Google Health, an online repository of users' medical records, is not covered by the Health Insurance Privacy and Portability Accountability Act of 1996, which is designed to protect this very information. But Google is not a "covered entity" and therefore doesn't have to comply with the law. This raises serious concerns for some, but others suggest it's a good thing that Google Health and HealthVault, a similar service from Microsoft, are not covered by HIPAA. They say going through the HIPAA process creates mountains of data, much of which is redundant. Important facts — allergies to a medication, for instance — will get buried and, certainly, not be accessed during an emergency. Will HIPAA evolve as the amount of patient information increases?