If you've ever tried to collect all your medical records, you know how difficult that may be. Records are usually spread out across several different hospitals and offices. Keeping electronic records in one place would seem ideal.

However, now that big companies like Microsoft and Google are getting into the medical record storage business, a fascinating piece in this week’s New England Journal of Medicine raises important questions about whether medical privacy rules should be extended to these private firms. All you have to do is order a book on Amazon and you can quickly see how every move you make online is tracked by marketers.

The authors of The New England Journal article say there are still more questions than answers about the new “personalized health information economy.'’

For example, Microsoft and Google are not bound by the privacy restrictions of the Health Insurance Portability and Accountability Act, or Hipaa, the main law that regulates personal data handling and patient privacy. Hipaa, enacted in 1996, did not anticipate Web-based health records systems like the ones Microsoft and Google now offer.

The authors say that consumer control of personal data under the new, unregulated Web systems could open the door to all kinds of marketing and false advertising from parties eager for valuable patient information.

Even more surprising is the response of Peter Neupert, the vice president in charge of Microsoft’s health group, who resisted the suggestion of extending Hipaa to newcomers like Microsoft and Google.