k]

Especially a 3rd party that makes no guarantees as to their compliance with any regulatory requirements (eg HIPAA).

Re:yes..

[prockcore]

You do that every time you pick up the phone. Or send a letter. Or do anything other than talk to someone face to face.

Re:yes..

[jon3k]

"A third party like your ISP? Your telephone company? The USPS? FedEx? "

That's what encryption is for, and until Google can encrypt my data at rest, they are not HIPAA compliant. Fax and telephone are specifically addressed by HIPAA -- fax is basically just given a free pass (ridiculous, I agree) and verbally relaying ePHI via the telephone requires a written consent form from the patient.

Re:yes..

[jon3k]

Google is not HIPAA certified, period. ePHI is required by HIPAA to be encrypted both in transit and at rest (on disk). So unless you're encrypting your Google Docs somehow, you're violating the rule.

Re:yes..

[jon3k]

3rd party tools like this I assume

Re:yes..

[BitZtream]

..the google apps contract is fine. IAAL and i use google apps for all my stuff.

No you aren't.

A) I've seen you claim to be something else in another post

B) No lawyer would make such a blanket statement since there are many instances where Google very clearly is NOT legal to use due to confidentiality requirements. Nevada for instance requires any email with any sort of personal information (such as your address) to be encrypted and unavailable to third parties, which pretty much rules out using it in Nevada. HIPAA compliance is another place where it fails completely.

Nice job though, you've managed to get people to not notice that you are a logged in user and assume you are anonymous as well as actually believe your spew. I'm impressed.

Re:yes..

[Anonymous Coward]

If you had read the entire article....

Article not needed. The summary says clearly, "I provide IT services for medium-sized medical and law practices."

Nothing in there implies lawyer.

Re:yes..

[BitZtream]

You either aren't a lawyer, or you are a shitty one.

You aren't expected to maintain confidentiality, you are required to by law in most countries. Since the agreement with Google for using apps makes no guarantee of confidentiality at all, you'd be liable for any leaks right off the bat.

So again, you either aren't a lawyer, or you fucking suck as a lawyer.

Re:yes..

[linuxrocks123]

You can shout that as much as you want, but, until someone gets sued and loses, you're wrong.

Re:yes..

[Anonymous Coward]

IANAL but I know from first hand experience of a real lawyer terminating their cloud service development and deployment after a minor breach of confidentiality was evident that portended real lapses. YMBATL if you believe the vast majority of cloud services are sufficiently secure for even your own business, let alone the healthcare records of others. (You Must Be A Terrible Lawyer)

Re:yes..

[ValentineMSmith]

He just has to ask himself whether or not he feels lucky. I work with ePHI every day, and would NOT want to be the first person targeted with prosecution over that. Remember, HIPAA is a criminal statue, not just civil. Lawsuits would be the least of your worries if you ended out disclosing patient information.

Re:yes..

[jon3k]

Who's shouting? Look it's also illegal to rob banks but as long as you don't get caught, you're in the clear.

Re:yes..

[guyfawkes-11-5]

IAAL too and I see nothing wrong with Google apps. Don't know about doctors, but lawyers are perfectly aware that nothing is foolproof once you get online, and we realize that some Google employee has access to our stuff. We're expected to maintain confidentiality in a reasonable matter, not approach it with the paranoia of a computer security expert.

IANAL, but with HIPPA its apples and oranges.
I had done some with healthcare companies, and they use encrypted "dropboxes" and email for transferring sensitive files with PII. They rightfully take it seriously, especially since most patients are identified by their SSN.
I an somewhat surprised that attorney/client communication isn't be better protected, it seems sorta quaint.
Just so were on the same page re HIPPA:
http://privacy.med.miami.edu/glossary/xd_hipaa_sanctions.htm
violation penalties (HIPAA)
Per section 1177 of HIPAA, a person who knowingly
* uses a unique health identifier, or causes one to be used;
* obtains individually identifiable health information relating to an individual; or
* discloses individually identifiable health information to another person;
is in violation of HIPAA regulations. Such persons are subject to the following penalties:
* a fine of up to $50,000, or up to 1 year in prison, or both;
* if the offense is committed under false pretenses, a fine of up to $100,000, up to 5 years in prison, or both;
* if the offense is committed with intent to sell, transfer, or use individually identifiable health information for commercial advantage, personal gain, or malicious harm, a fine up to $250,000, or up to 10 years in prison, or both.
HIPAA also provide for civil fines to be imposed by the Secretary of DHHS "on any person" who violates a provision of it. The maximum is $100 for each violation, with the total amount not to exceed $25,0000 for all violations of an identical requirement or prohibition during a calendar year.

Re:yes..

[booris]

Since for instance AWS can offer HIPPA compliant services, I would not generalize and say that "hosted apps" cannot be used for sensitive data

Re:yes..

[Anonymous Coward]

[google employee #1] Gosh that checkout girl at the 5 and dime is pretty cute. Lets just have a look at...uh oh she has a site about herpes treatments in her google bookmarks...hmmmm....Hey that girl at Starbucks is pretty cute...

[google employee #2] That stupid brother of mine. He is about to mortgage his house to invest in a high risk venture entrepreneur-is-us.org... Maybe I will just have a quick look at their Google Spreadsheets....

While I am sure that Google has strongly worded and maybe even enforced policy's on this sort thing, is it something to count on?

disclaimer: I am a happy google docs user who's life is so boring I would be happy if someone would read my stuff :)

Re:yes..

[Anonymous Coward]

What your lawyer parents forgot to tell you is that lawyers use the services of all sorts of third party services, who agree and are duty bound to maintain the confidentiality of the information the lawyers entrust to them. My law firm's entire network is administered by a third party IT company. If you think there is something legally wrong with that, you need to talk to your parents again. We send out sensitive documents for copying, 40,000 pages at a time. You think any law firm on the face of the planet handles that in-house? You think the reprographics companies, who are intensely competitive for law firm business, are sitting around reading the documents? I tried a trade secrets case where the key trade secrets evidence consisted of dozens of over-sized engineering drawings. Not many law firms can reproduce those in-house. We hire scientific and accounting experts to review confidential information and serve as consultants. I use Verizon wireless, and clients leave voice-mail on Verizon's network. None of that waives attorney-client privilege or work product protections. Its not even a close call.

You also might want to tell your parents about the Stored Communications Act and the Computer Fraud and Abuse Act, both federal laws. (There is also a very broad California statute that I'm certain applies to Google.) Among other things, the Stored Communications Act makes it unlawful for a company to turn over your e-mail pursuant to a civil subpeona. In fact, there's a federal case out there that says you can sue a lawyer who serves a subpoena in blatant violation of this law. I was surprised by that case myself, so your parents should be wary if they are still practicing. On the other hand, your G-mail can be subpoenaed by law enforcement in a criminal case. But that is much less likely to happen, since those are not handed out like candy the way civil supeonas are. But then, those same criminal subpeonas can be sent to ISPs, phone companies, the list goes on.

Ultimately, all documents no matter where they are stored are discoverable unless they are subject to a specific privilege. And if they are privileged, using the services of a trusted third party who obligated to maintain confidentiality does not waive the privilege. And if someone tries to subpeona that information, the law requires notice and an opportunity to object.

Re:yes..

[Joe Wagner]

As they have explained it to me, once you voluntarily hand information off to an uninvolved third party, the veil of privilege is breached and it can be discovered.

IANAL, as well, but that statement is incomplete. You can clearly outsource at least one IT function: email, without risking privilege. Google's Postini is the the email service provider for many (most) of the nation's best and/or biggest lawfirms. (e.g. lookup the mx records of steptoe.com, chadbourne.com, perkinscoie.com, gibsondunn.com, bakernet.com, dlapiper.com, whitecase.com, sidley.com, mayerbrown.com). All *.psmtp.com.

Re:yes..

[Anonymous Coward]

but do they know, and *mind* that, too?

Re:yes..

[Anonymous Coward]

Actually, NO!!!!
I'm gonna give u an example.
Lets 'sppose, u made an Orkut profile - have picture in it. Now u joined Demonoid - with same Gmail ID. You see, ur orkut pic as its avatar. Inference - Demonoid is soo clever.
Now, 'suppose u made orkut profile, deleted it, then joined demonoid. Still u'll see ur last profile pic as its avatar. Fishy ???
Well, later I took some research on it & found somthing tht took me aback.
Anything & everything that u ever entered in google & its various services' profile info & details field - no matter u later updated, removed the info or deleted the service - they r still stored in their server && IS retrievable for _experienced_ users.
In these days, whr cloud computing emerging, various device syncing hav been standard - its been a challenge for how many days a regular user can maintain personal information confidential.

Re:yes..

[aimansmith]

Which bar? Do you happen to have a URL or other reference that the OP could check for his/her state (or show to clients)? On another point, a LOT of small practices (think sole practitioner or firm / practice with less than 5 people) use all-in-one domain services like GoDaddy or Yahoo! Domains for everything, including their email (I have absolutely no data to back up this claim, it's just based on the folks I've met who have small businesses). Given this, how is their email data any more private / protected than data hosted on Google Apps (let's leave the calendar out of it for now, since I think we can all agree that email is the item more likely to contain privileged info)? The provider can still be subpoenaed, and it's still susceptible to the same potential hacks. Since we're all geeks here, we all know what it would take to do it _right_ - physically secured personal mail server, everything encrypted, yada yada, but the cost of hiring someone to do all that may be prohibitive to a small firm, and it probably unnecessary besides; in my experience, the law (and IANAL) generally says that you need to take reasonable measures to protect your client's secrets. I, personally, think that Google Apps is fine for this, as long as your user base is educated in the obvious security concepts (i.e. use a separate, unique password for your Google corporate account) and potential risks (i.e. Google doesn't offer any guarantees AFAIK).

Re:yes..

[julesh]

Hmmm Virgin Media must have updated their T&Cs recently without notifying me.
They announced they're outsourcing all email to google.

"G. Your details and how we look after them
7. By having our services activated in your home and/or by using them you consent to our transferring your information to countries which do not provide the same level of data protection as the UK if necessary for providing the services. If we do make such a transfer, we will put a contract in place to ensure your information is protected."

(Virgin's T&Cs)

Re:yes..

[julesh]

Google's Postini is the the email service provider for many (most) of the nation's best and/or biggest lawfirms. (e.g. lookup the mx records of steptoe.com, chadbourne.com, perkinscoie.com, gibsondunn.com, bakernet.com, dlapiper.com, whitecase.com, sidley.com, mayerbrown.com). All *.psmtp.com.

Although it's impossible to tell whether they're just using the spam/virus filtering service or they're using the full service including message archiving. The former would be no problem at all from a subpoena point of view as google don't hold the messages after processing so would have nothing to produce.

Re:yes..

[speedtux]

UK business are not allowed to process personal data in the USA without express customer consent because its data protection laws fall short of ours.

US and UK privacy protections differ, but to say that the US protections "fall short" of UK protections is false. They have different aims, and I prefer the aims of US privacy protection to those of the UK and Europe, thank you very much.

I think you see the kind of myth you're repeating perpetuated by the UK government; anti-American rhetoric makes a great cover for pushing through an increasingly totalitarian agenda.

Re:yes..

[Tenebrousedge]

Yeah, well. You're an asshole and I've never seen you claim to be anything else.

Claiming an AC is a logged in user is pretty amazing, though. I guess I'm not drunk enough to be posting stuff like that on slashdot.

Re:yes..

[peterjb31]

Nope, instead they leave archives of the information on trains...

Re:yes..

[Anonymous Coward]

You're calling computer security experts paranoia? Are you kidding? It's just plain common sense.

I would never do business with a Lawyer who would outsource the storage of my confidential documents.

Re:yes..

[Anonymous Coward]

It seems some lawyers are more concerned with alleviating the blame than doing things the right way. Being an IT security consultant, I would never advise a client to send their sensitive data to a 3rd party, unless one of that 3rd party's purposes is to safeguard your data, such as an off-site tape backup repository.

If you have a secret you don't want anyone to know, don't tell anyone.

Re:yes..

[Anonymous Coward]

However, It is now common place for several large companies to "outsource" applications.. I think the issue appears to be cause its Google

Re:yes..

[bWareiWare.co.uk]

Like your ISP, your client's ISP, both of their backbone providers - and that is just best case.

Unencrypted email is not secure, ever.

Re:yes..

[chadplusplus]

(attorney w/s email w/s (hotmail or gmail)) and (ethical and confidential w/s communications w/s duty)

I haven't had to do any hardcore research in a few years so I may be a bit rusty. I just do title work and the partners are all in charge of the hard interpretations.

Re:yes..

[Anonymous Coward]

Here in Europe using stuff like that is absolutely not allowed for sensitive data, doctors, lawyers and governments are most certainly NOT allowed to use a hosted app like that.

My, how cosmopolitan...since (except maybe for lawyers) that's exactly how it is in the USA also.

Re:yes..

[Anonymous Coward]

but how can you evaluate that the security this "small" company has is better than google?
As an example its not the law firms core business, so having just your average run of the mill sysadmin running some windows and maybe linux server. Running a bunch of different service all requiring expert skill sets to maintain (email is an absolute nightmare).

I would think the risk of the law firm having an un-patched server, forgotten security hole, slack passwords is a much greater risk than going 3rd party where they have to guarantee and give you sla agreements (not sure if google offers this..) where their core business is data management ..

or?

Re:yes..

[rjh]

Unfortunately, you missed the part in my post where I said an uninvolved third party. If you're contracting with a firm that agrees to be bound by your rules, whom you are paying to do business on your behalf, etc., then they're an involved third party and what they do is covered under work product rules.

Google Docs, as I understand it, is different. From all that I've seen of Google Docs, it doesn't meet the standard. If you want to claim it does, the burden's on you to prove it. The analogies drawn to reprographics companies and the like are all inherently flawed -- as is all argument by analogy. Just because the law says X is legal doesn't mean something very close to X is okay, and in the case of reprographics and Google Docs they aren't very close to each other at all.

Re:yes..

[QuantumRiff]

do you give your clients email accounts on your server, and only communicate to them that way? Or do all of your clients only use their own, hosted server? Pretty much the entire internet rely's on third parties..

Re:yes..

[Joe Wagner]

IANAL, but that's not really true. They do have possession of email as it passes through. If I send Google a subpoena, then at least for 15-30 days they'd have to retain copies of all the responsive emails that they receive. But clearly that's not the case, otherwise I'd subpoena monthly the opposing party and get a continuous copy of their emails. Law firms can hire any number of outside agencies to handle privileged docs, e.g. paralegals from temp agency, graphic artists, etc and not lose privilege.

Re:yes..

[debrain]

IAAL too, and I use Google Apps. Indeed, one of the law societies with whom I'm admitted to practice (the Law Society of Upper Canada) encourages use of Google Docs for collaboration with clients and because it is better backed up than local documents.

Re:yes..

[Sun.Jedi]

You do that every time you pick up the phone. Or send a letter. Or do anything other than talk to someone face to face outside of the cone of silence.

FTFY. ;)

Re:yes..

[Anonymous Coward]

Agreed.

I work for a health care company. We do both outpatient clinics and insurance operations.

We too have numerous outside vendors. The main privacy issue one is dictation and transcription.

Sending the data out is not a HIPAA violation provided the contractor follows HIPAA. It seems that Google is just not willing to do that. Which is reasonable. They just don't want to deal with that shit. It would hinder them.

Re:yes..

[Anonymous Coward]

Whether it's a Google employee or your own IT staff, either one is equally able to leak your info. When making decisions like who to use to host your email/office apps, perhaps you should look at track records, and which party stands more to gain by leaking your info. I would submit Google has a LOT more to lose by leaking your info. than the office's IT staff.

Re:yes..

[ajs]

It doesn't take a "computer security expert" to know that you're unnecessarily risking your clients' confidentiality by sending your communications wholesale to a 3rd party.

And yet, it does take a computer security expert (or so it would seem) to realize that this is how modern businesses operate. Law firms, doctors, insurance companies and thousands of other companies have backup services; outsourced printing services for sealed cases and hundreds of other reasons to have to contract with third parties for the handling of sensitive data. Heck, your hospital probably goes through a dozen other companies just to run your bloodwork and store/backup the records.

You're coming very late to this party by suggesting that outsourcing sensitive data is a problem. See Slashdot posts from 5 years ago for many examples of companies figuring out (painfully) how to do this right.

Google is as good a choice for outsourced data as any. Apps is kept (painfully, from my point of view as a non-business user) separate from the rest of the Google infrastructure and has totally separate guarantees in terms of uptime (that is to say, any), service and confidentiality. They even have services for SOx compliance (through a third party) and long term archival policies.

Re:yes..

[ajs]

IANAL ... once you voluntarily hand information off to an uninvolved third party, the veil of privilege is breached and it can be discovered

I don't buy this. you might be right, but I think it's worth suggesting that an actual lawyer who has handled such cases should be consulted on this point.

Sure, if you hand your records to someone else causally (e.g. you CC the wrong person on an email thread) or you use a public mailbox for business communications, then there's no expectation of privilege. However, when another company is handling your internal email, I don't buy this at all. To say that that can be discovered is like saying that your leased office space can be searched because it's not owned by the law firm. Just not buying that at all, and legally it would be a very, very hard point to make.

Re:yes..

[Anonymous Coward]

You're 'unnecessarily risking your clients' confidentiality by using email. Or by using the US postal service. Or by using a courier. Or by writing something down. It's all a matter of how paranoid you want to be. Lawyers, apparently, have said it passes their muster and I think most common people would agree that they aren't concerned about a bored google tech digging through their emails.

Re:yes..

[debrain]

IANAL. My only legal credential is that I come from a family of lawyers and judges who are absolutely adamant about their moral obligation to preserve privilege.

As they have explained it to me, once you voluntarily hand information off to an uninvolved third party, the veil of privilege is breached and it can be discovered.

As they have explained it to me, anything you give to Google can be subpoenaed. Google is currently one of the most-frequently-served companies in the world, and Google gives full and enthusiastic cooperation with lawfully issued subpoenas.

If you really see nothing wrong with risking the privilege of your work product by putting it into the hands of a third party, and if you really see nothing wrong with making it discoverable via subpoena, then by all means use Google Docs. However, for my own sake, I refuse to deal with lawyers who use outsourced IT services.

IAAL, and I think the law of privilege is somewhat misunderstood, and easily confused with confidentiality. Here's how I describe it when asked to explain it in the legal context:

Privilege is the right of a person to not have their communications with their lawyer disclosed.

Confidentiality is the obligation of a lawyer to not disclose information.

In the case of privilege and outsourcing to a third party, where the client has not intentionally waived privilege and there is no expectation that privilege be waived (i.e. if a person tells their lawyer to publish information, the person explicitly waives privilege over that information), then the information being held by that third party is probably still under privilege and not admissible as evidence in Court. As a general rule, the client must either explicitly or implicitly waive privilege in order for the information to be admissible in Court, and using a third party document creation and storage system would not of its own accord give rise to such a waiver.

In the case of a third party being subpoenaed, there is generally a duty of that third party to notify the owner of the information (as the person whose rights are being affected), and indeed the person requesting the subpoena generally has an obligation to tell the owner of the information that they are seeking it. It would likely be an abuse of process and violation of constitutional rights to have information held by a lawyer about a client disclosed without due process (which involves at the least notice and the opportunity to respond in a meaningful way, notwithstanding those cases where the information is ephemeral - in which case disclosure should be made to an independent escrow lawyer pending resolution of any dispute over whether the information is privileged).

Confidentiality is a different kettle of fish. If a lawyer endangers the confidentiality of information, they may be liable for negligence or at the very least of losing their client. The duty of confidentiality could be breached where the lawyer stores documents online and negligently fails to diligently research the security of that online service provider, where the contract with that online document provider provides no warranty or guarantee, and the documents become public due to some technical default. However, as a general rule I am suspicious of conclusions that lawyers would be negligent (subject to the quirks of each jurisdiction's law relating to the professional negligence of lawyers) on the basis that they stored documents with Google, a massive multi-national company whose security team is vastly superior to that of virtually every law office.

In conclusion, storing documents on Google Docs does not waive privilege and any information obtained that way is likely not admissible as evidence in Court, and a lawyer is likely not exposing themselves to negligence simply by virtue of using Google Docs as one would expect Google's security to be quite good (particularly when compared to the complete lack of computer knowledge about security in most law offices).

Tha

Re:yes..

[Anonymous Coward]

Actually I know Amazon has HIPPA applications running on EC2.
I'd bet Amazon does as well.

Re:yes..

[nitehorse]

If any Google employee ever attempted to look up personal data in the fashions you just described, they would be fired so fast they wouldn't even know what happened. From my understanding, it is currently impossible to look up user data in these manners without setting off a whole ton of red flags, and all of those red flags mean "immediate termination."

