Quoted Text

Microsoft Wants Your Medical Records
By: Jon VanZile  

Medical records are available only to a few people, including you and your doctor. But the idea that your most private medical records may be housed by a private company like Microsoft, and accessible to strangers with a few keystrokes, has privacy advocates concerned.

Microsoft, the $51 billion computer-software giant, is not satisfied with simply being the major systems provider for most computers in America -- it also wants to hold your personal medical records, and everyone else's in the country.

The Redmond, Wash.-based firm started by Bill Gates sees this as good business, and even plans to offer advertising along with computerized searches of your records.

"Our goal is to become an advertising powerhouse," Microsoft CEO Steve Ballmer tells Advertising Age. "Today, we're the No. 3 seller of Internet ads. We're determined to allocate the talent, the resources, the money, and the innovation to be the pre-eminent software provider for advertisers, publishers, and agencies. We have all the pieces we need to succeed."

Microsoft says today’s health care recordkeeping is messy and not ready for the digital world. The company plans to do something about it.

But the idea that your most private medical records may be housed by a private company, and accessible to strangers with a few keystrokes, has privacy advocates concerned.

In early October, the software giant introduced HealthVault, an online service that allows people to store their medical records for easy access and retrieval. The service is free to consumers and physicians. Files can be uploaded directly by doctors and patients in a number of formats, and each account has multiple layers of access privileges.

The HealthVault program is part of Microsoft’s goal to become an advertiser-driven business. Ballmer tells Advertising Age that his company hopes that advertising will generate up to 25 percent of its revenues within the next decade.

Microsoft is investing heavily in its advertising capability. In 2007, it spent about $1 billion on research and development in its MSN Internet unit, which includes adCenter, its Internet pay-per-click advertising unit. That compares to $500 million spent in 2005, according to an InfoWorld.com report. In May, Microsoft invested $6 billion to acquire aQuantive, a digital marketing services agency with 2,600 employees that it's banking on to further boost its Internet advertising business.

Microsoft’s money-making plan for HealthVault involves interweaving a health-centric search engine with the document database -- and offering advertising with the searches. The market could be enormous. According to a Harris Interactive poll, 76 percent of adult Americans over age 55 use the Internet to research health conditions.


Just How Safe?

Medical records contain some of the most private sensitive information any person might have. Disclosure of chronic diseases can affect careers, relationships, and even social standing.

So just how safe are these records?

Probably less secure than most people appreciate -- and if Microsoft's HealthVault grows into a national medical records storehouse, they might not be protected at all under federal law.

Under the federal medical privacy law, known as HIPAA, health records can be disclosed by your doctor's office to a few entities without your permission. This includes any company involved in treatment, payment, or health care operations, such as a doctor's office, billing agency, or insurance company.

HealthVault occupies a murky territory somewhere in between.

A Microsoft spokesperson tells eWeek magazine that HealthVault will be covered under "HIPAA considerations," but the extent of actual coverage is unknown, according to Paul Stephens, director of policy and advocacy for Privacy Rights Clearinghouse, a nonprofit, nonpartisan consumer-education group.

It probably will require a court challenge before anybody knows for sure, and Stephens thinks it unlikely that Microsoft would go to court to defend any single person's right to privacy.

"It would be prohibitively expensive," Stephens says.


The Perfect Answer

As far as Microsoft sees it, HealthVault is the perfect answer to one of the most pressing problems for American families -- the convoluted health care system. But critics urge caution.

If HealthVault is successful, it will pool an enormous amount of the most sensitive medical information in one place, creating an unprecedented national medical record. Such a record would be vulnerable to hackers and subpoenas alike, not to mention earthquakes and terrorist attacks.

"That poses significant risks," says Stephens. "First of all, as we're seeing with telephone companies, the federal government can obtain information under the guise of national security."

In recent years, telecommunications companies have come under scrutiny for participating in a federal call-monitoring program aimed at detecting terrorist activity. In some cases, domestic phone records were provided to the FBI voluntarily, without subpoenas.

According to Stephens, a national medical record may be just as irresistible to government data-mining operations. "The government feels it can obtain information about potential terrorists by mining billions of pieces of data," he says.

Such a concentration of private medical records may also prove irresistible to lawyers.

"Under the current system, lawyers would have to know all your medical providers and physically go to each place to secure records," Stephens says. "But the likelihood is that if Microsoft receives a subpoena, they're going to fulfill it because it would become prohibitively expensive to contest every subpoena."

And, finally, of course there is the threat posed by a natural disaster, terrorist attack, or computer hacker. If Microsoft's servers were disrupted for any reason, whoever had stored files in HealthVault would lose them. In an emergency, this could be catastrophic.

Microsoft believes it has addressed these issues.

At HealthVault's October debut, Peter Neupert, corporate vice president for Microsoft’s health solutions group, said the company was using secure, physically isolated servers; the entire system is encrypted and totally controlled by users; and the company has pledged never to release health-related information to marketing organizations.

"This is about the family health manager, and creating an information system that works for them," Neupert said. "We need to make this information reusable. We need to make it accessible."

Neupert faulted the current health care records system, with its multiple forms and many clipboards, as overwhelming for the average "family health care manager," usually a mother, who is responsible for herself, her children and her husband, and, often, elderly parents as well.

"These women want tools to simplify their interactions with the health delivery system," Neupert says. "They want an information system that puts them at the center, that makes it easy to manage their health. And we can do that."

So far, industry reaction to HealthVault has been cautious. Few health care providers are participating, according to Privacy Rights Clearinghouse, and success with the system depends on large-scale involvement.

As for Stephens, he says he won't trust his medical information to Microsoft any time soon.

"My preference is that people maintain their own health information in both paper and electronic forms on a thumb USB drive," he says. "There is a great deal of utility in having medical records in one place, but the question is where do you want to keep it?"

Quoted Text

"This is about the family health manager, and creating an information system that works for them," Neupert said. "We need to make this information reusable. We need to make it accessible."

Neupert faulted the current health care records system, with its multiple forms and many clipboards, as overwhelming for the average "family health care manager," usually a mother, who is responsible for herself, her children and her husband, and, often, elderly parents as well.

"These women want tools to simplify their interactions with the health delivery system," Neupert says. "They want an information system that puts them at the center, that makes it easy to manage their health. And we can do that."

Quoted Text

At HealthVault's October debut, Peter Neupert, corporate vice president for Microsoft’s health solutions group, said the company was using secure, physically isolated servers; the entire system is encrypted and totally controlled by users; and the company has pledged never to release health-related information to marketing organizations