So would a logged-in search for, say, "rheumatoid arthritis" or specific drug names be out of the question if it's in the context of finding treatments for a patient? And does HIPAA also block a family practitioner from using Drive to track patient histories?

Yes you can't store patient data on google drive.

There are plenty of practice management cloud solutions with cloud storage support which are hipaa compliant.

Thank you for the clarification!

Swinging back to topic: Microsoft has traditionally had a good rapport with the business / government space, so I'll be shocked if they don't already have a plan for addressing the need to protect private data. Maybe the enterprise solution version of Windows 10 will have this feature off by default?

There is a nod to Enterprise. The minimum value for HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection\AllowTelemetry is 0 on win10 Enterprise, and 1 on consumer editions. (I believe the default value is 3. Lower is more private, but lowest is not offered to consumers)

Like people mentioned there are different settings for Enterprise SKU's including different settings for different verticals (e.g. education or health industry).

For example Office 365 for Healthcare which is HIPAA compliant has probably quite a different privacy policy and out of the box authentication, encryption and right management settings than what you would get as an individual or even by buying Office 365 for business editions.

http://www.microsoft.com/en-us/health/products/office365/def...

Not saying that's right, but most companies that provide free/subsidizes consumer services including companies like Google tend to have quite a different SLA and service terms for corporate customers.