News-Record.com

The Internet search-engine giant Google is going to begin storing some patients' private medical records:

Google Inc. will begin storing the medical records of a few thousand people as it tests a long-awaited health service that's likely to raise more concerns about the volume of sensitive information entrusted to the Internet search leader.

The pilot project to be announced Thursday will involve 1,500 to 10,000 patients at the Cleveland Clinic who volunteered to an electronic transfer of their personal health records so they can be retrieved through Google's new service, which won't be open to the general public.

Each health profile, including information about prescriptions, allergies and medical histories, will be protected by a password that's also required to use other Google services such as e-mail and personalized search tools.

Google views its expansion into health records management as a logical extension because its search engine already processes millions of requests from people trying to find about more information about an injury, illness or recommended treatment.

But the health venture also will provide more fodder for privacy watchdogs who believe Google already knows too much about the interests and habits of its users as its computers log their search requests and store their e-mail discussions.

On the good side, this gives patients unprecedented access to their own medical records, which is important for people who want to take a more active role in managing their own health care.

On the bad side, data stored by Google won't, at least for now, be covered by the Health Insurance Portability and Accountability Act (HIPAA), which protects the privacy of medical records. In addition to an increased risk of privacy violations, there's at least an outside chance that the records could be used for marketing purposes.

On the good side, Google has a record of dedication to individual privacy. Under pressure from users, it developed a system to purge search records after 18 months, and two years ago it fought and won a case in which the U.S. Department of Justice wanted to examine large numbers of its records.

Would you let your records be stored by Google if it meant you could access them more freely?

I got a call last week from an individual who said he recently had applied for jobs at two area companies. He said that as part of the application process, both companies had asked him to sign forms authorizing the release of his medical records to the company. He didn't want to do that and wanted to know if the request was legal. He had a copy of only one of the releases he was asked to sign, but he faxed that over, and, yes, it did ask him to authorize release of "medical records" (without any specified limitations).

His concern was well-founded. I talked with Ronald McKinley of Cincinnati, who has served on an expertise panel for the Society for Human Resource Management. He said flatly that such a request is illegal.

"An employer has a right and an obligation to check people's backgrounds -- but not for medical information," he said, adding, "I don't know why an employer would want that, except to discriminate."

The Americans With Disabilities Act does allow an employer to inquire about an employee's ability to perform defined functions relative to a specific job, with or without certain accommodations. But it doesn't allow blanket requests for medical information.

Jose Rosenberg, director of the Greensboro Office of the U.S. Equal Employment Opportunity Commission, drew a distinction between offering someone a job contingent on his passing a physical -- which is legal -- and asking for medical information in general, which is not.

And Burton Garland Jr., a partner in the Lowenbaum Partnership, a St. Louis law firm that represents employers, says he would not advise a client to seek such a blanket release of medical information at any point in the employment process.

Of the two companies mentioned by my caller, one said it did not ever ask for medical records or medical history. (This is the one from whom my caller did not get a copy of the release.) The other acknowledged having formerly included that information in its standard form seeking authorization of information release (along with such standard items as credit histories and arrest records). But it said it has never used that form to actually seek medical records and has now revised the form to eliminate any confusion. It e-mailed me a copy of the revised form, as well.

I see this as less an investigative story than a teachable moment.

If you're applying for a job and the potential employer asks you to authorize a blanket release of your medical records, you do not have to do so. Tell the company that its request is illegal and tell it to contact its lawyers or the EEOC if it doubts you.

And if you're an employer, be very careful about what information you ask your job applicants to authorize to be released, lest you run afoul of the Americans With Disabilities Act and possibly other laws, depending on your state. If you haven't had a lawyer review the paperwork you ask your job applicants to fill out, you should.