Re:yes..

[rjh]

Look at the word "uninvolved" in my phrase "uninvolved third party," please.

In the case of an office lease, you hold a property right in the office space. In the case of hiring a company to handle X, you've established an employer relationship with them and the law is pretty clear on how that affect privilege (it's preserved; they're considered to be working for you).

The examples you're giving are good ones, but they're also examples of involved third parties.

Re:yes..

[Hurricane78]

And the companies that I will make contracts with aren't too.

It's like the banks that we hear about, that "lose" private data. You can bet that those clients and their friends won't ever use them again.

I for example never open a bank account, if I do not get at least HBCI 3.0 with a chip card for a class 2 terminal, and some powerful encryption.

Re:yes..

[kelnos]

Cool! I didn't even realize that asking questions like that was something that was ok to do. I'll certainly keep this sort of thing in mind if/when I need a lawyer. Thanks for the explanation.

Re:yes..

[caitsith01]

In the case of privilege and outsourcing to a third party, where the client has not intentionally waived privilege and there is no expectation that privilege be waived (i.e. if a person tells their lawyer to publish information, the person explicitly waives privilege over that information), then the information being held by that third party is probably still under privilege and not admissible as evidence in Court. As a general rule, the client must either explicitly or implicitly waive privilege in order for the information to be admissible in Court, and using a third party document creation and storage system would not of its own accord give rise to such a waiver.

IAAL too, albeit not an American. In common law countries, it is not as clear cut as your description makes it sound in the USA. If you convey information to a third party in circumstances which are inconsistent with the maintenance of privilege, then whether you intend to waive privilege or not it may well be that a Court will find that you have lost it in any event. Common law courts have a view which might be described as "you can't have your cake and eat it too" - i.e. if this stuff is too special and secret to be shared with your opponent, then you had better make damn sure your conduct with respect to the same is consistent when you are dealing with third parties too.

Giving Google access to your data for the purposes of marketing etc (which is presumably why Google really wants access) may well be inconsistent with the maintenance of privilege, at least in the UK, Australia and other common law jurisdictions.

Re:yes..

[caitsith01]

..the google apps contract is fine. IAAL and i use google apps for all my stuff. i DO maintain a separate backup but everything goes on google. the bar is also fine with it.

IAAL (who isn't posting anonymously). The Google Apps contract is not fine. For example, Google expressly reserves the right to fuck with your data, and potentially to report you to the powers that be if they don't like what they find:

Google reserves the right (but shall have no obligation) to pre-screen, review, flag, filter, modify, refuse or remove any or all Content from any Service.

Whatever soothing noises Google might make about the purpose of this, what matters is the words in the contract. The words in the contract are a problem.

Google's privacy policy should also set alarm bells ringing:

We may also use personal information for auditing, research and analysis to operate and improve Google technologies and services.

They also expressly state that they will share your data when 'complying with legal processes', which could include discovery:

We may also share information with third parties in limited circumstances, including when complying with legal process, preventing fraud or imminent harm, and ensuring the security of our network and services.

You are also reliant on Google's "good faith" interpretation of its own agreement:

We have a good faith belief that access, use, preservation or disclosure of such information is reasonably necessary to (a) satisfy any applicable law, regulation, legal process or enforceable governmental request, (b) enforce applicable Terms of Service, including investigation of potential violations thereof, (c) detect, prevent, or otherwise address fraud, security or technical issues, or (d) protect against harm to the rights, property or safety of Google, its users or the public as required or permitted by law.

Finally, Google washes its hands of protecting your information:

Unless you have agreed otherwise in writing with Google, you agree that you are responsible for protecting and enforcing those rights and that Google has no obligation to do so on your behalf.

Certainly the firm I work for would never in a million years put confidential client information of any kind on this system, nor would any of the serious firms we come up against.

Re:yes..

[dilute]

I love to jump in two days late... Anyway, who says REGULAR email is confidential? To quote Wikipedia: "e-mail messages have to go through intermediate computers before reaching their destination, meaning it is relatively easy for others to intercept and read messages". People stopped fretting about that years ago and basically accept the risk of interception of email en route. Risks of trusting Google are probably LESS than those resulting from routine use of unencrypted email, which is basically universal today in business and the professions. The vail of confidentiality is already fairly thin and I don't think using gmail or Google Docs makes it qualitatively any worse. If you have anything TRULY confidential you'd be nuts to put it in an email or for that matter any other electronic document, for a variety of reasons.

   

Re:yes..

[julesh]

IANAL, but that's not really true. They do have possession of email as it passes through. If I send Google a subpoena, then at least for 15-30 days they'd have to retain copies of all the responsive emails that they receive. But clearly that's not the case, otherwise I'd subpoena monthly the opposing party and get a continuous copy of their emails. Law firms can hire any number of outside agencies to handle privileged docs, e.g. paralegals from temp agency, graphic artists, etc and not lose privilege.

AIUI, in order to get a subpoena from a court, you must provide evidence that the party you wish to subpoena _already has_ the information you want from them. I don't believe it is possible to acquire a subpoena for information that does not yet exist. I also believe a subpoena can only force someone to reveal documents that they already have in their posession; it cannot be used to compel somebody to collect information that they would not otherwise collect.

Re:yes..

[nomadic]

As they have explained it to me, once you voluntarily hand information off to an uninvolved third party, the veil of privilege is breached and it can be discovered.

There's the key, in this case Google Apps wouldn't be an "uninvolved third party," it would probably be considered an agent of the user, and thus the privilege would be maintained.

As they have explained it to me, anything you give to Google can be subpoenaed. Google is currently one of the most-frequently-served companies in the world, and Google gives full and enthusiastic cooperation with lawfully issued subpoenas.

I believe Google gives notice that a subpoena is being sought, in which case it is not particularly difficult to get it squashed. "Your honor, this is outrageous; Plaintiff is actually issuing a subpoena in order to get attorney-client and work product-privileged documents. I move to quash the subpoena and for sanctions."

However, for my own sake, I refuse to deal with lawyers who use outsourced IT services.

If you're not dealing with a large firm, chances are you're dealing with a lawyer who uses outsourced IT services.

Re:yes..

[svtdragon]

I think you see the kind of myth you're repeating perpetuated by the US government; anti-terrorist rhetoric makes a great cover for pushing through an increasingly totalitarian agenda.

There. Fixed that for you. [1]

[1] See also: 43rd President of the United States; Darth Vader

Re:yes..

[kelnos]

I don't think the main issue here is the relative levels of security know-how between an in-house team (which I suppose often means "that guy over there") and some 3rd-party service. The idea is that once you give your data to a 3rd party, it's not under your control anymore. Even if Google's security is better than what your in-house IT guy can do, now any Google employee with access to the systems also has access to your data. In practice this may not be a big deal: hundreds of thousands (millions?) of people have their data up there, so you can always say, "why would they peek at my data over anyone else's?" ... but... the potential is still there. And in industries where there are strict regulations about the confidentiality of customer data, storing your data with a 3rd party might be a no-no.

Re:yes..

[debrain]

If you convey information to a third party in circumstances which are inconsistent with the maintenance of privilege, then whether you intend to waive privilege or not it may well be that a Court will find that you have lost it in any event.

Thanks for weighing in.

In common law countries, it is not as clear cut as your description makes it sound in the USA.

Incidentally, the USA and Canada are common law countries. That's not really relevant, except for the shared genealogy of privilege in the common law.

If you convey information to a third party in circumstances which are inconsistent with the maintenance of privilege, then whether you intend to waive privilege or not it may well be that a Court will find that you have lost it in any event.

This would be an implicit waiver of privilege. Even implicit waivers of privilege generally require some sort intention by the client to waive confidentiality. However, at least in Canada, I understand that so long as there is and has always been an intention by the client to maintain confidentiality, the information disclosed to a third party is inadmissible in Court.

It must be the client who implicitly waives privilege, and only they or a duly authorized agent (i.e. their lawyer acting within the scope of their instructions) could do that. It's not the lawyer who waives or loses privilege of course, but their client. If the lawyer acts in a way inconsistent with their client's instructions and privilege is deemed to be waived as a result of the lawyer's actions (i.e. outside the scope of the client's instructions) the lawyer may be liable for negligence.

On a related anecdote, I regularly retain third parties and disclose privileged information to them, including accountants, forensic analysts, engineers, specialist physicians, vocational experts, etc. Because they are agents retained by me (on behalf of my client) they veil of privilege extends to them. One must retain third parties for the purpose of expert reports, and often extend to them privileged information. That disclosure to the third party only waives privilege where the third party becomes an expert witness or submits an expert report - in which case they must disclose the basis for their beliefs (notably information given to them by the person who commissioned the report, including, it turns out, draft reports). If they are never called as expert witnesses or submit and expert report, the information disclosed to them remains privileged and is inadmissible - or so I understand.

Common law courts have a view which might be described as "you can't have your cake and eat it too" - i.e. if this stuff is too special and secret to be shared with your opponent, then you had better make damn sure your conduct with respect to the same is consistent when you are dealing with third parties too.

The roots of privilege stem back hundreds of years to the Norman Courts, and are grounded in the premise that in cases of adversarial disputes the system works better for everyone if there is an advocate who cannot be compelled to disclose the information and admissions of their clients. This principle is as ancient as it is simple and well founded, and one would hope not swayed in the digital era.

Giving Google access to your data for the purposes of marketing etc (which is presumably why Google really wants access) may well be inconsistent with the maintenance of privilege, at least in the UK, Australia and other common law jurisdictions.

It would be hard to imagine a Court ruling that the ancient doctrine of privilege be overturned because the information was stored with a third party that had a machine analyze it for the purpose of marketing to the lawyer. Would storing backup tape drives off-site at a storage site constitute waiver? What if those backup tapes had to be examined before they were stored? How is that different from the content-agnostic analysis that Google does of online documents for marketing purposes? It'd be interesting to know where the line starts and ends on that one.

Until a Court decides, one never knows!

The bottom line

[Samalie]

If you are in an industry where your internal communications/documents/etc should or must remain confidential, than you cannot trust Google Apps as your free platform for email/document creation/document storage.

If you don't mind the possibility that the world may get your data, then by all means feel free to use Google, or any other SaaS type offering.

Re:The bottom line

[Jurily]

Lazy sysadmin wants to compromise his company to work less. News at 11.

Re:The bottom line

[Anonymous Coward]

and an internal IT guy cant leak your data to the world ? you stupid or something ?
i trust google way more than internal IT staff with grudges.
and you can sue google without a eula type contract.

Re:The bottom line

[eln]

If you are in an industry where your internal communications/documents/etc should or must remain confidential, than you cannot trust any Internet-based system as your free platform for email/document creation/document storage.

FTFY. If your documents exist on the Internet, especially unencrypted, they won't be confidential for very long. Whether or not Google as a company is trustworthy or not is irrelevant. If anyone hacked into your Google account, they would have access to everything. If a random employee at Google decided to sell your stuff to a tabloid, there's nothing you could do to stop them until it was already too late. Without ironclad confidentiality agreements with real penalties for breaking said agreements, you shouldn't be trusting any third party with this stuff, and you certainly shouldn't have it on the Internet.

Re:The bottom line

[CharlyFoxtrot]

Lazy sysadmin wants to compromise his company to work less. News at 11.

Come on it's not just laziness. People use the Google apps at home, they do the job. It's no wonder they say "Why not use the same stuff at the office?" That's how MS got where they are after all, it also might be why they've got their panties in a twist over Google.

Re:The bottom line

[Anonymous Coward]

in fact (yeah yeah IANAL), it seems to me you're already breaking your own confidentiality agreement

Re:The bottom line

[Shakrai]

and you can sue google without a eula type contract.

You can sue the IT guy with a grudge too but that won't help you to recover your business reputation or lost clients after a data breach. Why the hell does everybody look at something and think that "we can sue them!" is some sort of plus anyway? I'd rather avoid being in the position of having to decide whether or not to file a lawsuit altogether, thank you very much.

Re:The bottom line

[HTH NE1]

Further, if you share data with an outside company, you don't have a reasonable expectation of privacy in that data anymore, and the government can subpoena that company for what it knows about you. Just like a lawyer engaging in communications with his client with a third party present, those communications are no longer privileged.

IANAL, I just watch fake ones on TV.

Re:The bottom line

[Orange Crush]

It's also hard to compete with "free."

Re:The bottom line

[jeffasselin]

Number of internal IT guys with systems access: 5
Number of Google employees: 3 billions

Chance to identify and sue the pants off the leaker if he's internal: 99%
Chance to sue Google and not get ass-raped by their robotic lawyers with laser eyes: Infinitesimal

Re:The bottom line

[spydabyte]

When you don't pay for something, you can't rely on it. Try winning a law suit against a patient because you didn't have the correct medical knowledge because your ISP couldn't resolve a Google DNS one day...

I'd think this is a much greater issue than worrying about Google email snoops. That and unecrypted standards over wifi access. Doctors: Don't go mobile. Stay within your cellular-free hospitals.

Re:The bottom line

[erikdalen]

For small businesses that don't have a full time sysadmin there's also risks running your own. It might fail and take long time to fix for example. And it might go for long times without security patches.

I suppose both those things are true for larger places as well with sysadmins overloaded with work :(

Re:The bottom line

[EdIII]

Not only did you not read TFA, but you did not even read the summary. Laziness has nothing to do with this at all. He is getting a lot of friction from his clients that don't understand HIS reservations about doing business with Google in this manner. He is concerned for their legal liability. Sounds like an IT guy that actually cares.

His question being posed to the /. community, is whether or not his clients have a point. Can we really trust Google with data that must remain confidential. Can he recommend Google services to his clients without fearing for liability later down the road.

Yeah, that sounds lazy to me....

Re:The bottom line

[Orange Crush]

And yes, it's lazyness: he's a sysadmin, and he knows the security implications. He just chooses not to care.

Of course he knows the security implications. His clients don't. And he can't force them to pay the (significant for a small office) costs of doing it "right." They'd simply stop being his clients.

Don't assume he's lazy, he's trying to do his best for his smaller clients and that's admirable. (I've often found the smaller the client the more of a cheap bastard and whiny high-maintenance client they tend to be)

Re:The bottom line

[CharlyFoxtrot]

MS got there with pure dumb luck, shady business tactics and buying out potential competitors.

Yeah it was dumb luck that put MS BASIC on every home computer in the 80's. Then they just stumbled into the professional markets with COBOL and XENIX and DOS on the IBM. We should all be so dumb.

And yes, it's lazyness: he's a sysadmin, and he knows the security implications. He just chooses not to care.

He cares, he points it out to his clients and then he'll roll out what they tell him too. Just like we all do. It's really an opportunity for Google, they could just offer a security and confidentiality guarantee for a low monthly fee. No less risky than trusting the consultant who comes to set up your shop.

Re:The bottom line

[WinterSolstice]

I would agree with this. I would *never* use a attorney who didn't take proper care of my confidential records. Those are more than just slightly sensitive.

Re:The bottom line

[Anonymous Coward]

which is why lexis nexis gets subpoenaed so many times.... oh wait, they dont. gee... with all that confidential legal strategy online at lexis
you would think they do. and using lexis breaks priv ... oh wait, it doesnt.
i know youre not a lawyer but please dont be an idiot as well.
using microsoft word or any other tool does NOT break priv, google apps is SSL encrypted and secure enough (Google Apps is SAS 70 Type II certified) that its not a problem. so is lexis, westlaw and the hundreds of other third party tools used by lawyers, some of which are local and some of which are hosted. stop with the ignorant bullshit already. you have a reasonable expectation of privacy BECAUSE THE CONTRACT SAYS SO and THE SERVICE IS ENCRYPTED IN THE NETWORK LAYER and THE SERVICE IS CERTIFIED TO AN INDUSTRY STANDARD (not important to you, important to a Daubert analysis).

Re:The bottom line

[commodore64_love]

>>>People use the Google apps at home, they do the job. It's no wonder they say "Why not use the same stuff at the office?" That's how MS got where they are after all
>>>

Actually Microsoft went in the opposite direction, hanging onto IBM's coattails which grew dominant in the office while Atari and Commodore were dominant at home (from 1980 to 1986). Then people started saying, "I want to bring my work to my home", and so they went and bought IBM PCs which became dominant from 1987 onward.

So MS went from office-to-home. I doubt the reverse strategy would succeed for Google, since most people don't do a lot of work at home - mostly they just copy whatever the office uses, i.e. Microsoft.

Re:The bottom line

[LoadWB]

The number of employees with access to the information is not as relevant as the potential exposure. When Google Apps et al have little "oops" moment which affects only "a subset of users" with the effect of exposing private data to unauthorized people, the effect is the potential exposure to billions of people on the Internet, including hostile governments, groups, etc.

I will not knowingly or purposely do business with anyone who puts MY information at risk like that. It is bad enough that in some cases I do not have a choice -- communications companies, card processing companies, creditors, etc. -- but when I do have the choice, I choose no, and it is about damned time that these companies get smart about our objections.

This is my primary objection to a national smart-grid, which will be prime for the picking, especially when the Administration is dragging its heals on cybersecurity. What a wonderful idea: we put your electrical usage habits online for you, for your convenience, and for the convenience of anyone else who wants a shot at viewing your usage habits to determine when you are home, gone, and for how long. And one little "oops" is all it takes to reveal your private information to someone. But you can rest easy knowing that only a small subset of users will be affected.

The scenarios are actually pretty frightening when considered, and in the interest of budgets and paying for something NOW NOW NOW, security will, and does, often take a back seat, if any seat at all.

But why should you care? You do not have anything to hide, right? Wrong. Your habits are extremely valuable to those who would take away from you, be it property or life. Additionally, every time your security is compromised, a company upstream has to shell out money. That company has to recoup its losses and generally does so by increasing your costs, if you do not already pay for this in your fees. So when you get re-issued three Visa check cards because someone did not secure your information, know that you are paying for it in the end.

Re:The bottom line

[JerRocks]

Half the world works for Google now?

And another number for to weight in your list:

Chances your internal IT guys know more about securing your data than Google engineers: 5%

Yes, my number was pulled out of my ass too.

Re:The bottom line

[Abcd1234]

Number of Google employees: 3 billions

Jebus... they must've *really* reduced their employment standards...

Re:The bottom line

[chadplusplus]

Lexis vs. GoogleApps, lets compare.

Lexis: search terms and results associated with client numbers

GoogleApps: entire documents and communications

Oh, I think there's a difference there, but maybe I just use Lexis differently.

Re:The bottom line

[moonbender]

3 billion? I knew China and India were up to something.

Re:The bottom line

[CharlyFoxtrot]

Actually Microsoft went in the opposite direction, hanging onto IBM's coattails which grew dominant in the office while Atari and Commodore were dominant at home (from 1980 to 1986). Then people started saying, "I want to bring my work to my home", and so they went and bought IBM PCs which became dominant from 1987 onward.

And yet the only reason they were there to be noticed by IBM at all was because their BASIC was on all the home computers including those very Atari's and Commodores. And the C64's BASIC was essentially the computer's OS (to the user at least).

Re:The bottom line

[Darinbob]

You don't sue the leaker in this case, you sue the entire medical or legal firm, even if it was a Google employee who was the leaker. Granted the firm could turn around and sue Google in return, but they're certainly not off the hook themselves.

Re:The bottom line

[Anonymous Coward]

Exactly!
Until Google has the ability to work with encryption, it isn't trustworthy for certain files.

I'd love to see a prompt appear for me to enter, say, a Truecrypt password that will decrypt my files on their end then open it in spreadsheet for example.
But all of this will cost huge resources on their end, so it would probably have some cost associated with it.
And with all the scare of SSL attacks recently, i wouldn't really trust transmitting important information over the net either, especially if your job depended on it.

It is all a huge mess... screw the Internet and the Web!

Re:The bottom line

[memnock]

wait... stuff like that is news now?

Re:The bottom line

[Anonymous Coward]

Number of internal IT guys with systems access: 5
Number of Google employees: 3 billions

Chance to identify and sue the pants off the leaker if he's internal: 99%
Chance to sue Google and not get ass-raped by their robotic lawyers with laser eyes: Infinitesimal

That smug feeling that comes with "I told you so!": Priceless.

Re:The bottom line

[Anonymous Coward]

This is an incredibly important point..

From the Lawyers perspective, the fact that the information is accessable to (and that the lawyer KNOWS it is accessable to) google employees can negate privilege in legal cases, or at least weaken it noticably.

For HIPAA, you have to know who has your data and that its secure, if your data is travelling across the interwebz unencrypted, youre going to fail an audit. Do you know what googles backup practices are? do you know where your PHI is?

