Healthcare is really in the dark ages with respect to this. True, there are many doctors offices that use computers, but nowhere near the majority do. As a previous poster stated, those offices have to shell out money for moving to EMR systems, and it's not cheap. That means that most of those health records really are in paper form. Not in a bunch of databases manned by DBA's as someone else posted. That would be nice, but it's nowhere near the truth.
Be real here - in a typical small physician's practice, they are probably using paper records. Why? Because it doesn't take a freaking IT staff to make it work and keep it working day in and day out. It costs a lot of money from that practice's perspective to initiate an EMR system and to keep it running for very little overall ROI. Once it's up and running, it may or may not be easier to deal with but the practice will probably have to change the way they do things to conform to the system's way of doing things, and that's not easy, especially for physicians. In my experience they do things a particular way for what, in their minds, is a perfectly good reason.
Let's scale this up to a hospital. Another poster stated if this was such a good thing and save so much money, why haven't hospitals already done this. It's because it's not just plopping a computer down and telling someone, "here ya go". It's a complete business process re-engineering effort on a huge scale for each and every hospital. That's not easy when you are trying to treat people at the same time and not loose critical med orders or lab reports. It normally takes a hospital a year or more to make that transition, and that's *after* they've planned it all. It's not just doctors in a hospital - it's pharmacy, labs, emergency, trauma, oncology, nursing, medication administration, medical order tracking, the list goes on.
Microsoft has HealthVault and Google has Google Health, but neither are under HIPAA guidelines as other posters have erroneously stated. While they have pushed themselves as interoperable Patient Health Record repositories, they haven't even scratched the surface, yet. And would you place your data in MS or Google, knowing that they are unregulated? Obviously the first thing they want is to be able to search that data - it's worth a fortune to the pharma companies and other researchers.