Wal-Mart isn't waiting for the Obama administration to figure out how to digitize medical records. The World's Biggest Retailer hopes to do for electronic health records what it has done for dog food, plastic lawn chairs, and some generic drugs: make them widely accessible for a reasonable price.Instead of suburban shoppers, Wal-Mart this spring will be targeting physicians' practices with bundled hardware, software, installation, maintenance and training. Through its Sam's Club division, the New York Times reports, Wal-Mart will become a systems integrator, bundling hardware from partner Dell with software, or rather, software-as-a-service, from Massachusetts-based eClinicalWorks.

Long a target of workers groups armed with wage and benefit complaints, (among other charges) the company has been delving into the crossroads of health and IT lately.

• This week it took out a full-page ad in Roll Call, a publication for members of Congress, calling for "quality, affordable health insurance" for "every person in America."
• In October, it rolled out e-health records to all 1.4 million of its employees and their dependents.
• Since 2006 Wal-Mart has offered a list of around 350 generic prescription drugs priced at $4 for a 30-day supply. In February the list became available to physicians subscribing to Epocrates' Web-based and mobile clinical content.
• The retailer has begun building walk-in medical clinics in some stores and aims to open 2,000 nationwide within 5 - 7 years.

Wal-Mart's foray into the healthcare industry, specifically into the e-records business is laudable on its face, representing fashionable twin attributes, Change and Progress. But serious questions about privacy and security cannot be ignored.

A retailer could learn a lot by doing some very basic data mining. For example, Wal-Mart announced in January a low-price ($9) smoking cessation pack. Assuming it has access to patient data under the e-health records plan, what's to stop Wal-Mart DBAs from trolling patient profiles for smokers and sending them targeted ads and coupons for nicotine patches, gums and lozenges? The third parties involved are also potential leakers of private data. Is HIPAA enough of a privacy safeguard to keep a scenario like this from happening?

Privacy is one thing; data security is another. Many other retailers, financial firms, and even the federal government have goofed or been bamboozled by hackers and exposed customer data that was entrusted to them. Remember TJ Maxx or the Hannaford Bros. grocery chain? Or maybe Heartland Payment Systems rings a bell?

Chances are, medical patients (like customers whose transactions were processed by Heartland) won't know if their physicians are entrusting their records to a third (and sometimes fourth or fifth) party.

Before Wal-Mart gets too much further with its plans, company watchdogs and potential customers (and their customers, i.e. patients) need to ask more questions. A lot more questions. As of this writing, there's not a word about the Wal-Mart e-records initiative on WakeUp Wal-Mart, a Web site which bills itself as "America's campaign to change Wal-Mart."