I've worked in IT in both the legal and healthcare markets and these are important issues that small business owners really should pay attention to.. I had to advise my own Divorce lawyers to refrain from using GMail accounts when communicating about my case..

Re:The bottom line

[Anonymous Coward]

Actually he is not the one that wants to use the Apps it's his customers. He is doing do diligence and asking a panel of questionably attentive people what their opinion is. Please pay more attention to detail.

Re:The bottom line

[blackraven14250]

Number of chances for inhouse data examination: 2 per day

Number of chances for Google employee to see data: 3 googols per day

Re:The bottom line

[Anonymous Coward]

The really interesting scenario is if you have an issue with your Google account to the point where you have to have Google tech support intervene. At that point you'll definitely have some unwanted exposure of your data to the said Google employee. Last I knew employees to whom you are entrusting your private data to don't have to pass any sort of non-standard background checks like their public service counter parts would have to.

Re:The bottom line

[dotc]

That's the annoying thing - my patients ask for my email address all the time.

I decline, explaining email isn't appropriately secure for health communications... and get the "Come on, get into the 21st century, you luddite!" response. Particularly from the Blackberry crowd.

But everyone posting at slashdot is "I wouldn't go to anyone who isn't super safe."

Sadly, most patients aren't like that...

Re:The bottom line

[mgblst]

Except that Google would have in place systems to stop any old employee from accessing that information, maintain complete logs. A lot of small companies do not, anyone can access.

Re:The bottom line

[Simetrical]

Further, if you share data with an outside company, you don't have a reasonable expectation of privacy in that data anymore, and the government can subpoena that company for what it knows about you. Just like a lawyer engaging in communications with his client with a third party present, those communications are no longer privileged.

IANAL, I just watch fake ones on TV.

I'm also not a lawyer, but this sounds totally wrong to me. If you give some info to a third party, the government can subpoena that third party no more or less than they can subpoena you. Even if I don't have a reasonable expectation of privacy if I give my mail to Google (which seems unlikely to me), Google certainly still has a reasonable expectation of privacy with respect to the mail it hosts. The government isn't allowed to just read Google's mail without following due process, same as if you hosted it yourself.

Anyway, in medicine, the worry isn't really about the government snooping on your data. It's about private parties.

Re:The bottom line

[Dan541]

MS got there with pure dumb luck, shady business tactics and buying out potential competitors.

Noting shady about smart business practices.

Re:The bottom line

[Anonymous Coward]

This seems simple.(or maybe I am?)

Some industries cannot legally use stuff that doesn't abide by certain laws.(as he said, HIPPA) I haven't checked, but I'd doubt google apps would abide by those laws.

On the other hand, problems should be looked at in perspective.

What's the difference between a Google employee being able to read some of your data, and a part time or temporary employee being able to do the same? While we in IT like to think that our bretheren are honest, there are plenty who just want to make as fast a buck as they can, and don't care one iota about their company's data privacy. Granted, they SHOULD, and should be fired if they don't protect it, but when an admin is on vacation, who is taking his place? Does he know what he's doing in security matters? Is he very competent? Is he honest? Remember when the AOL guy sold a big list of AOL screennames to spammers some years ago? AOL didn't get sued, but they lost a lot of customers when spam increased dramatically. And if someone in a health care company sells their info, good luck! Or if an investment house employee sells customer data, and those customers get identity theft, it's not good.

To me, it's kind of like governments: How good a government is depends on the people in it. Crooked people, or extremely selfish people cause governments to be terrible. Honest, caring people cause governments to be good. (Told you I was simple)

Re:The bottom line

[Anonymous Coward]

You convinced me at ass-rape, who cares if they have laser eyes. As in the immortal word of the back up vocals in the Chris Roc song "No sex in the Champagne room", DON'T WANT THAT, NO [in ref to guys w/ pierced tongue].

I am lazy as in I didn't bother to log in MaDdcOWw

Re:The bottom line

[greg1104]

Just because you do pay for something that doesn't mean it's automatically reliable either. Your odds of a hard drive crash in a given year are a few percent; if you're relying on electronic medical information, that will leave you just as vulnerable to not having it available when you need it as if Google's service isn't up for some window of time. Hardware and software fail, files get corrupted, and services become unavailable; all you can do is compare the statistical likelihood of your data not being around at a given time. Whether Google's service is on average more or less reliable than a local one is pretty complicated to determine if you fairly account for all the ways even a locally hosted system can die.

Re:The bottom line

[turbidostato]

"And yes, it's lazyness: he's a sysadmin, and he knows the security implications. He just chooses not to care."

A sysamdin is not in the position to care. He is, at most, in the position to assess and then do as ordered.

Re:The bottom line

[demonlapin]

I can't speak for the high maintenance aspect, but the cheap bastard? Absolutely. A big corporation makes money, it gives it out to employees and vendors and shareholders, everybody gets a piece. A small business makes money, every single nickel of it belongs to the boss - except he has to pay the employees, vendors, and tax man himself. OF COURSE they're cheap - $50K is nothing to a big corporation, but it's the difference between driving a Honda Accord and a BMW 7-series to a small businessman.

Re:The bottom line

[jon3k]

You call it smart business I call it anti-competitive (and the EU agrees).

Re:The bottom line

[TheSkyIsPurple]

Even if MS has signed an NDA with your company?

Re:The bottom line

[Anonymous Coward]

Actually Microsoft went in the opposite direction, hanging onto IBM's coattails which grew dominant in the office while Atari and Commodore were dominant at home (from 1980 to 1986). Then people started saying, "I want to bring my work to my home", and so they went and bought IBM PCs which became dominant from 1987 onward.

So MS went from office-to-home. I doubt the reverse strategy would succeed for Google, since most people don't do a lot of work at home - mostly they just copy whatever the office uses, i.e. Microsoft.

It did go the other way where I once worked. We were well settled on WordPerfect and 1-2-3. The support area's policy was that you were entitled to a half hour of help on non-supported apps and that was it.

But the weenie managers all had PCs at home with Word and Excel. They came in and started meowing that they didn't like WP and 1-2-3 any more. Management caved and replaced the good stuff with MS crap.

Later, our IT department was outsourced to a division of IBM (ISSC, now mercifully dead) -- we all kept our jobs and desks, just a different company name on the paychecks. Things were re-evaluated. Guess what -- we somehow arrived at a "vote" on the IBM stuff, which included AmiPro (pardon me while I go retch for about five minutes) and 1-2-3, both of which were owned by IBM. Somehow, the policy became, "Buy the one that doesn't say Microsoft on the box."

Re:The bottom line

[Anonymous Coward]

And yes, it's lazyness: he's a sysadmin, and he knows the security implications. He just chooses not to care.

No, true laziness is being too lazy to use a spellchecker to find out how "lazyness" really should be spelled.

Re:The bottom line

[theLOUDroom]

Sometimes you just have to say "no."

People in all sorts of fields get offered money to comprimise themselves every day.
You need to determine where the line is and stick to it. Doing someting stupid because someone else paid you doesn't automatically restore your reputation or protect you from legal liability.


Try read a welding forum somtimes. Someone will show up and want a hole in their gas tank welded. The welder will say "no". Then every so often you read about the guy who said yes and died.

It all comes down to professional ethics. When that little voice in your head says "I shouldn't be doing it this way." STOP. Sure, there's always someone out there willing to pay you to do the wrong thing, but that's no excuse for your own actions.

Make the case for doing it the right way. If they refuse, look for work elsewhere.

Re:The bottom line

[Anonymous Coward]

I'm a healthcare business consultant and speak to small to medium sized physicians practices and hospitals. I have a very popular course that I teach on electronic health records, and 1/2 hr of that course is explaining to physicians exactly where they are at risk with wireless network data breaches at home, airports, and public hotspots, and with internet service providers, and with blackberry and iPhones.

Running Wireshark on a projector and poaching passwords sent in the clear and instant messages and the like is enough to leave a room silent.

Re:The bottom line

[Anonymous Coward]

I'd think this is a much greater issue than worrying about Google email snoops. That and unecrypted standards over wifi access. Doctors: Don't go mobile. Stay within your cellular-free hospitals.

Way too late. Lots and lots of modern medical equipment uses WiFi. "Cellular-free" was largely for the bad old days of analog mobiles that did interfere with the equipment.

Re:The bottom line

[Anonymous Coward]

There's nothing wrong with weldng a gas tank if you know what you're doing.

Re:The bottom line

[Boomerang Fish]

Having worked as consultant helping companies prepare for Sarbanes and HIPPA compliance, I can tell you that both require regular reports and testing to be performed by management ensuring that their controls are in place to prevent (preferred) and/or identify an IT guy who leaks such data. With Sarbanes-Oxley, an external auditor also performs the testing and the results are sent tot he SEC and included in any public inquiry about the financial status of your company. I assume something similar is done WRT to HIPPA, but so far I haven't actually had to work on the final reports, just the initial testing we perform to help the company figure out what they have to do to become compliant.

With proper controls in place, said IT guy would be prevented (ideal) or detected during such a disclosure, even if not immediately. Impossible for IT to get around? No, but damn difficult to do with leaving a trace, assuming proper controls concerning segregation of duties, isolation of production data from development teams, and proper system reporting.

Adding Google Apps brings in a whole separate entity for which you can employ NO controls, and who have publicly stated they won't guarantee the safety of your data. There are outsourcing companies that meet the requirements for SOX and HIPPA, and they can provide documentation (SAS70 comes to mind, but others exist too) generated by outside federally licensed auditors reporting on their status regarding such controls over their access to YOUR data and access to YOUR sensitive information. From Google's public stance on your data security, I sincerely doubt that they have undergone such auditing (or if they have, failed miserably).

So, if you trust Google more than your IT staff, then it's clear you've never undergone an external audit.

That said, if you have undergone an audit and failed it in any significant way, then the risk may be similar. But properly controlled environments are VERY difficult to steal or leak data from without leaving some sort of trail.

The audits aren't perfect but they're a hell of lot better than what Google has so far provided.

--
I drank what?

Re:The bottom line

[Anonymous Coward]

What on earth make you think companies do not pay for Google Apps?

And besides, this whole discussion is paranoid and ridiculous.

With this level of paranoia, no lawyer or doctor (or any other company for that matter) could NEVER outsource any IT.
Nor could they send computers in for repair. Nor use internet for anything.

Re:The bottom line

[j-beda]

The government isn't allowed to just read Google's mail without following due process, same as if you hosted it yourself.

I think the idea is that (for the most part) the government is not allowed to read your email with your lawyer AT ALL, since lawyer communications (and some doctor, priest, etc.) are privileged. If you "break privilege" then those communications might be easier to obtain from the "prosecution" point of view. Similar rules are in place for non-criminal legal stuff to protect some of your private communication from the person suing you (or being sued by you).

Re:The bottom line

[jeffasselin]

Nah, they just cloned their actual employees a few times over.

Re:The bottom line

[commodore64_love]

Yes Microsoft had produced BASIC for Apples and Commodores (no not Ataris - Atari Basic is not MS-related), which was great for a small company. But if IBM had chosen TI-DOS instead of MS-DOS, then we'd all be talking about the monopoly held by Texas Instruments. IBM was the center around which 1980s offices revolved, and eventually (1987 onward) the IBM and PC clones won the home market too. Whoever was picked by IBM was just lucky enough to be going for the ride.

>>>And the C64's BASIC was essentially the computer's OS

Not really. Virtually all programs erased BASIC and used the freed-up space to run their own operating system. Or no OS at all (like games which went straight to the hardware). Even common users recognized that MS-BASIC was pretty worthless and typically erased just seconds after startup.

Re:The bottom line

[caitsith01]

And what exactly would LexisNexis have which would be remotely relevant to a particular client of a law firm?

Re:The bottom line

[theLOUDroom]

There's nothing wrong with weldng a gas tank if you know what you're doing.

Fundamentally this is true. The problem is the significant number of people who both:
1) Think they know what they are doing.
2) Get killed anyways.

Re:The bottom line

[Anonymous Coward]

re: "He is concerned for their legal liability. Sounds like an IT guy that actually cares."

Yes, he might 'care' .. but 'caring' without the guts to stick up for what you know to be the right, legal, and safe way of doing things is suggestive of a person without a lil thing called 'backbone'.

It's his JOB to protect his lawyer clients from serious vulnerabilities that are preventable! It's the LAW that describes professional responsibilities to clients personal data! It's the LAW that says the lawyer's client data is NOT discoverable! It's the LAW that says Google and any other 'outsider' CAN be forced to reveal private data! It's the LAW that allows Google to be bought by some other business entity that has NO responsibilities at all, in a practical sense, to protect that data.

If you worked for me and i found that you were this 'wishy-washy' on this incredibly important matter, I would do two things: I would fire you. and I would discover if you are , in fact, a party to criminal distribution of your client's client's data, and I would report you to the Bar, at the least.

j. anderson, md
tkjtkj@gmail.com

Re:The bottom line

[Anonymous Coward]

This is a very good point.

I have practiced in the area of IT Security and Privacy for a very long time.

Simply put it boils down to the agreed terms and conditions.

Here is the problem that no one seems to have touched upon:

It is all fine and dandy to simply say that the contract says so. In most cases this will suffice. However where we run into issues is in dealing with cross jurisdictional boundaries.

The US Patriot act give the US authorities an complete unprecedented level of power to access information without having any consent of the information owner. If you are a lawyer or doctor practicing outside the US. The US authorities can still access your information if it is hosted on google or any other US based service, or ANY SERVICE ANYWHERE, where the data is accessible FROM the US.

This is a MAJOR consideration when you may be bound be privacy laws of other countries such as the Canadian PIPEDA or the UK DPA.

Simple answer. If you deal with sensitive client confidentiality, the risk becomes the US government. Not the service which is hosting your information. In most cases this shouldn't be an issue. In a specific case it may. Each case needs to be evaluated on it's own merits.

Google Apps is a great service for most. I switched my own stuff to it and saved hours and hours of headache maintaing mail servers and associated infrastructure. However, I would never advocate any client who deals with highly sensitive information to use this service. The risk of confidentiality being broken under a foreign legislation is far too great.

The only solution is to keep your data within your own jurisdictional boundaries.

Re:The bottom line

[Ritchie70]

A history of searches made by a lawyer or firm.

Slashdot layout broken AGAIN

[koreaman]

Why does the story header appear *red* instead of the usual green? (Firefox 3.5 on Vista)

Re:Slashdot layout broken AGAIN

[Anonymous Coward]

Why does the story header appear *red* instead of the usual green? (Firefox 3.5 on Vista)

Yeah, Seen that too. Opera 10 Beta, Windows XP Professional Sp2.

Back to actually posting...
I'd say, force them to use the proper means, I knows it is kinda hard to, but if you go ahead and tell them to use Google Apps, and then happen to get audited, or someone claims that the information has been leaked, then the chopping block usually will fall on the IT's head for not providing enough security.

Thats just my two cents.

Re:Slashdot layout broken AGAIN

[rnaiguy]

I think the YRO section always has the red border, just like games always has the blue/purple border.

Re:Slashdot layout broken AGAIN

[Scrameustache]

Why does the story header appear *red* instead of the usual green? (Firefox 3.5 on Vista)

It does that when the story is brand spanking new, I think. It means you're getting the freshest of slashdot's offerings, rejoice!

Re:Slashdot layout broken AGAIN

[Anonymous Coward]

I usually see it on stories with no (or nearly no) comments to entice suckers like us to read and post.

Re:Slashdot layout broken AGAIN

[master5o1]

Actually it's to tell people that they have a chance at getting a first post. Though, it is still unlikely because that damned Anonymous Coward always gets it. Damn Anonymous Coward and his super fast reflexes to Red stories.

Re:Slashdot layout broken AGAIN

[master5o1]

Some stories are red to show that they were posted by a communist.

Re:Slashdot layout broken AGAIN

[Red Flayer]

Why does the story header appear *red* instead of the usual green? (Firefox 3.5 on Vista)

Totally off-topic, I know. But it irks me that when we bring up a display issue, our reflex is to mention our browser AND our operating system.

Just goes to show that we are nowhere near any kind of usable standards for browsers like the kind that's been envisioned for a decade (or more!).

Re:Slashdot layout broken AGAIN

[Anonymous Coward]

Because it is a RED ALERT. You are supposed to have your shields up and you need to report ready at general quarters. Hurry up - and shut off that damned noise!

Re:Slashdot layout broken AGAIN

[selven]

I think Slashdot is warning him about corrupting a pristine open source Firefox release with some dirty Microsoft system.

Re:Slashdot layout broken AGAIN

[onemorechip]

Yes, it's a red flag alerting those looking to make frist psot.

No

[gweihir]

Confidentiality is very, very important to businesses and individuals, even more so in the Internet age. One of the reasons to continue to operate your own infrastructure, no matter what the current hype is.

Yes

[Anonymous Coward]

Well, I can. But not the idiots screaming 1984.

If you can e-mail info

[AvitarX]

I would think Google apps is fine.

Re:If you can e-mail info

[chiguy]

To expand a little:

Remember that email is unencrypted and is sent through random routers across the internet. Someone sniffing at an intermediate router can intercept your communications. So you should not send sensitive material via email.

Some argue that it's unlikely someone can get all of your email, citing the needle/haystack argument. This is true, but the router risk is highest at your facility and the recipient's facility, where it would be much easier to sort.

The greatest risk, though, is whoever is running the recipient's mail system, be it google, yahoo, microsoft, or some minimum wage IT guy.

And don't forget, if you're an AT&T customer on the west coast, the NSA has a room sniffing/storing EVERY PACKET going through AT&T's data center. So it's pretty much guaranteed that at least they see your emails.

So logically speaking, if you don't encrypt your email and use email for communication, then Google Apps is fine for similar information storage.

Re:If you can e-mail info

[AvitarX]

Thanks, and I wasn't really trolling.

HIPPA requirements should...

[Nutria]

immediately squelch any such thoughts.

Re:HIPPA requirements should...

[Daniel Dvorkin]

Yes, everyone should be worried about a nonexistent law.

There is a law called HIPAA that might possibly have some bearing on this too, and as it happens, that one's real.

Re:HIPPA requirements should...

[Anonymous Coward]

Umm... This isn't as much a no-brainer as you may think. HIPPA compliance is a bit muddier than that. I worked for 3 years at a company handling patient data covered under HIPPA, and as long as you claim a company is a business partner of yours, make them aware of the HIPPA status of the data they're entrusted with, and get them under NDA, you are pretty free to entrust your data to them. (Our co-location service provider pretty much had unhampered access to our patient data if they wanted it.) I'm sure if a medical practice was willing to ask Google for an NDA to cover their patient data, and access their site over SSL, I don't see why HIPPA would prevent them from using Google to manage their medical business data. Can someone confirm if google offers gmail and google docs over https? and if google will sign an NDA for those services if requested?

-Anonymous for obvious reasons. (Cheers)

Re:HIPPA requirements should...

[zuperduperman]

I agree with you when it comes to actual confidential patient data.

However HIPAA only applies to what is considered 'PHI' - data applicable to individual patients relating to their health.

There is an awful lot of other business that goes on even in a medical practice that doesn't contain this kind of information. Why not consider Google docs for this stuff? They totally suck as office software but on the other hand, they are tremendously useful - almost revolutionary - for their collaboration features. I can't see why a business couldn't use them as long as they have clear policies about when and where such use is appropriate.

Re:HIPPA requirements should...

[DragonWriter]

However HIPAA only applies to what is considered 'PHI' - data applicable to individual patients relating to their health.

Specifically, the privacy and security provisions of HIPAA (which aren't the only mandates under HIPAA) are addressed specifically to the protection of PHI.

Re:HIPPA requirements should...

[blackraven14250]

you claim a company is a business partner of yours

Without a contract, unlikely to be able to prove it.

make them aware of the HIPPA status of the data they're entrusted with

Have fun with that one.

and get them under NDA

Why would Google negotiate with a one-doctor office on terms of a NDA, again?

Re:HIPPA requirements should...

[hab136]

>Why would Google negotiate with a one-doctor office on terms of a NDA, again?

They could, and should set up a standard contract and NDA if they want to service this market.

por que?

[Em Emalb]

From here: http://docs.google.com/support/bin/answer.py?answer=82366&ctx=sibling

"
Privacy and security: Understanding section 11.1 of our Terms of Service
Print
We've received questions over time about the meaning of section 11.1 of our Terms of Service. We realize that for those not familiar with legal agreements for services that use the Internet, these terms can look confusing, or even frightening.

The first thing to understand is that this language doesn't give Google ownership rights to your data. You, and you alone, own your content. Whether you wish to keep your content totally private, or share it with the world, that's your choice.

