Google plans to store personal medical records

SAN FRANCISCO - Google Inc. will begin storing the medical records of a few thousand people as it tests a long-awaited health service that's likely to raise more concerns about the volume of sensitive information entrusted to the Internet search leader.

The pilot project announced Thursday will involve 1,500 to 10,000 patients at the Cleveland Clinic who volunteered to an electronic transfer of their personal health records so they can be retrieved through Google's new service, which won't be open to the general public.

Each health profile, including information about prescriptions, allergies and medical histories, will be protected by a password that's also required to use other Google services.

Google views its expansion into health records management as a logical extension because its search engine already processes millions of requests from people trying to find more information about an injury, illness or recommended treatment.

But the health venture also will provide more fodder for critics who believe Google already knows too much about the interests and habits of its users as its computers log their search requests and store their e-mail discussions.

Prodded by the criticism, Google last year introduced a new system that purges people's search records after 18 months. In a show of its privacy commitment, Google also successfully rebuffed the U.S. Justice Department's demand to examine millions of its users' search requests in a court battle two years ago.

The Mountain View, Calif.-based company hasn't specified a timetable for unveiling the health service, which has been the source of much speculation for the past two years. Marissa Mayer, the Google executive overseeing the health project, has previously said the service would debut in 2008.

The clinic already keeps the personal health records of more than 120,000 patients on its own online service called MyChart. Patients who transfer the information to Google would still be able to get the data quickly even if they were no longer being treated by the Cleveland Clinic.

"We believe patients should be able to easily access and manage their own health information," Mayer said in a statement supplied by the Cleveland Clinic.

The Cleveland Clinic decided to work with Google "to create a more efficient and effective national health care system," said C. Martin Harris, the medical center's chief information officer.

Google isn't the first high-tech heavyweight to set up an online filing cabinet in an effort to make it easier for people to get their medical records after they change doctors or health insurance plans.

Rival Microsoft Corp. last year introduced a similar service called HealthVault, and AOL co-founder Steve Case is backing Revolution Health, which also offers online tools for managing personal health histories.

Passed in 1996, HIPAA established strict standards governing the privacy and security of medical records. Among other things, the law requires a patient to be notified when his or her records are being subpoenaed. The notice must be made by the entity or person seeking the records so a patient has the opportunity to fight the request.

That means a patient who agrees to transfer medical records to an external health service run by Google or Microsoft could be unwittingly making it easier for the government or some legal adversary to obtain the information, Dixon said.

If the medical records aren't protected by HIPAA, the information conceivably also could be used for marketing purposes.

Google, which runs the Internet's most lucrative ad network, typically bases its marketing messages on search requests and the content on Web pages and e-mail contained in its computers.