I work in healthcare myself and I concur with your statement that few people really understand what HIPAA is and what it covers especially when it comes to telecommunications. It’s viewed as this magical privacy shield that when you say “HIPAA Compliant” suddenly everything is more secure.

From an IT perspective it’s as easy as: have your web server behind a good firewall, log server access, use good passwords and SSL, and store your data encrypted. This is all HIPAA compliant security is — and it’s better security than how your patient records are normally kept. Also, I’d place bets that Google Health is more secure than most current PHR systems that are out there.

Beyond the server security, HIPAA just introduces liability and restricts sharing, which would complicate if not outright kill the features that make Google Health useful.

Part of the problem is that HIPAA covered entities (CE) see themselves as competitors to patient-controlled accounts when it comes to networking information and are using HIPAA strategically. Should any CE have a default right to communicate private health information beyond its firewall without informed consent? Should every patient that declares to their CE that they have a PHR be allowed to request that *all* sharing go through the PHR account that they designate?