However, in order to honor this choice, Google Docs needs permission to display your content as you see fit. This is what we mean by a "license to reproduce." We need to ensure that when you click the "Publish document" button, or use the "Invite collaborators" option, we have the license to carry out your wishes. It is this agreement, between Google Docs and you, the user, that section 11.1 of our Terms of Service reflects."

Why would you even chance it? That's their EXISTING terms of service, but as always, those terms are subject to change without notice.

I can't imagine that HIPAA would allow this.

Re:por que?

[Anonymous Coward]

you can use google apps without google docs. HIPAA is fine with it.
you would chance it because [a] you cant afford to run an IT dept, [b] your internal admin which you hire for little money can steal your data and is more likely to, [c] you can sue google. google apps is ideal for small businesses. you dont need to use the docs component at all. you can keep patient records internally on a off the shelf NAS box costing less than $500 with encrypted drives and use email for communication.

Re:por que?

[DragonWriter]

you can use google apps without google docs. HIPAA is fine with it.

Maybe, maybe not. The HITECH Act (which is really part of the recent federal stimulus law, the American REcovery and Reinvestment Act) and the Guidance issued under the HITECH Act requires that for HIPAA protected health information (PHI) to not be considered "unsecured", information in motion must be protected under appropriate FIPS 140-2 approved standards (for use of TLS, that's NIST Special Publication 800-52, Guidelines for the Selection and Use of Transport Layer Security (TLS) Implementations), which (as well as restricting which of the avaialable cipher suites for TLS are acceptable--notably, not RC4) also provides for the use of client certificates for authentication and states that server implementations should not accept connections without them, rather than falling back on alternative authentication mechanisms like username/password. The HITECH Act requirements, and the specific standards referred to in the guidance, are rather new as specific mandates with regard to HIPPA PHI, and I am rather suspicious of anyone who, without presenting any analysis, simply says that HIPAA raises no problems with Google Apps being used for HIPAA PHI.

Re:por que?

[hkmwbz]

We need to ensure that when you click the "Publish document" button, or use the "Invite collaborators" option, we have the license to carry out your wishes.

Um, why do they need that? You give them a "license" them moment you click the "publish" button!

Need to assess more than one criteria

[Anonymous Coward]

It might be an acceptable compromise. The same clients considering Google Apps are 99.999% likely to have a non-existent or ineffective backup/archiving system, lack the expertise/cash for sysadmining Microsoft enterprise apps and would probably benefit from being able to log in on multiple machines to access their data. All strategies involve risk - if you veto Google, they may be missing out on the best compromise solution. YMMV.

Re:Need to assess more than one criteria

[Anonymous Coward]

Google is not bound by the same laws as lawyers and doctors and data which is stored on Google's servers is not protected by the same laws as data on the computers of lawyers and doctors. It is one thing to have to trust someone who works on systems with confidential data. It's quite another thing to move the data off-site.

Re:Need to assess more than one criteria

[bitemykarma]

It may very well be an acceptable compromise. However I do not agree with your argument because, a lot of Google Apps' potential clients do, in fact have backup systems, can sysadmin Microsoft, or even real "enterprise" apps, and can already log in on multiple machines to access their data.

But a lot of people see this as a way to break their lock in to Microsoft, and to save money.

Re:Need to assess more than one criteria

[westlake]

The same clients considering Google Apps are 99.999% likely to have a non-existent or ineffective backup/archiving system, lack the expertise/cash for sysadmining Microsoft enterprise apps and would probably benefit from being able to log in on multiple machines to access their data

Then when you need to do is form an IT co-op or partnership with a larger, stronger, organization that has the experience and resources to it right. Which is something the HMOs and government agencies are probably going to force on you anyway.

Say hello to your lawyer

[PolyDwarf]

This is slashdot, not legaldot.

That being said, your writeup sounds like you're a contractor/have your own company. If that's the case, the best you can do (Outside of telling your customers you aren't going to and being fired) is make very clear, in writing, what your opinion is, and get them to sign off, in writing, that they are responsible and/or have another way for handling confidential info, etc.

I'm not sure if that's enough to cover your butt or not. See first sentence about this is slashdot, not legaldot. I would consult with a lawyer, preferably one that is not one of your customers.

Re:Say hello to your lawyer

[Red Flayer]

It's been said before:

If you're response to an Ask Slashdot submission about $X is "Ask a lawyer about $X", then you should rewrite the Ask Slashdot question in your mind to "What should I know before I talk to a lawyer about $X?"

Lawyers are expensive. Community knowledge can e very helpful in reducing the amount needing to be spend on legal fees, and I'm sure plenty of Slashdotters have good insight that can help the submitter.

For my part, all I can say is that I wouldn't use a doctor if I knew they used Google Apps. There's too much risk that an employee at Google might let loose the secret of my debilitating suppurative penile encrustations.

Re:Say hello to your lawyer

[Red Flayer]

Oh crap. The cat's out of the bag.

Unsubmit! Unsubmit!

Re:Say hello to your lawyer

[PolyDwarf]

Yeah, but when your question directly revolves around a question of law, it does kind of beg the question that lawyers should be your first stop. Especially when you know enough to know the name of the law (in this case, HIPAA). A quick google search would lead you to www.hipaa.org, and there's a handy-dandy menu on the left with all sorts of stuff to know.

The guy already knows enough to know this is a Bad Idea (tm), so it was more an Ask Slashdot about "Hey, I know this is a Bad Idea (tm), but is there any way I can weasel out of it being a Bad Idea (tm)?"

And as for your penile encrustations... That sounds like another Ask Slashdot question.

Re:Say hello to your lawyer

[aztracker1]

I have to agree... simply get a liability release, that they are responsible and have made decision X. Then do what they have asked.

Re:Say hello to your lawyer

[Anonymous Coward]

I'm not sure if that's enough to cover your butt or not. See first sentence about this is slashdot, not legaldot. I would consult with a lawyer, preferably one that is not one of your customers.

It's a damn shame the laws can't be written in non-double speak, non-open-to-interpretation, non-legalese, and just plain old English. Imagine not needing lawyers...

Re:Say hello to your lawyer

[Anonymous Coward]

I award you no points for your failed attempt at humour.

Re:Say hello to your lawyer

[PhunkySchtuff]

For my part, all I can say is that I wouldn't use a doctor if I knew they used Google Apps. There's too much risk that an employee at Google might let loose the secret of my debilitating suppurative penile encrustations.

Yes, and just think of the "targeted advertising" you'd be receiving for this problem...

Re:Say hello to your lawyer

[scheme]

I'm not sure if that's enough to cover your butt or not. See first sentence about this is slashdot, not legaldot. I would consult with a lawyer, preferably one that is not one of your customers.

It's a damn shame the laws can't be written in non-double speak, non-open-to-interpretation, non-legalese, and just plain old English. Imagine not needing lawyers...

It's a shame that programs can't be written using plain old english or some other language. There's some obscurities present but a lot of the reasons laws and legal terms are complicated is because they end up having to deal with complicated situations and odd cases that arise in real life.

Re:Say hello to your lawyer

[Anonymous Coward]

I already uploaded all data about your suppurative penile encrustations to Wikileaks, you insensit.... wait

Signed, Your Insensitive Clod

Re:Say hello to your lawyer

[Anonymous Coward]

Ah! So that's why they call you "Red Flayer"!

Re:Say hello to your lawyer

[Anonymous Coward]

For my part, all I can say is that I wouldn't use a doctor if I knew they used Google Apps. There's too much risk that an employee at Google might let loose the secret of my debilitating suppurative penile encrustations.

No problem -- your little secret is safe with just us and your girlfriend in the know.

Haha!

[Anonymous Coward]

If web apps are ever farmed out to foreign servers, you can kiss your privacy goodbye. If the government requests any data off the servers and weasels around the usual search warrant limitations, you're on your own.

Give them fair warning

[Lonewolf666]

Tell them about what could happen, and that the risk may be low but not zero. Because data have been exposed through sloppiness before, not only through malice.
Then make sure YOU are not liable if they violate HIPPA or something similar. Either don't support their Google stuff or make sure you have documented that they use Google SAS against your advice.

Re:Give them fair warning

[hedwards]

Hosting this sort of thing off site on a service that's not really intended for HIPAA or similar is a recipe for disaster. It's not that Google is necessarily untrustworthy, it's that they're not promising to comply with the requirements under those laws. And they're certainly not going to be liable should anything go wrong that puts the firm or the IT department in breech of those particular laws.

Re:Give them fair warning

[GMFTatsujin]

That's one way to frame the argument, and it's a good one.

I'd stress to them that HIPAA PHI standards require the company -- AKA your bosses -- to be able to vouch for the security of the entire pipeline of information flow. It's not an issue of "they're not interested" or "the chances are low." It's an issue of minimizing the holes in the pipeline.

Google does not offer anything like PHI-compatible security. They are a big hole in the secuirty, whatever the chances or interest are. One could argue that the world's largest indexer of information, who makes the results of those indexes freely available to the public, is the antithesis of security.

If your bosses are serious about health care, they're not going to be idiots about it. (They may chose to be idiots about other things. Probably not this.)

Re:Give them fair warning

[Tokerat]

If a patient sues a provider because information leaked somehow, and it is discovered that information was obtained through HIPAA negelgence, the doctor's next question will most certainly be "Would you like to make it a combo meal?"

Seriously, the courts will strip him naked.

Re:Give them fair warning

[DragonWriter]

If a patient sues a provider because information leaked somehow, and it is discovered that information was obtained through HIPAA negelgence, the doctor's next question will most certainly be "Would you like to make it a combo meal?"

Seriously, the courts will strip him naked.

Well, except that HIPAA doesn't create a private cause of action which would allow a patient to sue in the first place.

Re:Give them fair warning

[DragonWriter]

I'd stress to them that HIPAA PHI standards require the company -- AKA your bosses -- to be able to vouch for the security of the entire pipeline of information flow.

Unless you are being paid as a HIPAA compliance consultant rather than an IT consultant, its not your job to tell them what HIPAA requires and, chances are, you don't really know what your client's status is under HIPAA and what the specific obligations they have under the various HIPAA rules. You certainly should raise the issue, if you think HIPAA or some other domain-specific privacy law applies to them, that it is out there and they have the responsibility to be certain that the business requirements they give you reflect their obligations under that law at any others that may apply, but you also shouldn't pretend to be qualified to advise them on what those rules are unless you really are competent to do that. If you aren't your client's lawyer, you shouldn't be giving them legal advice.

Re:Give them fair warning

[GMFTatsujin]

HIPAA makes no distinction between a compliance consultant and an IT consultant. If you're getting paid to work on a project related to health care and patient information, HIPAA requires you to be aware of the implications of information transmission.

That's the *whole point of the law that is HIPAA.*

Giving legal advice is one thing. Bringing attention to areas of your expertise that carry implications for HIPAA is another. IT professionals know about how technology affects the flow of information. We have a responsibility to our employers to put that knowledge to use on their behalf.

Re:Give them fair warning

[DragonWriter]

HIPAA makes no distinction between a compliance consultant and an IT consultant.

HIPAA doesn't have anything more than tangential to do with consultants. If you are being paid as an IT consultant, its not your job (and, unless you have unusual expertise outside of your field, not something you are qualified to do) to advise your client on legal requirements, whether HIPAA or anything else.

That's the *whole point of the law that is HIPAA.*

No, actually, its not; first of all, what you propose with regard to IT consultants responsibilities with regard to privacy isn't even part of the HIPAA or its associate rules, and second of all, privacy and security aren't even the whole (or even main) point of HIPAA. The main point of the Health Insurance Portability and Accountability Act is to make healthcare delivery more efficient and improve access to healthcare by both imposing mandates regarding the transferrability of health insurance, promoting the use of electronic transactions rather than paper to perform insurance-related functions, and mandating that those electronic transactions be in standardized formats to promote interoperability. The HIPAA privacy and security rules are secondary to that primary purpose; the exist largely to mitigate the fear of decreased privacy associated with electronic records that were, at the time HIPAA was adopted, seen as major barriers to public support for the adoption of the data systems HIPAA hoped to encourage the use of to streamline the administrative side of healthcare (they apply beyond the electronic data systems, of course, but that's their motivation.) The privacy and security rules are important HIPAA mandates, but they aren't the whole point of HIPAA.

If you're getting paid to work on a project related to health care and patient information, HIPAA requires you to be aware of the implications of information transmission.

No, in fact, it doesn't. If you are a contractor to a HIPAA covered entity (which it is the entities, not your, job to discover) and if you may be exposed to PHI in the course of that activity, HIPAA does require the entity itself to put you under a business associate agreement (BAA) that binds you to the requirements that apply to the covered entity with regard to protection of PHI. Additionally, the recently-passed HITECH Act makes the security requirements with regard to PHI directly binding on a contractor under a BAA to a covered entity (so, if you are considering taking a job that would require a HIPAA BAA, you have an obligation to understand the requirements of HIPAA with regard to PHI so that you can apply them to your own handling of PHI.)

But, it is not your job to tell your client what rules HIPAA imposes on them, its their job to tell you that as it applies to the requirements for the systems you are building for them. Once they have done so, it is your job to use your technical expertise to explain to them the implications particular implementation options have with regard to those requirements.

Giving legal advice is one thing. Bringing attention to areas of your expertise that carry implications for HIPAA is another.

Yes, exactly. Telling them what HIPAA requires them to do is the first. Telling them how various options impact the requirements they have communicated to you, including any that are based in HIPAA is the second. My point is that an IT consultant's job is to do the second, not the first.

HIPAA compliance is no joke.

[MarkvW]

If they wanna do it, they gotta get a lawyer--a lawyer who knows HIPAA. HIPAA compliance is a pain--and noncompliance can be very expensive.

Lawyer costs may even outweigh the Google savings

Re:HIPAA compliance is no joke.

[ArsonSmith]

Biggest problem is Doctors like to think they are above the law. I worked in IT for a hospital chain and trying to explain that they can't do that is nearly impossible.

Re:HIPAA compliance is no joke.

[chiguy]

If they wanna do it, they gotta get a lawyer--a lawyer who knows HIPAA. HIPAA compliance is a pain--and noncompliance can be very expensive.

Lawyer costs may even outweigh the Google savings

Really?

As far as I know, NO ONE HAS SUCCESFULLY SUED FOR HIPAA VIOLATIONS. (Of course, I do hope someone Googles me wrong)

When you go to the doctor, you sign a waiver that pretty much waives all your privacy rights. Doctors and other medical providers/institutions have to protect your information. Sure. But they are allowed to send your information to third parties to help "manage your health" or "process billing" or "collect payments" or all sorts of things.

These third parties ARE NOT REQUIRED to follow HIPAA, as they are considered non-covered entities. This means once your info goes to billing for processing, your privacy is based on contracts with your provider and social embarrassment.

Even if you didn't waive your rights, how exactly do you prove that (1) your information was negligently released (2) it was your health care provider who did it and (3) you were damaged in some way.

That's a lot of hoops to go through to prove your case, and probably not worth hiring a lawyer (or rather, not worth a lawyer's time to take your case on commission).

I always laugh when I hear about the dreaded HIPAA requirements. And think of origami tigers.

Re:HIPAA compliance is no joke.

[DragonWriter]

As far as I know, NO ONE HAS SUCCESFULLY SUED FOR HIPAA VIOLATIONS.

Since HIPAA doesn't create a private cause of action for violations, only the federal government can enforce HIPAA rules generally (sometimes, under state laws, the fact that a disclosure is in violation of a federal law like HIPAA, or of a assurance or agreement mandated by HIPAA, may, with other factors, meet the standard for some private cause of action under state law, but the action won't be for a HIPAA violation, per se.) To date, AFAIK, none of the HIPAA complaints received by the Department of Health and Human Services' Office of Civil Rights (which enforces HIPAA) have resulted in monetary penalties being assessed, but most of them do result in OCR requiring business practice changes on the part of the entity against whom the complaint was lodged. A few do get referred to the Department of Justice for criminal prosecution, though I believe that, to date, no prosecutions have been made on HIPAA charges alone (sometimes HIPAA charges have been part of a broader criminal complaint.)

But they are allowed to send your information to third parties to help "manage your health" or "process billing" or "collect payments" or all sorts of things.

These third parties ARE NOT REQUIRED to follow HIPAA, as they are considered non-covered entities. . This means once your info goes to billing for processing, your privacy is based on contracts with your provider and social embarrassment.

There was a time when that was at least generally true (where a business associate of a HIPAA covered entity might not be liable the way a covered entity was if it was not itself a covered entity), however, the recently passed HITECH Act (part of the American Recovery and Reinvestment Act of 2009 [ARRA], Pub.L. 111-5) both added additional security requirements that apply to HIPAA covered entities and extended both the existing and new security requirements on HIPAA covered entities, including the civil and criminal penalties for violations, to apply to those entities' business associates to the same extent as to covered entities themselves. (see ARRA, Title XIII, Subtitle D, Sec. 13401; codified at 42 U.S.C. Sec. 17931.)

Re:HIPAA compliance is no joke.

[surfcow]

Google for this phrase: HIPAA violations in the news

I get 172,000 hits.

Re:HIPAA compliance is no joke.

[TheMCP]

HIPPA non-compliance can not only be expensive, it can lead to jail time.

This is my understanding based on training I received from a lawyer while working as a secondary IT director for a medical school:

The IT director for a medical organization is required to certify that the organization is HIPPA compliant. If they are not, the IT director must make them compliant, and that may have to mean simply cutting off everyone's access to computer resources until a plan is in place to allow access in a compliant manner. (Not allowing anyone to access anything is compliant.) If the IT director certifies them to be compliant when they are actually not, the IT director can go to jail, as can anyone who may have coerced them to sign the certification. Medical professionals can also be subject to fines and/or jail time for handling data in a non-compliant manner (such as entering data into a non-compliant system such as google docs), especially if they did so knowingly.

Were I in anonymous reader's shoes, I would tell my medical clients that I am convinced that because of HIPPA they must not use Google Docs for any medical information. If they press the issue I would tell them that I am so convinced that they must not use Google Docs to handle any medical information that if I find they have done so, I will drop them as a client and report them to relevant authorities at once. No job is worth going to jail for.

Re:HIPAA compliance is no joke.

[Anonymous Coward]

I do not see how you could possibly use google apps and maintain HIPAA compliance.

Tricky HIPPA...

[Annwvyn]

As a Paramedic, I can say that HIPPA is extremely strict and will, if violated, force your license to be questioned as well as cause fines to be pushed your way. Honestly, doing ANYTHING outside of a secured network or a patient care medium (i.e. Pyxis, Temsis) with privileged, confidential information will plant a bullseye on your back. It is just not worth risking it. I can guarantee that an expert data thief is going to be more skilled and knowledgeable at computers and networking than any physician I know.

Re:Tricky HIPPA...

[Daniel Dvorkin]

True enough -- and as an anonymous coward pointed out, many (perhaps most) in-house networks aren't going to be secured all that well either. Allegedly HIPAA-compliant systems might satisfy the lawyers, but I have to say I'm deeply skeptical that the standard of privacy they actually provide is all it's cracked up to be ... or any better than what Google can do.

Re:Tricky HIPPA...

[Annwvyn]

I would have to agree with you that HIPPA's standards and their ability to provide for the people are pretty flimsy. However.... the risk you put on your license and career, as well as the fines that you can accrue if you violate HIPPA, are very real. It isn't so much whether you should follow HIPPA because it is the right thing to do and they are all-wise... you should basically follow it to cover you rear.

Re:Tricky HIPPA...

[aztracker1]

Ask them if they'd be willing to put all their bank account information, and their related logins and passwords, including savings, 401K, and other investments, along with their social security number, and their address into google docs/apps.

Re:Tricky HIPPA...

[Anonymous Coward]

As someone who has studied HIPAA, you are full of it.

First, you need to be a covered entity.

Second, you just need to: " take reasonable steps to ensure the confidentiality of communications with individuals."

Since google is not a covered entity, much of the regulation won't pertain to the data on their systems.

This is how parties removed, but paid by, covered entities get away with accessing actual data.

As long as you maintain HIPAA compliance on the data while in your control, you are fine. Assuming you are a covered entity

Re:Tricky HIPPA...

[bragr]

This may be the best answer to your needs, tell them this, and they suddenly question just how secure it is, and its that seed of doubt that you can use to turn them off of this idea.

Re:Tricky HIPPA...

[StevisF]

I used to work in IT at a medical school and your characterization of HIPAA is not accurate. HIPAA is not strict at all unless you've intentionally divulged protected health information. Your employer is going to a lot worse things to you (i.e. fire you) than any federal prosecutor.

Re:Tricky HIPPA...

[Annwvyn]

Though it may be true that they might be less strict then I am laying out, I am not willing to gamble my license to practice, certifications, OR my jobs on it. The words "they MIGHT prosecute me" is good enough for me.

