Microsoft's HealthVault: Putting Medical Information on the Web Offers Great Promise and Great Risk

Implications: Microsoft's HealthVault will store medical information in an encrypted database available via the Web. In addition, there will be access to health information available to the public. Putting secured health data online seems like a great idea provided that personal information remains out of reach of those that will take advantage of it.

Analysis: The benefits of putting secure medical information on the web are appealing. Not only can individual data be made available to a physician no matter where a patient may be, but emergency personnel will be able to quickly review medical histories, drug allergies, and other critical information. Taken further, statistical analysis can be obtained for patients using a particular medication or after a new type of medical procedure.

On the other hand, the potential for abuse of this system leads to some truly frightening possibilities. Phishing scams, hackers, and even unethical health care professionals with purportedly legitimate access will certainly gain access to some data. Once this personal information is in the wrong hands, there will be no putting the genie back in the bottle. Simply changing account numbers won't do it, and there is no way for personal information to be retrieved once exposed. If hereditary predisposition to illness exists, this information could be used for blackmail or as a basis for discrimination.

Of course, great rewards often carry great risks. The key for Microsoft (or anyone else) is to demonstrate that the benefits outweigh the risks. In order to be of most benefit, a health database system will need to be set up as an internationally recognized standard that can be used with existing health systems. Microsoft's track record in providing open source software is spotty at best, so it remains to be seen how much acceptance the HealthVault system will garner among insurers, health care providers, and others who will be the users of the information.