For a start, as I said in my last post and many times, and at least one of these commenters has written at length, the benefits of sharing health data in clinical situations massively outweigh the risk. So that should be the focus of the discussion.
I am NOT saying that there shouldn’t be privacy protections and there is no reason in my mind why, for all HIPAA’s flaws, it cannot be extended to PHR providers as covered entities.
However, as far as I can tell nothing that is happening here violates HIPAA. Showing you keyword based advertising may not to everyone’s taste, but it does not mean your private health data is being transferred to anyone. And presumably your data will only end up in these services if you give them permission to accept it, which will include consent to provide whatever services and advertising you’ll see.
And that’s assuming that either company does advertising based on records rather than search terms (which is Google make that 98% of their money).
But exactly where are Microsoft and Google suggesting that they’re going to be selling private identified data? Nowhere. Microsoft has bent over backwards to demonstrate that they have no intention of allowing themselves or anyone else to access your health records without permission. And Google will likely do the same when it announces its plans officially.