Re:Tricky HIPPA...

[Anonymous Coward]

As a senior IT employee in a 3000+ hospital ( my career for the last 15+ years ) I can say that HIPAA is not extremely strict and if ...

really ?

know anyone ... anywhere ( and I dont mean the Farrah Fawcett story ) fined ? Me neither.

Plant a bullseye - by who ?

You sure live in a different world than I do.
Did you know that the root origins of Hippa have nothing to do with secure data - right ? ( look up the acronym meaning )

=

Re:Tricky HIPPA...

[CodingHero]

I'm not a security expert, but if the bad guys know that a lot of lawyers and/or physicians keep records at Google, then they need only break Google's security scheme to get access to this confidential data. While a larger number of small in-house networks may be less secure individually, is it reasonable to presume that it would be more difficult and/or time consuming to defeat a number of different security schemes than to just defeat one and have access to all sorts of provate information?

Put another way, what I'm saying is analogous to the argument that there exist more known viruses and security flaws for Windows machines simply because they take up a vast majority of market share and the potential payoff is much bigger and worth the time needed to break said security. Maybe OS X and Linux are just as insecure as Windows, but its easier and more "profitable" to break into the large number of Windows systems with which the majority of people trust their data than to try to spend time breaking into someone's Mac as they comprise a rather small percentage of all users.

Bottom line is that it seems that storing such confidential information at Google, and then advertising it via articles and forums like this one, makes Google a bigger target and puts more people at risk in the end.

Then again, I'm one of those people who thinks cloud computing isn't such a great idea...

Just accept it

[scoile]

Your role, as a qualified member of the IT staff, is to make the higher-ups aware of the risks. Do your due-diligence, tell them the data isn't secure (in person, in e-mail, and maybe even on paper), and remind them from time-to-time (using creative new analogies whenever possible). That's it, you've done your job.

The fact of the matter is, regardless what the policy is, and regardless what they all "agree" on, they're going to put sensitive information on the Web. You'd have to take away their Internet access and portable devices to prevent it, and even then, they'd just go home and use that.

Accept that the best you can do is educate them and provide alternatives.

Re:Just accept it

[FlyingBishop]

You can't put confidential information in the hands of sysadmins who haven't signed off on the requisite forms. Unless Google is willing to certify that all people with any access to your data or the hardware on which it sits takes the requisite classes and signs HIPPA non-disclosure forms with regard to your data, you can't sign off on such a move.

Even then, I would expect that access is restricted to a reasonably small group of people (for a small doctor's office no more than the 5 or 6 you might have on-site.)

Re:Just accept it

[Anonymous Coward]

and remind them from time-to-time (using creative new analogies whenever possible).

Let me help you start off. As everyone on /. knows, taking a chance on a HIPAA violation is like driving a car with a stumbling carburetor and marginal braking capability ....

Re:Just accept it

[Anonymous Coward]

re: "The fact of the matter is, regardless what the policy is, and regardless what they all "agree" on, they're going to put sensitive information on the Web. You'd have to take away their Internet access and portable devices to prevent it, and even then, they'd just go home and use that. Accept that the best you can do is educate them and provide alternatives."

Fortunately, that plan not only is NOT 'the best' one can do, it is an ILLEGAL act to have any role in the circumventing of HIPPA requirements. Passive 'advising' such as you suggest is not a topic included in the law: there is no such exception. If you are a party to your clients' illegal and irresponsible acts, then you are equally at risk for fines and/or jail time.

Email is not confidential.

[Anonymous Coward]

You don't use email for confidential information.

That is the biggest problem is that users think that email SHOULD be confidential. it is not.

Re:Email is not confidential.

[hedwards]

Precisely, that's why my healthcare providers only use it to notify me that a message has been received. I have to log in to their site via SSL if I actually want to read the information. There are still risks, but with a properly secured DNS server and the appropriate measures to make sure it isn't a forgery, it's as secure as you can get.

Re:Email is not confidential.

[John Hasler]

Email could be confidential if people would use encryption.

Re:Email is not confidential.

[Kazoo the Clown]

It seems to me that this should be underscored. The heck with gmail, EMAIL is not guaranteed to be sent encrypted or in any way secure. If you're sending credit card info, passwords, personal health information, or ANY info you can't afford to have random strangers read, you SHOULDN'T be using email for it, PERIOD.

Re:Email is not confidential.

[John Hasler]

While email rarely is encrypted it certainly can be.

Re:Email is not confidential.

[Dan541]

Email should be confidential, the fact that it is not does not change the matter.

Postal mail is considered confidential so of course it's electronic equivelent gets the same line of thinking.

Can I find out the names of the doctors you work f

[Anonymous Coward]

I'd like to report them to the regulatory commission that enforces HIPAA rules.

Seriously, read up on HIPAA and get them to follow HIPAA rules, otherwise huge fines could be coming their way.

Just because a doctor hands out those privacy pamphlets doesn't give them the green light to ignore or circumvent the privacy and security rules. Claiming ignorance is not an option.

Get them off of gmail and google apps and put them on systems and networks that you can effectively apply controls too.
You have no control over the security and privacy controls in place within google apps thus you can't effectively satisfy the HIPAA rules.If they do not want to do an internal networks with servers, outsource it all to a data center that is HIPAA compliant and where you control the servers both physically and logically.

Good luck and hire yourself a partner or subcontractor that does HIPAA and SOX regulatory consulting. You could hire me but I'm $350/hr.

No difference

[Anonymous Coward]

Frankly there is very little difference between individual employees at Google having access, and individual employees of a firm's IT consultant (or employees of the firm itself) having access. Yes, you might not, as a firm, know the identities of the relevant individuals at Google, but you probably don't know the identity of everyone who works at your IT consultant either. Oh, and Google has much, much more to lose if it becomes apparent that confidentiality has been compromised.

The bottom line is, Google doesn't have to provide an absolute assurance of confidentiality. It just has to be at least as good as what firms get now. In my view, that's not a particularly high bar.

Re:No difference

[hedwards]

Google, is that the same Google that lost a lot of data a couple years back? I'm not really suggesting that they're not to be trusted, but they have lost data in the past, and as unlikely as it might be, it could happen again. Not to mention the fact that they allow access through insecure methods to the data.

Re:No difference

[jaymz2k4]

I'd have to agree with this. The minute people start to use non-internal staff & resources to provide information infrastructure you're implicitly trusting that the company as a whole will protect your data.

I'd just as well trust Google with my mail data & docs than yet another consultancy that provides core IT services.

The bottom line is who do you trust. The best option in my opinion, which has been mentioned plenty before, is let your clients know what you think, give them the (quantified) risks and what (if any) violations of policy it would entail and let them decide. Then make sure its in a signed agreement.

Proper legal advice would also be the order of the day when you've done as much research that you can on your own (i.e., stuff like this)

Re:No difference

[John Hasler]

Outsourcing the handling of confidential data can be ok if and only if you
a) Qualify the provider by doing a thorough investigation
b) Get them to sign (by a corporate officer, not a salesman) an ironclad
      contract with indemnification and hold-harmless clauses.

It'll be cheaper to hire staff and do it yourself (and there's no way you'll get that contract out of Google).

HIPAA??

[Anonymous Coward]

You're gonna give up HIPAA info to the cloud? Sounds like a great way to end up in jail.

For corporate business I might be fine with using google apps, but I would never mess around with HIPAA-sensitive data... both for moral and for legal reasons.

wanted: client side encryption

[Anonymous Coward]

What is missing in todays solutions is encryption on the client side so that the mail/calendar/photo/storage site cannot access the users own data. Question is, what will the "free it" providers gain by implementing that? I believe this can best be pushed by political means, forcing these kinds of requirements upon the providers.

An idea to make this work

[MarkWatson]

Amazon published a white paper about using their AWS platform with HIPAA compient applications: basic idea is to keep data encrypted until it is in memory, and encrypt it again before writing to persistent storage.

For Google Apps, how about using rich clients that decrypt data for viewing/editing, and encrypt it again before storing back on big table, etc.

Perhaps Google themselves would implement this as browser plugins?

Re:An idea to make this work

[AnyoneEB]

Google could do this. Using IBM's algorithms which were on Slashdot recently, it might even be possible to keep everything encrypted on the server and only decrypt on the client so the data is safe even if the server is compromised. (Note: That was an article about a new and experimental cryptographic algorithm which may not be ready for serious use yet.)

There is a problem: Google wants to show ads and encrypted data gives them no clues about what ads to show. If there is really a market for it, then maybe they should develop a paid version with encryption that a business could trust. Another possibility would be a Google Docs appliance to be put behind the company's VPN. (Or does that already exist?)

Re:An idea to make this work

[Anonymous Coward]

Like HTTPS?

Re:An idea to make this work

[Anonymous Coward]

No?

Engage your brain before posting, thanks.

Re:An idea to make this work

[Monkier]

This does exist as a browser plugin for Google Calendar: http://www.ibm.com/developerworks/web/library/wa-googlecal/

Re:An idea to make this work

[Anonymous Coward]

For Google Apps, how about using rich clients that decrypt data for viewing/editing, and encrypt it again before storing back on big table, etc.

Rich clients, you mean like Office?

Perhaps Google themselves would implement this as browser plugins?

Who maintains the keys/security? If it's Google, you're back to square one.

If keys/security options are maintained onsite, you'd still need a local IT resource (the exact reason people use Google).

Re:An idea to make this work

[dkf]

There is a problem: Google wants to show ads and encrypted data gives them no clues about what ads to show.

It's not a problem, because...

If there is really a market for it, then maybe they should develop a paid version with encryption that a business could trust.

A number of other cloud providers have been doing exactly that for a while now, so it wouldn't be at all surprising for Google to do it as well. Of course they'd have to charge for it, but to claim that doing otherwise is better is deeply disingenuous. To expect to get a high-quality service for nothing is... deeply optimistic.

Another possibility would be a Google Docs appliance to be put behind the company's VPN. (Or does that already exist?)

They don't appear to have done yet. But whether or not they do one is more likely to be a business decision and not a technical one; the technical and legal requirements most certainly can be satisfied. (Whether they can with their current infrastructure, no idea...)

Re:An idea to make this work

[Locklin]

That's basically what FireGPG does, at least for email.
1. It's awkward and breaks a lot of the "features" of web-apps.
2. Google will never implement it or make it easy as it would prevent them from harvesting information (their business model).

Re:An idea to make this work

[AnyoneEB]

Yes, of course. Sorry, I did not mean to imply that Google should be expected to be give away services for free without advertising.

Re:An idea to make this work

[DragonWriter]

Amazon published a white paper about using their AWS platform with HIPAA compient applications: basic idea is to keep data encrypted until it is in memory, and encrypt it again before writing to persistent storage.

And unless that white paper was published after (and took into account) this year's HITECH Act and the subsequent Guidance under that act, its probably leaves out a lot of critical concerns. Before the HITECH Act and the Guidance, there were basically no concrete, specific requirements that had to be met for HIPAA security compliance; there were vague requirements to protect data at rest and in motion, for instance, but no real standards on what protection was adequate. The HITECH Act and the Guidance issued under the Act specified fairly particularly what must be done with PHI for it not to be considered "unsecured", as well as imposing notice requirements when PHI is exposed "unsecured" and expanding who is legally responsible for violations of HIPAA security standards.

Google appliance in the office?

[MartinSchou]

Far as I know the Google Mini Enterprise comes with all of the apps you need.

And since it's a local server, I suspect it'd still qualify for your confidentiality needs the same way any other local server would.

Re:Google appliance in the office?

[Anonymous Coward]

The Google Mini (http://www.google.com/enterprise/search/index.html) is a search appliance. It will not run mail/apps.

Re:Google appliance in the office?

[Anonymous Coward]

I was about to suggest something similar. A local server running google applications is the answer. Just like our computers running installed native software.

Re:Google appliance in the office?

[Anonymous Coward]

Really people mod this guy up. The clients of interest on this really need to stop trying to be cheap and at the very least use this. It supports email and policy settings and runs locally. It will save money over having an IT guy maintain servers but I think the first step is to call Google corporate sales and ask about compliance. They are doctors for christ sake, do they really have cash flow problems that would prevent $50 yearly per user?

Re:Google appliance in the office?

[Anonymous Coward]

I don't think so. That's a mini search appliance for local data. It isn't hosted Google Apps.

Re:Google appliance in the office?

[Anonymous Coward]

Google Mini only does search, not email, etc. And it's licensed by how many documents you can crawl, index and search. You still need Google Apps (hosted, per seat per year) for email and more. Their Postini features a heck lot more stuff for the Enterprise (ie. companies with extra needs, not your home consumer). Backup, security, etc.

Put it this way: you either trust your confidentiality and security with Google or trust your IT department and their freshly minted MSCE cert with your confidentiality (hahaha), and security (more hahaha).

But if you're a competent admin that gives a damn and can run your own servers properly, Google Apps isn't for you.

Caveat: IAAGEP (I Am A Google Enterprise Partner).

Re:Google appliance in the office?

[DrEasy]

Are you sure? It seems to me that only their search appliance is run on a local server. Google Apps are still only hosted at Google, unfortunately. Your link doesn't say otherwise.

Have you read this on Google?

[tenchima]

Question: Is Google Apps HIPAA compliant?

http://www.google.com/support/forum/p/Apps%20Partner/thread?tid=4d6f74d03de056c7&hl=en

Some interesting points raised.

Of course, it may have been you who originally asked this question Google in the first place...

Re:Have you read this on Google?

[Anonymous Coward]

Question: Is Google Apps HIPAA compliant?

http://www.google.com/support/forum/p/Apps%20Partner/thread?tid=4d6f74d03de056c7&hl=en

Some interesting points raised.

Of course, it may have been you who originally asked this question Google in the first place...

I like the authors contradictions:

Google doesn't certify or identify Google Apps as being compliant with any specific set of regulations.

Google Apps is SAS 70 Type II certified.

Re:Have you read this on Google?

[Anonymous Coward]

isn't SAS 70 a standard, and not a set of regulations? The $foo regulations may say that SAS 70 audits mean this or that, but that doesn't mean the statement "We are SAS 70 type II certified" is the same thing as saying "We certify that we do not violate $foo regulatory requirements".

If my lawyer used Google Apps, I'd get rid of him.

[Animats]

No lawyer can legitimately use Google-hosted services, unless they're doing work for Google. It would be a huge violation of confidentiality.

In Silicon Valley, where many lawyers are doing work adverse to Google, absolutely no way would this be tolerated. Even Microsoft Windows Update makes some lawyers nervous.

Do you abandon confidentiality for Google apps?

[Chuck Chunder]

That's a better question.
Their policy suggests not.
Perhaps a Google engineer somewhere can "read your stuff" but only in the same sense that you could as the person administering your clients mail. Is that a worry? I'd expect Google have a lot more to lose if such a privacy breach happened than you, their whole apps hosting business would evaporate.

That said, if there are specific legal requirements for your industry you'd need to evaluate on those specific requirements not on what a random guy on Slashdot thinks.

Re:Do you abandon confidentiality for Google apps?

[John Hasler]

> Perhaps a Google engineer somewhere can "read your stuff" but only in the
> same sense that you could as the person administering your clients mail. Is
> that a worry?

Yes, because that engineer is not contractually obligated to you to keep the stuff confidential. Neither is Google.

Ever read a EULA?

[porkThreeWays]

When you click "Accept" on many EULA's you give up rights to privacy of your data to that company. What's the difference if it's hosted or not. Microsoft can just as easily have Exchange phone home with data as Google employees can read your mail. There's no difference. You just have to decide which company you trust most.

Re:Ever read a EULA?

[Anonymous Coward]

I guess you've never heard of a closed network.

Re:Ever read a EULA?

[Tynin]

I dislike MS as much as the next /.er but if your company allows your Exchange server to call home to Microsoft, for anything other than patching, your network admin needs to be fired.

Re:Ever read a EULA?

[geekoid]

YOu do ralize that since they own the OS(MS) they can have it do whatever they want, and not let you know.

Re:Ever read a EULA?

[maharb]

This is misinformation. Exchange doesn't send all your e-mails to a Microsoft server where employees could read it. Companies can also harden their servers and information to their choosing which is far different than a web portal access that is easily 'hackable'; mainly with social engineering.

Now you may not trust Microsoft products and that is fine but to say the security and privacy level of corporate run exchange and google docs/apps is equal is crazy talk.

Re:Ever read a EULA?

[snowraver1]

Yea, but I own the network.

Re:Ever read a EULA?

[Tynin]

YOu do ralize that since they own the OS(MS) they can have it do whatever they want, and not let you know.

First MS would have to breech a firewall, possibly disable an IDS they likely have little clue how it is configured or if they are even bumping into it, and then circumvent the OS. There will be tracks.

And you do realize, it is trivial to examine what is going across a network you own and disallow these kind of conspiracy theory shenanigans. If MS ever did this, you can bet your paycheck that between a few competent Windows / Networking admins they could and would determine what was going on and would have a field day with the lawsuit their company could milk MS over.

Re:Ever read a EULA?

[LoadWB]

The difference is that when you have children in your house, you generally have better control over behavior, and misbehavior is punished. When you let your children off to someone else's house, you have little control, if any, over behavior.

Put that into network terms. Also, consider that when money is being shelled out, one is more likely to pay attention to parts of the contract which say "we will send copies of your email to our centralized servers for analysis," and say BULL SHIT. But Google Apps has the primary motivation of being free or a lot less than the in-house options, so again security and confidentiality takes a back seat, if it gets a seat at all.

Re:Ever read a EULA?

[Anonymous Coward]

Since when is Microsoft the benchmark? Postfix, for example, doesn't have any sort of the EULA nastiness like what you're saying Exchange has. KWord doesn't have the problems MS Word has.

There might not be a difference between Google and Microsoft, but there's sure as hell a difference between Google Docs and normal stuff. Just stay away from EULAs.

Re:Ever read a EULA?

[Anonymous Coward]

When you click "Accept" on many EULA's you give up rights to privacy of your data to that company. What's the difference if it's hosted or not. Microsoft can just as easily have Exchange phone home with data as Google employees can read your mail.

Really? Because I can completely firewall off my Exchange server from the outside world. I can force it to relay all email through another MX for scanning/filtering/blocking.

I can be absolutely sure no data is leaking from Exchange to the outside world (even block hacks like hiding data in DNS requests). Try that with Google.

Re:Ever read a EULA?

[Anonymous Brave Guy]

When you click "Accept" on many EULA's you give up rights to privacy of your data to that company.

And the law in places like Europe really won't care. Any company whose software started uploading personal information behind its users' backs would be in serious trouble. And any user who did know that this was expected and used the software anyway would also be in serious trouble. This is why services like Google Apps are (in very black and white terms) not appropriate for use under the kinds of circumstances we're talking about in this discussion, at least under European law.

I'm not a lawyer or an accountant, but I am a part-time sysadmin for an organisation that handles personal data in the UK, so I have actually read the data protection rules here, which appears to be more than a lot of people here today.

Re:Ever read a EULA?

[Anonymous Coward]

Funny you should say that, China pulled a stunt like that with their hardware being sold to US government and military agencies. No one picked it up until it was too late. Quitely, the US is now buying their hardware with far more strict checks and from friendlier allies.

Look into how the F-35 data was stolen.

The fact is, people do get away with seeping out information from your network without you knowing. Do you know how easy it is to disguise information in seemingly harmless packets? For all you know, Microsoft has all your porn.

Re:Ever read a EULA?

[Mr. Slippery]

it is trivial to examine what is going across a network you own and disallow these kind of conspiracy theory shenanigans. If MS ever did this, you can bet your paycheck that between a few competent Windows / Networking admins they could and would determine what was going on

Not if you're an MS-only shop: "I ran a network sniffer to verify that our MS servers aren't phoning home." "Great. Sure am glad we bought a copy of NetSniff for Windows!"

It's the old "trusting trust" problem in a new form.

Re:Ever read a EULA?

[Anonymous Coward]

I would hope your patch management would be better than automatic updates. None of my servers are patched directly from M$.

Searched Google for ya'

[SloppyElvis]

Typed "Google Apps HIPAA compliance" into Google and found your response from Google: Is Google Apps HIPAA compliant? The answer is of course, "it depends".

Re:Searched Google for ya'

[SloppyElvis]

Thought about this on the way home... I work in medical software, and HIPAA is not something to be taken lightly...

