Google Apps and Privacy

About a week ago, there was an interesting Slashdot posting about privacy of data and Google Apps, specifically in respect to HIPAA compliance and legal liability. Based on the very interesting train of comments, it seems that using Google Apps for medical data would not be HIPAA-compliant because the data is not stored in an encrypted form. I certainly don't claim to be very familiar with either HIPAA or Google's Terms of Service, but that does sound like it could be a problem.

More importantly, though, is the point raised that Google employees can read your data. This is something that most people don't really think about. I had an interesting conversation with a fellow TJ student once. As a sysadmin, I had access to the mail system, and I mentioned that the nature of having administrator access was that we could read students' TJ e-mail if we wanted to, but that we were highly unlikely to do so. This student wasn't very comfortable hearing this, so I also brought up that using any other mail system like Gmail had the same issue. For some reason, this person was more comfortable with strangers having access to her data than a fellow student. If I remember correctly, the rationale was that some information (e.g. personal relationships, etc.) could be more damaging in my hands than in the hands of a total stranger. At the same time, that's saying you would trust a random stranger with your most personal secrets more than you would another responsible student (because becoming a student sysadmin is not as easy as "here you go") at the school you attend. And yet, as illogical as that seems, more and more people opt to go this route. For instance, people will blog or post things online but then are surprised when other people find it and it gets used against them (the classic example is a prospective employer finding an embarrassing photographs of or information about you online).

Back to the original topic, then. While Google Apps offers a lot of benefits, including low cost (it's free unless you opt for a premium version) and familiarity (just about everyone has a personal Gmail account and finds Google products easy to use), there are times you want to consider the implications of putting things in the hands of people that you don't really know. There is a reason, after all, that passwords and other sensitive information aren't supposed to be sent in e-mails. But let's say that every employee that works for a company handling your data is trustworthy. You still have to deal with the possibility that data is accidentally mishandled or lost, because even with the best intentions, accidents do happen ("lost laptop with thousands of Social Security Numbers" ring a bell?). That is, after all, the definition of an accident.

So the next time you choose to use a public service for storing or transmitting potentially sensitive information, consider not only the benefits, but also the implications of doing so. And if you're in healthcare, I advise you to do your research thoroughly, and consider whether or not your patients would approve of the way your data is being handled. But who knows, these days it's possible plenty of people would be quite happy with their private health information in the hands of computer nerds they've never met.