Consider this hypothetical situation... Di$neyCo's latest summer blockbuster High School Music Video bombs on reports of the lead actress Miss Starlet recieving an abortion at your client's clinic. Information was obtained through a violation of HIPAA. Miss Starlet's multi-million dollar contract for High School Music Video 2 was terminated. Now, Di$neyCo has an army of lawyers seeking damages for the bomb, Miss Starlet is represented pro bono by Publicity-Seeking-Leather-Fringe-Wearing-Super-Lawyer, the Physician has the finances to hire on a top personal lawyer, the Phyician's liability insurance carrier has several law firms hired on to divert liability, and Google has a legal army re-stating Google's "we don't claim compliance" statements. That leaves you in a serious predicament.

Companies that claim compliance have a number of things you probably don't have:

1. A legal team
2. A full time Regulatory and Compliance staff
3. A Quality Management System that complies with the Code of Federal Regulations
4. A documentation trail that proves the companies product was designed and engineered according to the Quality System
5. Insurance against liability damages
6. The ability to raise large amounts of money for legal defense

You'd be well advised to hire a lawyer to protect you against such a situation.

Re:Searched Google for ya'

[DavidRawling]

Gosh thanks. But why couldn't you respond with one of the other 19 answers? Maybe "As I see it, yes", or "Reply hazy, try again".

Let's face it, Magic 8 Ball is about as useful as that response. Is your other name Wally?

Meetings with your boss must be a hoot. "Elvis, please investigate attaching the frood to the bligblang, with the goal of ensuring the quodloober speed is increased." "Ooh, the answer according to my 20-sided die is 'Not available in Georgia'."

What does the fed do?

[ljaszcza]

We are a contractor for the Veterans administration. The VA insists that we comply with privacy issues strictly. Any communications that have patient information must be sent on encrypted secure systems. No open email servers/hotmail/gmail/whatever is allowed. Failure to comply with the privacy (detailed in the out of control HIPAA set of rules and standards) is punishable both financially and by being banned from contracting with the US federal government. As an administrator, I have to remind physicians that if they are caught transmitting identifiable information of our patients over unsecured channels, it may cost us our contract and may result in their being banned from seeing medicare/medicaid patients. Anyhow, that's my two cents on utilizing gmail or such for sensitive information.

Another thought

[PolyDwarf]

I just had another thought on this.

Assuming you cover yourself properly from legal liability, do whatever your clients want... Then turn them all into the HIPAA police (I know there aren't HIPAA police... I have no idea who does the enforcement actions; you get the idea) for some sort of reward.

Professional responsibility

[rjh]

It is not your job to educate them on their professional responsibilities. Odds are very good that you aren't competent to advise them on it, and it would arguably be a violation of their canons of ethics to take advice from you. Lawyers and doctors have ethics committees to field questions like these: refer your users to them.

In the interim, stand by your guns. If your users say they'll go to the ethics committee and they're sure they'll be exonerated, propose this as a hypothetical question: if you give privileged documents to an uninvolved third party, is the veil of privilege pierced? Yes or no? (The answer is usually "yes"; exceptions are rare.) So, if you give privileged documents to Google, is the veil of privilege pierced?

Don't give advice. Just ask questions, and whatever you do, don't give in.

Re:Professional responsibility

[Anonymous Coward]

If you give data to Iron Mountain is my hospital at risk ?
If I run datalines over clear text T1s is my hospital at risk ?

No, of course not .. because all the data is encrypted. As should be your email.
Google is just a courier ... like the above.

Re:Professional responsibility

[Anonymous Coward]

youi are clearly NOT a lawyer. google is NOT a third party any more than a secretary is.
secretaries and google are covered under the same exemption. priv is maintained.

Re:Professional responsibility

[gdshaw]

There's a big difference between being competent to declare something safe, and knowing enough to declare it unsafe.

Here is what google has to say on the subject...

[Anonymous Coward]

http://www.google.com/support/forum/p/Apps%20Partner/thread?tid=4d6f74d03de056c7&hl=en

So you know email isn't secure... right?

[Anonymous Coward]

Unless you & your customers are encrypting all your communications then your email is already available to be intercepted & read. Aside from which, it's probably more likely that someone internal will be the one to leak emails, rather than some big bad corp. Do you expend the effort on security that google or other providers do?

Personally I think IT guys need to stop thinking that they're the hub of the business. If you're in the legal business IT is not your core business, it's an enabler. So whatever you can do to make that simpler/cheaper is a good thing as long as it meets your other requirements. Rather than a free service, you should look at paid services where there are contracts in place with SLA's. It doesn't change anything, but gives you a "you sue us, we sue them" position in the event something does go wrong. Make sure you're able to take backups locally so that you always hold a copy of your data & you're good to go.

Hosting providers?

[RichardJenkins]

I think there are three classes of company for the purposes of this discussion:

If you trust shared hosting providers; you shouldn't care about the Google employees who can access your data

If you trust managed hosting providers like Rackspace, particularly if they're hosting virtualised servers for you; you probably shouln't care about Google employees with access to your data.

If you don't trust managed hosting providers; well you're probably not reading this from the office, and Google Apps doesn't get a look in.

I'd say most companies fall into the second.

Re:Hosting providers?

[Anonymous Coward]

This makes no sense. Trusting Rackspace to host a public website is very different than trusting Google with confidential client information.

Re:Hosting providers?

[RichardJenkins]

Many public websites host confidential customer data that would cause you a PR and legal nightmare if it were compromised; these are the ones I'm talking about.

Not yet relevant...

[Denagoth]

Until Google Apps can FLAWLESSLY import and export files with Microsoft Office (doc / xls / ppt) no company is going to use it. For good or ill, those are the file formats the world runs on. If Google fixes that issue (and that's a big if), then we can tackle the privacy question.

Possibility?

[Chuck Chunder]

If you don't mind the possibility that the world may get your data, then by all means feel free to use Google, or any other SaaS type offering.

I don't understand what "possibility" has to do with it. Your data could "possibly" be exposed if you have your own infrastructure.

A more relevant question is probability. Is there additional exposure through using Google? Are Google internal security practices likely to be better than yours? If you are a small shop outsourcing your IT services anyway then why is Google worse than some other party?

Re:Possibility?

[Vellmont]

Is there additional exposure through using Google? Are Google internal security practices likely to be better than yours?

I think these are ultimately the real questions to answer.

Unfortunately getting a REAL answer for them is likely impossible. Sure, Google could give you an answer, but what assurances do you have it's right? What assurances do you have that it will continue to be a correct answer? At least your internal practices can be identified and quantified. With Google, all you have is Google's word, and possibly an auditor paid by Google.

So since we're unlikely to get any real answers we make stuff up and rely on intuition.

Frankly, I think IT people are just way to paranoid about security in general. Data is almost always completely useless to all but a few people. Sorry guys, but a hard drive just isn't the same thing as a bank. Criminals care about money, not your cholesterol level or appendectomy. In other words the guy storing large amounts of credit card numbers is much more at threat than your doctor. Thinking about security without thinking about the actual threats involved is pointless.

Can we trust Microsoft for that matter?

[Anonymous Coward]

If you think about it. We buy this closed software from a vendor and place it in our homes, businesses, schools and so forth. We then enter the most confidential data and undertake highly sensitive transaction and such and all the time MS are the only ones who know the inner working of this beast. Can we trust that MS are not accessing our data? Do they (or their selected partners) have a back door? Are they able to read our data?
This software is in govt depts around the world and in formats that they control - why should Google be any different?

Re:Can I find out the names of the doctors you wor

[Proudrooster]

Source: http://www.google.com/support/forum/p/Apps%20Partner/thread?tid=4d6f74d03de056c7&hl=en

Answer to your question.:
  PeteGriffin@Google (Google Employee) + 3 other people say this answers the question:
From a sales standpoint, I would recommend turning the question around and asking them what steps they are currently taking to be compliant with the relevant compliance-acronym (HIPAA, SOX, FERPA, PCI, etc). Understand what steps they currently take to be compliant, and what their current solution is. You'll be able to quickly discover if it's a real showstopping requirement and be able to move on, if it's something that can be addressed by Google Apps... or if they are horribly un-compliant and they're hoping that Google Apps will solve all of their problems (and more!).

No solution by itself is going to be the silver bullet; organizations (especially small and medium businesses) have extremely varied IT infrastructure and policies, with information flowing in different ways for different reasons. Google doesn't certify or identify Google Apps as being compliant with any specific set of regulations. It's really up to the organization to determine if a solution meets their compliance needs for their specific situation.

Google Apps has a very impressive set of features that are extremely helpful when dealing with prospects with compliance needs. The Postini component of Google Apps (referred to as Google Message Security) allows for very granular control of email content (in and out). There are additional email archiving and retention components available. Google Apps is SAS 70 Type II certified. We have also made a good deal of information available about Google's security policies when it comes to our network of data centers through a hefty white paper.

If anyone has experiences dealing with situations like this, please feel free to share your thoughts. Tony Safoian over at SADA Systems has some good thoughts around this:
http://www.google.com/support/forum/p/Apps+Partner/thread?tid=2ce6b0904f65ac44&hl=en

are you nuts?

[TheGratefulNet]

don't even THINK about outsourcing that.

yes, giving it to google is outsourcing. what, you thought.....

you didn't think.

THINK.

keep the network OFF your medical (etc) files. sheesh! this is 101 level, people. come on.

let me be very clear; you do not want to put medical, legal or ANY sensitive info 'in the cloud'. anyone's cloud.

got it?

its very simple.

Re:are you nuts?

[geekoid]

No it isn't, and you are wrong.

This is an easily solvable problem.

Perhaps instead of hiding in your hostile well of ignorance, you take up thinking?

Google's not interested in our email/calendar.

[seifried]

But google is. They place ads based on the content of your emails (i.e. I get SVN commit messages, and lo and behold ads for SVN related stuff on the side bar). So at a bare minimum they have automated processes reading all your emails, extracting meaning from them and displaying ads to you.

Re:Google's not interested in our email/calendar.

[Alascom]

This is such tin-foil crap, and has been debunked many times. Every mail server, router and switch reads your email by your definition, it has to in order to route a message, or copy data from one buffer to another. Just because gmail targets an ad based on a word or two in an email does not mean that someone is READING your email. Every time you search for a message in Exchange, Microsoft processes are "reading all your emails", right? Get real dude.

Most importantly, ads are only displayed in the "free" versions. If you get the $50/yr version there are no ads so your entire point is moot anyway.

Re:Google's not interested in our email/calendar.

[TikiTDO]

This is true for your run-of-the-mill gmail account. Gmail is a service Google offers for free, and in return gets to put up some ads. From what I see in the article, the author would be more interested in using the paid ($50/account/year) service, which is obviously free of ads. Now, I am not sure what form the data takes on the Google servers, and what additional security precautions Google takes to ensure it stays private, but that is something that would need to be resolved between the admin and the Google team.

Re:Google's not interested in our email/calendar.

[seifried]

Agreed, but to what degree are they processing the email? Are they simply running it through an AV scanner, or are they extracting actual meaning (content, names, nouns, etc.). How much of this information leaks when you click on an ad for example? (hmmm a Doctor clicking on ads for specific drugs, etc.). I'm not against Gmail, I use it, but I think people need to be more aware of this "well no one wants to read my email/etc." because in fact this type of data is becoming increasing valuable and is being strip mined for information.

Re:Google's not interested in our email/calendar.

[seifried]

Again, you can use it free for up to 20 users or whatever the number has been cut to recently, which I have the horrible suspicion some of his clients might do. Plus for some things like HIPAA you can't really outsource stuff without strict controls (which you don't get with Google).

Re:Google's not interested in our email/calendar.

[TikiTDO]

I believe the 20 user service is the standard edition, which as you said, one would have to be brain dead to use in a sensetive environment. You may also have a point about the premier service, as Google does not give you full access to the infrastructure. However, all the results that I can find related to the question point to the same answer: Hire a HIPAA consultant in order to evaluate your environment, and how Google can fit in there.

Now I may be making some logical leaps, but if Google services were absolutely not HIPAA compliant, would it not be likely that somewhere, someone hired a HIPAA consultant, asked the exact same question, then posted the answer online? Again, this is all based on assumptions and lack of information, but I do not believe a flat out denial is the right answer either. I guess in following with the general theme of the responses, I would suggest hiring someone qualified in the matter.

Re:Google's not interested in our email/calendar.

[Culture20]

After you convince your doctor's office that google office is okay and google parses the records, let us know when you see the marked increase in ads for herbal enhancements while searching for anything on google from an IP address google associates with you.

Re:Google's not interested in our email/calendar.

[Anonymous Coward]

If you send email, then at the very least, your email provider has an SMTP server, which is an automated process reading all your emails, and extracting meaning from them, such as who the recipient is.

Re:Google's not interested in our email/calendar.

[Anonymous Coward]

I use google apps enterprise(email, docs, etc..) for my business and NO ADS SHOW UP. You ARE using google apps ENTERPRISE, aren't you?

Re:Google's not interested in our email/calendar.

[seifried]

That's header data, generally speaking an SMTP server doesn't read body content (unless it's filtering for spam/etc.). Plus the types of data being extracted and what they are doing with it sort of matters.

Re:Google's not interested in our email/calendar.

[seifried]

I'd er on the side of caution (especially with legal requirements like HIPAA), it's easy to move to Google if it turns out ok, it's a pain the explain in a deposition why you thought it was ok (and have to move to something else/etc/etc.).

if you're paying them, why not?

[discogravy]

if it were a service the lawyer/doctors/etc were paying them for, how would this be different than say a lawyer's office contracting their IT work to a tech firm?

Re:if you're paying them, why not?

[John Hasler]

Depends on what the contract says.

Re:if you're paying them, why not?

[chiguy]

The only (non-pedantic) difference is the customer (doctor/lawyer) can make the service provider sign an agreement that forces them to follow appropriate privacy laws (HIPAA) or take steps to ensure privacy. This agreement can then provide legal recourse if something goes wrong.

Generally, Google will not sign a strict privacy agreement with your medium sized business. Technical issues aside, they have a lot more money to go after and an infinite number of lawyers willing to sue them for part/all of the spoils.

If they don't care why do you?

[Rix]

Sure, explain the risks, and recommend they run the idea past their lawyers.

It's their risk to take, and look at it from their perspective; they're already trusting you with their data. Why should they trust Google, with it's nigh infinitely deep and sueable pockets, less than they trust you?

Just screw HIPAA

[Anonymous Coward]

What do you care more about, laws or Google's success? That's what I thought. Take the easy road./sarcasm
It's HIPAA, by the way, not HIPPA.

What about trusting you?

[Dr_Harm]

It sounds like you are a contractor. So, your "clients" have to trust you, don't they? You could read their e-mail, calendar, etc... and if you developed an interest in one of their more famous clients, you could do just as much damage.

The question, then, is not one of "needing to trust Google". The question is, "Is Google more or less trustworthy than the current solution?" There is a fair argument that a large, multi-billion dollar company has a lot more to lose should things go sideways than a contractor. There is also a fair argument that they probably have 1000x more people with access to the data than an independent contractor.

This, of course, ignores any legal requirements like HIPAA, PCI DSS, etc. etc. But I think my point is still valid: If the client has already contracted out management and/or hosting of their data, they have already made the decision to trust an outsider. Going with Google or not is just a question of "which outsider do we trust"

Re:What about trusting you?

[fluffernutter]

Good logic except for the fact the Google has openly admitted to scanning customer data. Would you expect someone to go with any smaller hosting service with a contract that reserves them the right to own admin rights to your server and scan it at will, without reservation?

Google is evil

[DNS-and-BIND]

Don't believe anything they say - Google is a publically traded corporation. The job of the directors is not to make a profit, it is to maximize profits. The example the founders set will only go so far. How much attention do other companies pay to their corporate slogans? How many of you can name the slogans of AT&T, IBM, Facebook, or other companies? And how much attention do the employees of these corps pay to their slogan? Does the Goldman Sachs slogan really drive its employees?

Google Apps is as secure as the internet.......um.

[Bob_Who]

The fact is that if Google Apps is not secure enough for you, then neither is any network data that also shares a connection to the internet. Lets be honest, any network connection is a pathway to your data. If you really want security, close the loop. Otherwise, Google Apps is perhaps an appropriate reminder that you're ultimately vulnerable. If hackers can get onto the Google Apps Servers, then they're not going to be stopped by your internet security either. At least, not for long....Buggy browsers, malware, users, and Windows will eventually leave you naked. Google Apps is appropriate for many and is more secure than a Trojan bot key logger root kit polymorphic virus windows IE beta orgy toolbar macro, like most small business systems that I encounter.

You're right, they're wrong.

[jcr]

HIPPA is the law, and organizations with a duty to protect patient confidentiality don't have the option of basing their security policies on wishful thinking.

-jcr

Unlikey, but depends

[mustafap]

>Is it time for me to remove the Tin Foil Hat on the subject of confidentiality and stop resisting the juggernaut that is Google?

Is the information you are posting confidential? That's not a question you can answer by yourself: It's a combination of the business deciding, and whatever laws apply in your country. With the higher level being the decision. Medical and Law? Surely the answer is an obvious No.

No.

[John Hasler]

If I found out that any lawyer or physician working for me had put any of my confidential documents up on Google I would immediately terminate the relationship and file an ethics complaint.

Re:No.

[geekoid]

Why?

Explain how this is different then a set of internal server?

Re:No.

[John Hasler]

> Explain how this is different then a set of internal server?

Google is not contractually obligated to keep my stuff confidential.

Re:No.

[Anonymous Coward]

actually they are. have you even looked at the contract for google apps ?

Yep

[Anonymous Coward]

After all, Google will Do No Evil(TM)

What's wrong with trusting Google?

[Anonymous Coward]

What's wrong with trusting Google?

A better question is "Why are our records private?" Is there any real reason your company would need to protect this information? If not, then I guess it's fine to put the info up on the internet. If your company needs to keep some secrets, then you keep them within the company.

Works Great For Twitter

[Doomstalk]

Twitter docs hack exploits stupidity vuln

Blatant HIPAA violation

[Tokerat]

As someone who works in the medical industry (a recent change of pace, I'll admit), let me say that if anyone in my company transmitted confidential information over a web mail service like Gmail or Yahoo!, they would be instantly terminated and possibly indited. Non-secure transmission of confidential patient information (even as simple as an insurance subscriber ID) is precisely the reason laws like the HIPAA protections exist. If these providers are your clients, it would be wise to make it very clear to them how illegal what they are doing really is, and how severe the repercussions are for their actions.

Think of it this way: Do you want Google indexing and/or caching your SSN, your policy number, or even your name as it relates to the results of your most recent colonoscopy? Didn't think so, and neither does anyone else in their right mind. I won't advise you to be a tattle-tale to any regulatory agency, but I'm surely tempted.

Re:Blatant HIPAA violation

[zuperduperman]

Whoa, I can't see anywhere that the submitter stated they wanted to store confidential PHI on google docs. I imagine we're talking about email and calendaring - things that are generally insecure by nature anyway and which don't contain PHI. A doctor couldn't put patient appointments into google calendar, but I doubt they put them in outlook either - they have dedicated software for that. They could certainly put any other business related stuff in google apps (staff meetings, training, holidays, business appointments ...). The biggest risk I see is that there would be a temptation to "leak" patient information into the insecure systems, but they face that anyway (you won't find your doctor sending you your test results by email) - it's a matter of training and policy.

Re:Blatant HIPAA violation

[Tokerat]

I kind of read it to be like he was receiving emails from Gmail accounts of his clients with stuff like "Oh, when I try to look up XYZ's file in our system I get an error message" type of thing. Still an absolutely blatant no-no.

An IT consultant is not a lawyer...

[DragonWriter]

I provide IT services for medium-sized medical and law practices. Lately I have been getting a lot of feedback from doctors and lawyers who use gmail at home and believe that they can run a significant portion of their practice IT on Google Apps. From a support standpoint, I'd be happy to chuck mail/calendar service management into the bin and let them run with gmail, but for these businesses, there is significant legal liability associated with the confidentiality of their communications and records (e.g., HIPPA). For those with high-profile celebrity clients, simply telling them 'Google employees can read your stuff' will usually end the conversation right there. But for smaller practices, I often get a lot of pushback in the form of 'What's wrong with trusting Google?' and 'Google's not interested in our email/calendar.' Weighing what they see as a tiny legal risk against the promise of Free IT Stuff(TM) becomes increasingly lopsided given the clear functionality / usability / ubiquity that they experience when using Google at home. So my question to the Slashdot community is: Are they right?

Maybe they are, and maybe they aren't. But here's the thing: you are being paid as an IT consultant, not a legal adviser or a compliance consultant. You need to ask what their requirements for security, privacy, etc., are, and, if they ask about using Google Apps to meet those needs, you should give your professional advice as to whether that service meets the requirements they have articulated to you. But you probably aren't qualified to tell them what their requirements are under HIPAA (not HIPPA) requirements, or any of the myriad of other specialized, domain-specific, privacy laws and regulations, or even to tell them which of those laws and regulations apply to them, and, if you aren't, you shouldn't hold yourself out as someone who can answer those questions for them.

Legal mumbo jumbo

[Super Jamie]

Have your lawyer write up a legal letter which says that for any confidentiality-bound practice like lawyers or doctors, you recommend they do not use Google Apps as they are likely in breach of their own privacy-related responsibilities. Have the end user sign the document before you will do business with them. If they won't, then walk.

That way, when they get busted to the tune of millions of dollars for the sake of a couple of hundred bucks of office software, you can't take the fall.

Email is plain text for most people anyway

[fryjs]

Whilst this doesn't apply for internal emails and documents, and I realise there is a difference in storing archives insecurely on Google's servers than simply transmitting insecurely, I do find it interesting that many people are concerned about Google reading the contents of their email/documents, when they have been sending and receiving emails/documents for years in plain text, over routers and servers they know nothing about.

Email Signature

[Tokerat]

Put this in your email signature:

She was let off easy...

Not your issue

[chadplusplus]

You have made the facts clear to your clients that google or other service providers can read potentially confidential communications. Aside from that, you have probably informed them as to the pros and cons with respect to reliability and usability of the online apps. At this point, you have fulfilled your duties.

Whether it is ethical for these individuals/entities to use web apps is a question for lawyers and as a cautionary note, you opining upon the ethics of using these services is border line practice of law.

As a lawyer, I often wonder about these things myself. Many small offices and sole practitioners rely upon hotmail/gmail for email services. Even those who set up a domain name and custom email addresses often still rely upon a third party to manage their servers, like GoDaddy.

I was developing an online application to manage client billing, but abandoned it due to privacy/ethical concerns.

But like I said, my original point is that your role is to merely inform the facts and determining whether it is ethical to use those services in light of those facts is up to the lawyers.

Re:Not your issue

[stocke2]

I highly doubt most lawyers are qualified to determine ethics of any sort. the lawyers job is to determine the legality of something not ethics.

Re:Can I find out the names of the doctors you wor

[Anonymous Coward]

Good luck with that. We are not talking about postini. His OP was that his clients were using the free google apps products which is in the cloud utilizing applications, servers, networks that he cannot effectively ensure that controls are being applied to.

Plus Postini only gives you the assurance that transmission of data is potentially secure between the covered entity and the third parties. It is still up to the covered entity to ensure that they are compliant with all HIPAA rules both required and addressable. And addressable doesn't mean "optional" btw. As I tell most of my clients, as long as they have the risk analysis done, publish documentation, policies, procedures, and administrative, privacy, and security/technical controls are in place, they should be good to go. To be sure, they should get an external audit done. Remember once the doctor signs off that he is compliant, he's liable. And if he marks YOU down as his Security Officer, you become liable.

I'm going to assume, by the fact that the doctors are using the free apps to run their business on the cloud , that they have not done anything else to ensure HIPAA compliance.

Lawyers are another topic I could delve into but won't. I'm shocked your lawyer clients are actually using this. Client-Attorney Privilege, etc could be compromised. The lawyers I work with at the corp level would eat these guys for lunch by killing them with discovery.

I am not a lawyer, just a HIPAA & Sox consultant that works with Lawyers specializing in regulatory issues. My ultimate suggestion for the OP is to have their client talk to a lawyer specializing in HIPAA. Lawyers are another topic like I said.

No physical security

[pentalive]

No matter how ironclad the agreement or how draconian the penalties your data will still be public. Sue Google into non existence and well your data is still public.

Without physical security there is no security.
If you don't own the box and control access yourself there is no physical security.

Re:No physical security

[Lehk228]

more information is leaked due to local security failures(viruses, worms, trojans, assholes using anonymous FTP from home, assholes using unprotected windows shares and unencrypted wireless) than to third party application servers being compromised.

the key thing is to look over the service agreement with google docs to make sure that there is an agreement to keep stored documents confidential.

Re:No physical security

[Anonymous Coward]

Without physical security there is no security.

Sure. Except not.

There are three standard methods to introduce security:
* physical (e.g. a lock)
* technical (e.g. encryption)
* procedural (e.g. hiding your PIN code as you type it)
All three can be broken (lock can be picked, encryption can be brute-forced (or better), procedures can go unheeded), none is perfect.
You need to consider all three to have a secure system.
Physical security (e.g. a lock) that anycone can circumvent because the procedures are unobserved (e.g. passcode on a post-it on the door) are no guarantee of security.

Re:No physical security

[ajs]

No matter how ironclad the agreement or how draconian the penalties your data will still be public. Sue Google into non existence and well your data is still public.

As the grandparent suggested, "Google" is a red herring here. We've had this debate before, and it's over. Every industry that handles sensitive data has been working for the last 10+ years to determine how to contract with third parties to manage that data. It's been a long and difficult road, and some kinks are yet to be worked out, but to suggest that it's not possible to do right seems to be contradicted by the thousands upon thousands of hospitals, government contractors, law firms, courts, government agencies and so on that have been doing it very well for some time now.

In fact, the exact same argument can be applied to your personal release of this information to a third party (e.g. the firm in question) in the first place, and we've long since come to understand that our personal data needs to be shared with those who provide us valuable services. We, as a society have come to terms with this and developed models for how that should work. These rules are ingrained in our laws and even the fundamental rules upon which our laws operate (e.g. Common Law). While it will likely take another 100 years to work out exactly how technology and the web of corporate interaction will fit into that framework, to stick your head in the sand and pretend that it's not a part of our world is rather silly.

Re:If my lawyer used Google Apps, I'd get rid of h

[nomadic]

No lawyer can legitimately use Google-hosted services, unless they're doing work for Google. It would be a huge violation of confidentiality.

No it wouldn't.

Microsoft phone home? HA!

[pentalive]

If Microsoft applications started "backing up" documents by sending them to Redmond it would be detected (If only by increased bandwidth at the main router) and the hue and cry would be deafening.

A sudden change in in or outgoing mail traffic will also be noticed.

Any actual prosecutions for violating HIPA? ANY?

[Anonymous Coward]

AFIK, nobody has ever actually been prosecuted for violating HIPA.

can you say HIPAA

[Uzik2]

I can't imaging google is hipaa certified as a storage provider for medical information.

Josh

[Anonymous Coward]

If I found out my legal info or personal medical records were being transmitted (likely in plain text) through gmail and other google services I would sue the crap out of everyone involved.
And I would win.

Yes, there's an additional vulnerability

[Moraelin]

Once something is on Google, the up side is: any computer with internet access can log in and access it. The down side is the same: any computer with internet access can log in and access it.

If something is on your internal network, that already puts a bit of a limit on who can access those files. It's not bulletproof, and you can still get rooted, but it's a limit. The average Tom, Dick and Harry are as good as physically separated from that data, even if they can guess your password.

Once that stuff is on Google, essentially anyone who can guess your password is good to go.

For example, you only need one employee who uses the same password everywhere (it happens more often than you'd think) and has ever shared their home email password with their spouse, or their WoW account with the chinese guy who power-levelled it, or whatever. Or they only need the same password somewhere where you need to guess their mother's maiden name to get that password. (Again, you'd be surprised how many put the real maiden name there.)

Or some passwords are that easy to find out, because they're weak. People use their nickname, or pet's name, or whatnot as passwords all the time.

Some passwords aren't even kept secret. I know the logins for a local hospital _and_ the emergency medical service, without ever having worked there, just because the former was taped to the monitor and the latter was spoken out loud while I was there. And yes, apparently veryone there used the same. So every ex-employee knows those too. Plus any patient who can read or has ears.

So, ok, now you know a name and password for the hospital computers. Now what?

In a traditional IT scenario, they're only accessible from the internal network. Sure, you can try to sneak into a room and use their computer, but you can be caught, so most people won't. Sure, you can try to get them rooted somehow, but again most people wouldn't even know how.

Now move those files on Google, and you have a real extra problem. If that hospital ever moves its data to Google, every single patient who ever read the post-it on a monitor, can try it from their own home. No having to sneak anywhere, no risking that someone walks in on you, no l33t haxxx0r skillz needed. Just point your browser at Google, log in as a doctor, and read the medical data of everyone who ever used that hospital.

I agree!!

[nimbius]

seatbeltless cars, guardless chainsaws, helmetless bicycles and police free cities will all help this 21st century civilization embrace the anarchy that makes it more productive!

Encryption

[Anonymous Coward]

Use it, but remember to encrypt all of your documents on Google Apps/etc. Once done, you have significantly less worries.

As for Online apps having significantly higher fees than an old copy of MS Office 97? Uhmm.. I didn't know Google charged me anything for its services.

can you say HIPAA

[Uzik2]

I can't imagine google is hipaa certified as a storage provider for medical information.

Re:Google is evil -

[Bob_Who]

People are evil. Corporations are not people, but people hide within their edifice in order to control others. Self interest is always abundant in our economy and society; and corporate greed is just a vehicle for that objective. Google, like Soylent Green, is people. If Google "Does No Evil" is that the same thing as "doing the right thing?" Perhaps its a start, but corporations don't deserve human rights, and people don't deserve a corporate domination of society and power. Our institutions need to be as accountable to society as our citizens - and its time we expect more from our people. Bottom lines despise human beings - and corporations would prefer no payroll or human interaction. Shareholders want profit, and it is a dehumanizing influence on the people who decide to lay off workers and rip off their customers. Incentives on the bottom line ignore other people's quality of life.

Tell them you'll turn them in for HIPAA violations

[al0ha]

If they even so much as continue to talk about using Google, or any other insecure third party application, for sensitive patient data. There is no possible way to use Google without breaching HIPAA unless all the doctors and patients interested in using it are capable of successfully encrypting and decrypting all communications; which they are not.

SMIME

[PhunkySchtuff]

SMIME could be the answer. With free personal email certificates available from places like Thawte, it's trivial to enable end-to-end encryption with mail clients like Apple Mail.

I use Google Apps for my business and anything that's sensitive, I will encrypt. In Apple Mail, once you have imported your freemail certificates into your keychain, a couple of buttons appear in the Compose Mail window - one to sign and one - provided you have the recepient's public certificate in your keychain too - to encrypt. In order to get someone's public certificate in your keychain, all you need to to is send them a signed email, to which they can reply with a signed email and you will have each other's public certificates.

Since moving to Google Apps, I've saved power (by not needing a machine on 24/7 just to handle incoming and outgoing email) I've got email syncronised between my laptop, my desktop and my iPhone by using IMAP, I've got a great webmail interface that's powerful and easy to use and I don't need to worry about administering my own email server.

Reliability has been very good so far and I've moved a couple of my clients over to Google Apps as it makes sense for them to outsource their email hosting rather than handle it themselves, or pay per email address through their ISP and have very limited storage space and POP access.

Security is the least of my concerns - and I would consider myself a security conscious person. With email, even sent from your own server, it travels over so many insecure links from it leaving my server to arriving at it's destination that I don't believe outsourcing my email to a 3rd party like Google is any less secure.

As I mentioned initially, if security is a concern, and this applies even if you're running your own email server, use encryption.

Here's what an IT Law Firm Says

[Anonymous Coward]

Seyfarth:
http://www.seyfarth.com/index.cfm/fuseaction/publications.publications_detail/object_id/9275a22b-3998-494c-84d8-7d234e503d82/IssuesRelatedToCloudComputingArrangements.cfm

This is about "cloud computing", but google-anything is cloudy.

Doesn't everyone know that google is an advertising company? What do you think they do with every piece of data they get their hands on? They dig and search and categorize and correlate **all** data to sell you and other people stuff and services.
NEVER expect anything to be private with google.

HIPAA Security "Standards" are a joke.

[surfcow]

Here, read it. You'll be surprised.

http://www.rdmc.org/cmhc/reports/HIPAA_Security_4.pdf

They are not really standards, just vague suggestions. For example:
"Implement electronic procedures that terminate an electronic session after a predetermined time of inactivity."

Ummm, how long? Is a week alright?

"Implement policies and procedures to protect electronic protected health information from improper alteration or destruction."

and my favorite:
"Implement a mechanism to encrypt electronic protected health information whenever deemed appropriate."

And so on.

Hard to take these "standards" too seriously. Very subjective, vague, open to interpretation. Not really standards. Simply saying: "require passwords" or "have a backup plan" is not useful.

Re:HIPAA Security "Standards" are a joke.

[DragonWriter]

That document is from 2005. Additional (and more detailed) specifications for requirements for PHI to not be considered "unsecured" were specified in Guidance issued this year under the authority of the HITECH Act (part of the American Recovery and Reinvestment Act of 2009), which also extended HIPAA's existing (and the Act's new) security requirements to business associates of HIPAA covered entities and not just the covered entities themselves.

It's their choice, not yours.

[obarthelemy]

Explain the risks (and benefits) clearly to them, in writing, with proof you did it. Storing medical info is particularly sensitive.

If your customers are willing to take the risk, it's their choice, and their responsibility, as long as you've been clear with them.

I think they'll back down when you come to them with a waiver to sign to clarify that they are responsible, not you.

Re:If my lawyer used Google Apps, I'd get rid of h

[betterunixthanunix]

It would be a massive risk of confidentiality breaches. I would rather only have to trust the people working for the law firm to prevent a data leak than have to trust them and the thousands upon thousands of IT workers at Google. Legal files could easily become high-profile overnight, especially if there are special interests who think they can them as a case-in-point for whatever agenda they have; an IT worker at Google might be paid off to leak some files, and with so many IT workers, the chances of finding one who is corrupt or desperately needs money are fairly good.

Never mind confidentiality...

[daschlag]

Users are accepting of system outages when it's their personal stuff, and even then, only barely. When your clients start asking for "Free IT Stuff", remind them that nothing is free, and that when Gmail goes down, there is nothing you, as their support staff, can do about it. And yes, confidentiality is important, and no, Google doesn't provide it.

It maybe ok for Physicians under HIPAA

[sgent]

As long as Google will sign a business associate contract -- which they very well maybe willing to do -- then they can legally store information on gmail.

You are right, but unfair to Google

[MattW]

"Google employees can read your stuff" is not accurate.

Google just doesn't trust internal people; the security folk there are very savvy, and they know that incidents from inside are a serious risk. Which isn't to say they are HIPAA compliant; until they are, your doctors don't belong there. But it isn't fair to Google to imply that internal people there have unauthorized access to your mail. Are there people who might be able to read your email without authorization? Perhaps. But I think Google has controls to mitigate the risk of it happening, and make it so that it cannot happen without an audit trail.

Re:You are right, but unfair to Google

[Todd Knarr]

Actually I think the problem would be the Google people who have authorized access to your data.

Are google apps HIPAA compliant?

[nurb432]

If not, you doctor friends are committing a federal crime as it is, punishable up to jail time.

If they are, then its a non issue.

Google Apps Appliance?

[Zaiff Urgulbunger]

Given that Google already sell a search appliance, I've wondered before why they don't sell a Google Apps appliance. I'm pretty sure I could resell a bunch of these no problem!

Alternatively, would it be possible to have the Google Apps front-end use storage elsewhere?

Re:Any actual prosecutions for violating HIPA? ANY

[Annwvyn]

http://www.renalandurologynews.com/Staff-Nurse-Faces-Jail-Time-for-HIPAA-Violations/article/119854/ http://www.healthcareguy.com/index.php/archives/483 http://www.healthdatamanagement.com/news/HIPAA-38694-1.html Go ahead... take the time and spend the money to get a license to practice. Then go mess around with private information. See what happens.

Why not trust them?

[Anonymous Coward]

Why not trust them? Why trust you? How many server admins read the mail of their bosses?

Offer an analogy

[Anonymous Coward]

What if Google offered free radiology services? Or free bloodwork? Would they feel comfortable using it? Would they consider it meeting a "standard of care"? Trying to come up with a comparable situation could help you and the doctors get closer to the root issues.

Security through obscurity

[GeoSanDiego]

So which is more likely to happen: A google employee reading your hosted email and using that information in nefarious ways, or if self hosted the sysadmin you now have to have on the payroll doing the same thing? The farther away from and less familiar any person is with your business the less likely that person will consider the possibility of messing with your business. I would rather put my faith on being a fish among thousands in a lake rather than being the only fish in a bucket.

Other people can read your stuff too

[Blackeagle_Falcon]

'Google employees can read your stuff'

Even if these clients are currently running their own e-mail server, employees at the local ISP could use DPI to read their stuff. Anything you send on the internet that isn't encrypted can be read by lots of different people at lots of different points. Unless the clients are currently encrypting their e-mails, I don't see any privacy reason not to use gmail.

instead of asking slashdot, ask google

[j1mmy]

there's a for-pay version of google apps which can be delivered over SSL. i don't know if the license terms are any different, or if the server-side storage is at all secure, but i'm willing to bet someone working for google could answer that question for you.

Re:instead of asking slashdot, ask google

[whoop]

As with any Google Apps story around here, the old saying, "You get what you pay for" applies. If you want complete control, pay for one of them there Google Apps-in-a-box devices. Of course, a Google sales rep, lawyer, etc will be able to answer all these sort of questions. I'm sure someone, somewhere has asked them before.

Think about it the other way...

[Chris Snook]

Who's more likely to do something damaging with your data: one of the few Google employees who has direct access to it as part of a sea of data belonging to millions, or the disgruntled tech in your own company who has access to the server room?

I'm not saying that you should outsource without a second thought, but if you have a contract with clear terms for how your data should be handled, with an explicit lack of disclaimer of liability for damage to your business in case they mess up, and you outsource to a company with a track record of managing their systems at least as well as your own staff, you're probably at less of a risk of malicious disclosure with your data in the hands of a reputable disinterested party.

On the other hand, if the outsourcing provider wants you to sign away all your rights (and many do), they don't have much of an incentive to adhere to the terms of the contract, so you should stay away.

Tin foil hat to remain on.

[chiefted]

I think your fall back position is HIPPA. Unless Google is going to follow that (and I seriously doubt they would), keep the tin foil hat on. You could always say that in every Google building there is a screen that shows the latest search phrases. They scroll by constantly and can be seen from the outside of the buildings in some places. Do your employers really want to open themselves to that?

Re:Tin foil hat to remain on.

[cyber-dragon.net]

I agree with this, point out you would be trusting a company with no stake in keeping your data private, and quite the opposite, with data YOU are required to keep private, and will be liable if you do not. There is no suing google when they loose it, read the EULA, but you will be sued for sure.

Any lawyer should understand this.

Linux + Open Office + Thunderbird + etc

[IBitOBear]

Dude (et al 8-),

Your clients are at the "hey this free stuff is great" stage. Good. But there isn't really any value to having the ap be far away on a web server.

A decent and easy-to-accomplish setup of local Open Source stuff will do exactly the same job at the same price point, but without the questions of PRIVACY you mention nor the questions of RETENTION you didn't.

Google really _isn't_ on the hook to be there with these services or all your data in two years time etc.

So for privacy and retention reasons you cannot really ever use the web-application model to a remote company without many potential problems.

Again, local is mandatory, but Microsoft isn't. Everything you can find on Google Apps can be found for free use on/with any large-scale linux distribution pretty much for the cost of playing point-and-click in the software installer/chooser/whatever.

HIPAA makes it clear who gets the blame for loss

[jkinney3]

The blame will go to the DOCTOR not their online data service.

Having done a fair amount IT architecture work in the healthcare realm for the past 10 years, I can truthfully say that doctors are really cheap and look for ways to cut a dollar now at the risk of tens of thousands later. They are also early adopters of technology yet are basically clueless on how it works.

The cost of keeping an internal server plus vpn access for laptop use on an annual basis is a few hundred dollars. The cost of not having access to their records because of a fiber-seeking backhoe attack on their buildings access is hundreds per hour.

What _is_ the customer support number for Google if your Google Apps data goes missing? The doctors have your cell number and probably your home phone as well.

To Google, their account is one of thousands. To you, they are a car payment and maybe a few nights at the pub every month. Who is going to take care of them better, not cheaper.

The old mechanics saying comes to mind: "We do things 3 ways - right, cheap and fast. You get to choose two".

cjacobs001

[cjacobs001]

I just got here and haven't read the other responses, but . . . if you are seriously asking that question, obviously you are not familiar with your compliance requirements.

Anyone considering using Google Apps...

[defireman]

Should keep in mind that, once something goes on the Internet, it is on the Internet forever.

Double goes for porn.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Google or ISP, what difference?

[belcoop]

Strange reasoning. All files get send over the internet with e-mails, in essence, every document created ends up being sent electronically somewhere, as snail mail is just not an option anywhere. If you worry about Google reading your e-mails, than also your ISP, hosting your imap-server, the ISP of your client, the IT guy maintaining your and his computer system, etc. So the security of a google document ends up in the same insecure risk category as every e-mail you send. However, the reputational risk for google when documents get leaked from their server is extremely high, while the risk for your local IT guy or local ISP is probably lower than the price they can get for selling the documents.

Malpractice

[Rydia]

There's one critical thing that a lot of people are missing here, and that's that this isn't a question of who has the documents, per se, but what can be done with those documents.

Some people are saying that if you hand your documents to a third party, it's the same, because they still need a subpoena. The problem is that they CAN get it with a subpoena from the third party. If you had kept them to yourselves, then (in some cases) they wouldn't. They could be protected by the attorney-client priviledge. It's not just a question of physical security, it's a question of confidentiality, and once you voluntarily surrender that, it's gone. And that nice document your client wrote you explaining what REALLY happened is no longer just a letter to an attorney, but an admission against interest. If the client does it, that's stupid. If an attorney does it, that's malpractice. Leave aside any objections about how dumb it is for such a document to exist. The fact that it could, and that your policy would result in a disaster of that scale, is enough of a cautionary tale to dissuade someone from taking the risk.

Really, sharing the information with google (you're surrendering confidentiality by agreeing to let them look at all), you're probably committing malpractice. This is a really, really serious deal.

I've actually done some HIPAA compliance work, and while the rules are slightly more loose, I seriously doubt that the doctor and google are going to be collaborating on a treatment plan, or that google is supervising the doctor's work. The same problems remain.

Yes

[Anonymous Coward]

To pretend that owning your own servers makes your email secure ignores the fact that your email still travels across the internet. http://www.eff.org/issues/nsa-spying

https not http

[Anonymous Coward]

The following works on Google mail and once set it also works for the calendar. GOOGLE DOCUMENTS however will still go over http

To enable this feature in Gmail:

Sign in to Gmail.
Click Settings at the top of any Gmail page.
Set 'Browser Connection' to 'Always use https.'
Click Save Changes.
Reload Gmail.

Farming My Records To Pakistan All Over Again

[cmholm]

Not too many years ago, as the IT offshoring was really picking up steam, it turned out that a number of records transcription shops were farming out their work to subs who turned around and passed the work to offshore typing pools.

And, the doctors and patients were none the wiser until a Pakistani typist felt she was getting screwed by her job shop, and passed the threat upstream that she'd selling or post her data on-line if she didn't get paid. This turned into a major HIPAA-related Federal case for the responsible parties (doctors, IT shops) in the US.

My health provider has offshored a lot of its application dev. This reminds me to do some more research into what they're doing with my data. My dentist is self-employed, and I'll need to remind him resist any temptation he's having to use Google Apps for my dental data. If I find out he does it anyway, I won't hesitate a second to drop a dime on him.

Twitter anyone

[caller9]

Nobody mentioned twitter?

http://www.techcrunch.com/2009/07/19/the-anatomy-of-the-twitter-attack/

LOTS of lead-in on that. Long story short: Password recovery email sent to abandoned and thus recycled and avaiable hotmail account. Register hotmail account, send recovery email. Use gmail account to do password resets all over the damn place.

Google docs & everything Google was done on the first step.

Wow comments a little light on facts

[Anonymous Coward]

Well the security paper should make you feel better

http://www.google.com/a/help/intl/en/admins/pdf/ds_gsa_apps_whitepaper_0207.pdf

Passsed SAS 70 Type II audit - http://www.google.com/support/a/bin/answer.py?hl=en&answer=138340

Google uses Google Apps themselves and we all know they have secretes that people want to steal.

The twitter thing is pointless as it was a comprimised password that would expose anybodies data if there email was accessible anywhere accept the main office.

And no don't forget when you send email from your mail server to another mail server from another company it goes in plain clear text. That means you have to trust every router in between.

With all that said, for most companies Google Apps will probably be more secure than some admin jocky and his Exchange server and no independent security audits.

Why not ask the clients?

[Anonymous Coward]

I think the answer is very simple. Asking the professionals is the wrong perpsective to take. Get them to ask their CLIENTS if they want their personal information on google and I can guarantee it doesn't matter how safe or secure it is, people go to such professionals for confidentiality.

The question then becomes... "In the event that information *somehow* gets out, would the professionals take responsibility for it getting out and pay their clients for the breach in security?"

I think when asked to put their money where there mouth is they would err on the side of caution

I'll answer your question with a question

[Alcemenes]

How would it make you feel if your doctor stored your medical records in Google Apps?

Google Apps:Confidentiality are NOT exclusive

[AllenFalcon]

Privacy regulations -- HIPPA, SEC, S/OX, FINRA, and RIA -- present very specific requirements. Google Apps Standard Edition (free version) does not meet these standards. Google Apps Premier Edition, with full SSL encryption enabled, meets these requirements for information access and storage. If you use Google Message Discovery, part of Google Postini Services, your historical archives are also compliant. With respect to HIPPA and some privacy laws (such as MA 201 CMR 17.00), emails should be scanned for personal information and blocked or encrypted. As such, full compliance would require adding a service such as Zix. Allen Falcon

Re:Google is evil -

[gnupun]

You can call parent troll, but the phone companies recently admitted that they were spying on its customers as instructed by the CIA. What if Google provides the same service -- used as a tool to spy on all citizens? When it comes to something very, very important (to the patients), such as health records, security is paramount, and these cheap, fucking doctors should pony up the money to have a private network to maintain privacy of patient records rather than hand it over to an information hoarder, like Google.

Let's frame the question a little better

[Whuffo]

I don't know how many of you have seen what passes for "IT" in many small medical offices - it's frighteningly insecure. I've seen more than one office where they were networked with cheap consumer wireless equipment - with the default passwords still in place and no encryption. Just pull up in the parking lot and turn on your notebook and they'll helpfully give you a DHCP address and access to their systems. I've gone through a few of these offices and locked things down better but they're still not exactly military grade security.

So how does the security of Google Apps compare with this? At least with the Google product the risks are well defined. Trusting the security of your doctor's network might not be a good idea - and the risks here are largely unknown. The people snooping on these offices are usually after credit card info, not medical records.

Think I'm kidding? Go check it out at your local multiple-physician office complex - then try to talk them into letting you secure their systems for them.

Rightclick on story header, select "Mark as Unred"

[Anonymous Coward]

Boom, average-colored slashdot story.

No One...

[Anonymous Coward]

No one who is concerned with confidentiality or privacy will (or should) use online apps or Gmail! No matter what they say, YOU have no control whatsoever about who has access to your documents/data. And by the time you find out that there has been a breach, its too late. YOUR documents/data is all over the internet for anyone who wants it. Anyone is crazy to think that they can expect to put data/documents online and expect to have any privacy or confidentiality. At the very least, the IT people who support have access to you data/documents. All it takes is one rotten apple in the IT dept.

Challenge to the social engineer...

[mcrbids]

As they have explained it to me, anything you give to Google can be subpoenaed. Google is currently one of the most-frequently-served companies in the world, and Google gives full and enthusiastic cooperation with lawfully issued subpoenas.

The challenge is simple, and sweet:

1) Identify any law firm or privileged entity that uses Google docs.

2) Sue them, or perform some court action that would justify a subpoena.

3) Use the subpoena to retrieve all (or a significant number of) privileged docs from the priv entity.

It's a simple social engineering attack that might require the help of a cooperative law firm and some digging. Anybody listening?

Any worse than a Blackberry?

[Anonymous Coward]

It strikes me that this is a bit of collective FUD. Why aren't folks up and arms that doctors, lawyers, and politicians use blackberries to communicate (oh no, a third party handled the e-mail communications, so the fuck what)?

What does your malpractice ins' say about that?

[Anonymous Coward]

Really?!?
Are you nuts?

Does your malpractice insurance know about this?
Does your Bar Assoc?

You have just blown a major whole in all you attorney-client privileges.

Do you have your clients waive this in your engagement letter?

I hope you got someones written legal opinion that this is OK.

And it's not just mail...

[bschorr]

I get the same requesets from my clients. And it's not just GMail they want to use. It's the word processor, spreadsheet, etc as well.

I try to tell them that the security is an issue and they look at me like I just said that "Elvis enjoys tacos". It's startling how unconcerned they are about the risk to their confidential client work product especially in light of the fact that if it were to leak out they could potentially lose thier license to practice.

But...but...it's free, they say, with confused puppy eyes. As if free somehow obviates any need for security.

Why? Re:No

[pkretek]

I don't understand that anti-google "hype", which probably was started by Ballmer :-)

There are many hosted mail solutions, every ISP has their own mail service, blackberry does have one too. There's a load of hosted Exchange solutions. Etc, etc, and businesses USE it. If a google employee can read email, why an ISP employee can't? Because it's in their terms of service? ha!

Rolling your own solution is damn expensive and you need a guy who actually knows something about it, that's why most companies are more than happy to outsource it.

They can ready your... - a red herring.

[Anonymous Coward]

Do you also tell them that the systems administrators on their in house email and records systems can read their mail, records, etc?

Re:Google is evil -

[Bob_Who]

I think you're absolutely correct. Telcos, ISP's, Comcast, Google, Yahoo, and MSN are all PUBLIC. Cloud apps/data systems information are like the Signs posted on an interstate highway. To place all medical or proprietary info on google apps is a very convenient excuse for insurance companies to steal unauthorized access to that data. Even if congress limits or prohibits their use of medical history to exclude coverage (due to preexisting conditions) you can be sure they want that data anyway. Without a doubt, those who want that information the most, will find and get it first, right from the "cloud" or the airwaves. Digitizing the actual records will enable it's unbridled transmission, sooner or later. Even if your files are "sealed", the medical billing contains detailed coding and prices. This data is in a wide area networks of health care administration, credit bureaus, billing & collection services, and accountants data systems....so they have bits and pieces. Meanwhile, lets try not to make the process so easy for them (insurance) - make 'em pay, make 'em pay.

How about encrypted and digitally signed emails?

[gr8dude]

If you use Google's servers just as a means of getting something sent via SMTP and received via POP - you can configure your email client to use a digital certificate and encrypt all your correspondence.

Even if Google keeps everything in their archive, it is still encrypted.

Sounds like a good compromise to me. Before you say "getting a certificate from CA costs money", remember that you can set up your own CA, or get a certificate for free.

don't be naive

[speedtux]

Look at where breaches actually occur in practice: disgruntled employees, P2P, server vulnerabilities, corporate espionage, carelessness, etc. Your in-house IT staff is a much more likely source of data leaks and corporate espionage than an organization like Google or Microsoft.

Or, to look at it another way, your "in house" IT staff is really all a collection of third parties as well, and they often have much less of a track record and much less to lose than Google.

Why not buy a private google apps machine?

[Anonymous Coward]

I recall reading something a while ago about servers sold by google, hosting google apps for professional businesses. This is not free, but it does mean you will be able to use the google apps while also being in control of that data and you'll not have to worry about confidentiality and google employees or hackers snooping through your data.

It may be very expensive, and it may be overkill for your needs, but it's worth looking into.

Missing important point about alternative

[notionalTenacity]

I'm not saying you're fully wrong, but I think the discussion here is assuming that the alternative to google docs is a hardened computer, in a secure facility, surrounded with armed guards, razor wire, etc. And thats not the case. Speaking about small and medium legal and medical settings, the typical alternative is a poorly backed up, poorly secured, office computer, connected to the Internet, filled with viruses and backdoors, and enthusiastically contributing to the botnet du jour. Small businesses, in general, do not take the time to understand their IT security. Most lawyers do not understand technology, and unless a practice is very large, its not going to have a dedicated IT guy. So when you consider the risk of data loss, or breech, and compare that typical scenario with google docs, then suddenly google docs doesn't look so bad. Without education there is no security; and there isn't much chance of your average lawyer becoming tech savvy enough to secure their network any time soon - so maybe outsourcing aspects of this problem is an improvement.

You cannot trust corporations without contracts

[mbone]

My answer would be, no.

You cannot trust corporations without contracts. No matter how trustworthy the current leadership seems, the time will come when they will be replaced by persons unknown.

I would only use services where you are paying for it and a contract guaranteeing confidentiality exists. I believe that Google offers that on some services, but, if they don't, there are others that do. As for whether or not some service is HPAA compliant, ask your lawyer, not Slashdot.

IYAALIAAB

[Anonymous Coward]

It's not paranoia. Keeping records in Google apps and certainly in Google mail is a lot less secure than keeping them on a local server or PC. If you know Google employees have access to the data you are acting in a reckless manner.

You're a lawyer. Don't make me laugh.

don't throw me in that briar patch, brer fox!

[Anonymous Coward]

result in their being banned from seeing medicare/medicaid patients.

Wouldn't most physicians desire an exemption from having to deal with zero/negative-profit Medicare/Medicaid?

Business Model

[ultraexactzz]

You know, with all the responses saying that Google Apps are not good enough to comply with HIPPA PHI regulations, it makes me wonder - why wouldn't Google set up a tiered for-fee service that is compliant? Change the terms of service to guarantee the privacy of data, encrypt it on the server-side so that it can only be retrieved by the owner with the proper key (to prevent snooping google employees), prohibit the public viewing of documents (the publish feature), and charge a doller per month per gig, or something. Google is ideally placed to offer such a service, and - if they can meet the legal hurdles - would make bank.

Re:How about encrypted and digitally signed emails

[lee1]

Good idea. But why do you need a certificate? Why can't you just use public key (pgp, gpg)? That provides authentication and signing as well as encryption.

Here's how it's going to work:

[Hasai]

1: The suits will ignore IT's warnings. "What do geeks know about running a business?"
2: The suits will ignore Legal's warnings. "The money we save far outweighs the minimal risks."
3: A significant amount of time passes. The suits pat themselves on the back for padding the bottom line. Stock options are cashed in.
4: A medical datastore gets hacked into, probably from a PC belonging to one of the suits. (You know; the one with the password pasted to the monitor.) Data subsequently gets auctioned on a blackhat site. Men in Black pay a friendly visit. Ambulance Chasers descend.
5: The suits panic, look for scapegoat, invariably select IT. "But we didn't KNOW our IT department was putting records on Google!" Non-suit heads roll.
6: Organization is crushed by civil fines and lawsuits. Suits move on, soon finding other firms to trash. Balance of staff find themselves on the street.
7: PC Magazine finally gets around to publishing an article on how stupid it is to put HIPAA documents on Google et al. Loyal readership (CEOs in airport lobbies) panics, head back to own firms were non-suit heads subsequently roll.
8: Suits proceed on to the next insanity.
. ..
Lesson: Scott Adams is an optimist.

It's called a contract...

[scamper_22]

It's amazing to me how people seem to think the internet brings in a whole new world where nothing old applies.

If I have a legal responsibility and I wish to use a product/service that might affect that responsibility, then I would:
-get a contract detailing things
-get insurance to protect me
-audit the other party to make sure they will adhere to certain rules

Doctors, engineers, lawyers... have all dealt with this for a long time.
If I had a legal responsibility, would I trust Google with my data? Nope. At least not for their current free apps.
This is one case where they could most certainly offer a 'premium account'. You can speak to live person to handle issues should they come up. An SLA with privacy guarantees... Then I'd consider it.

Otherwise, I could rightfully be sued for negligence. Here I am a doctor or lawyer making 250k/year and I'm too cheap to spend a few hundred dollars to guarantee the privacy and security of my data. Sounds like negligence to me.

Unfortunately responsibility and accountability costs money. It's not a free lunch for you or Google.

SAS 70

[AustinFloyd]

The only main issue with SAS 70 audits is that the company/process being audited defines the scope of the audit. You can choose to not report processes, systems, or users involved, and the auditing company will only cover the scope you've set forth. IMHO SAS 70 is nowhere close to a comprehensive auditing tool for SOx or HIPAA compliance.

Re:SAS 70

[Chyeld]

From the same wiki link already provided, bolding added by me:

SAS 70 and Sarbanes-Oxley Act

With the introduction of the Sarbanes-Oxley Act (SOX), SAS 70 took on increased importance. SOX adopted the COSO model of controls, which is the same model that SAS 70 audits have used since inception. SOX heightened the focus placed on understanding the controls over financial reporting and identified a Type II SAS 70 report as the only acceptable method for a third party to assure a service organization's controls. Security "certifications" are excluded as acceptable substitutes for a Type II SAS 70 audit report. Audit Standard 5 (which replaced AS 2), available on the PCAOB's (www.pcaobus.org) website, details how a SAS 70 audit should be used in relation to SOX.

HIPAA

[Anonymous Coward]

HIPAA allows providers to share PHI over unencrypted email. Read the FAQ: http://www.hhs.gov/ocr/privacy/hipaa/understanding/special/healthit/safeguards.pdf

From the comments on here you would think that HIPAA requires you to safeguard your data like they are nuclear secrets.

If you store HIPAA data on a Linux server you are trusting that the Linux community has built a secure product. It's the same with a Microsoft or IBM box and the same with a Google service. If you are running your own you are also trusting that every one of your IT people are upstanding and highly competent. Personally, I trust Google to run a much more secure network than one I could build with a batch of admins that I hired. Whether Google is putting a guarantee in writing or not, the ramifications to Google if GMail, Google Apps, Appengine, Wave, etc. are not secure are huge.

That meets my definition of the HIPAA requirement for a "reasonable safeguard" but IANAL.

Not about privacy, it's about accountability

[charnov]

HIPAA isn't directly about privacy. It's about being able to hold someone accountable for accessing information. Anyone in security knows that breaches happen all the time. What matters is containment.

No, they can't read your stuff.

[Anonymous Coward]

For those with high-profile celebrity clients, simply telling them 'Google employees can read your stuff' will usually end the conversation right there.

This, and lots of other replies to this article are very, very misleading. It's not like this data is just lying around, waiting to be accessed by anyone who happens to work for Google. I'm willing to bet they have much, much tighter restrictions on accessing this data than almost any company anyone here works for. It's probably one or two engineers somewhere who could theoretically look into the database and pull some raw information out, and I imagine any such access would require authentication from another person and be heavily logged.

Considering the crap security that most companies have, I'd trust Google way more than a homegrown solution.

HIPAA is clear

[Anonymous Coward]

Tell them read the law or get a legal opinion. If the practice uses Google Apps and those apps violate HIPAA, they are breaking the law. No gray areas here. Why is it even a question? I certainly do not want my physician using non-HIPAA compliant communications with MY personal medical info. They need to get over it or take the risk themselves.

Re:HIPAA makes it clear who gets the blame for los

[DragonWriter]

The blame will go to the DOCTOR not their online data service.

Or not: under HIPAA, anyone that a covered entity contracts with to handle PHI must be covered by a Business Associate Agreement, and under the HITECH Act passed earlier this year, HIPAA security noncompliance sanctions, including civil and criminal penalties available under HIPAA, apply to parties under BAA's exactly as they do to the covered entities themselves.

I wish you could buy your own google app server

[Anonymous Coward]

I really wish google would sell google apps like it sold their search appliances. I think alot of companies would jump on board, heck if the entry point was lower enough, I'd get one for myself. Would it be much worse than maintaining an exchange server? Perhaps and that may be why it doesn't exist yet. An alternative might be to allow you to host your own data (rather than hosting the apps and data) that way you still somewhat control the actual content. (though I can see headaches ensuring that your data box remains connected to the google cloud.

Schneier on Cloud Computing

[chicago_scott]

Bruce Schneier wrote about this security implications of Cloud Computing in the June and July issues of Cryptogram.

June - Cloud Computing
July - Risks of Cloud Computing

Trojans inside OS

[Max_W]

At least Google encrypt e-mails while transmitting.

There are so many viruses and trojans lurking around that being inside the OS possibly even more dangerous.

By the way, what is inside OS? Who knows it? It is all compiled.

No.

[Hurricane78]

There. Answered it all for you.

Besides, if you take applications on the web more serious than to use them for your spam or some irrelevant stuff, then you seriously need to see a shrink.

Web apps are the SUVs of software. Except that they are as safe as a Yugo Nowhere. Slow, expensive, insecure, ugly, SLOW, shaky, INSECURE, pointless.
It's all of the "good" of the inner platform anti-pattern, all of the insecurity of a web connection, all of the slowness of scripting, and a whole lot of "made by the biggest web advertiser on the planet". ^^

Not if they're encrypted prior to upload

[SgtChaireBourne]

Confidentiality is maintained if the documents are encrypted prior to upload.

Your ISP is not a third party?

[Anonymous Coward]

So you do not consider your ISP to be a third party? All of your e-mail passes through their hands before it gets sent out to Teh Internets. Your ISP may not have access to your local address book and calender, but once you send an e-mail, your ISP can read it fully, as can certain people sitting between your ISP and the e-mail's destination. And, unless you are using encryption for your SMTP connection (which Google does), the same goes for someone sitting between you and your ISP.