Google Now Has Access to Millions of Medical Records

Google recently announced its newest healthcare partnership is with nonprofit Ascension. With 150 hospitals in 20 states, Ascension is the United States’ second-largest hospital system. This immense size will certainly come in handy to achieve the partnership’s main objective: The two organizations will work together to analyze the medical data of millions of patients in an effort to improve healthcare services.

To build and improve many modern medical applications, it is necessary to leverage insights from real patient data spanning decades. But the parties involved in handling the data are obviously not immune to scrutiny — especially if the organizations in question are already embroiled in legal battles over data privacy like Google is.

Google’s Race to Catch Up in Healthcare

Compared to other tech titans involved in healthcare, Google is a straggler. Apple’s Watch and iPhone now work with virtual medical research. Microsoft is helping medical systems share data using cloud-enabled tools. And Amazon is working with JPMorgan Chase and Berkshire Hathaway to improve medical care and costs for their employees.

Just earlier this month, Google publicly disclosed its intention to acquire Fitbit for $2.1 billion. But because of Google’s reach into the average consumer’s life, this deal was immediately met with skepticism and fear. To address these health data privacy concerns, the company claimed it wouldn’t use Fitbit’s health data for its advertising endeavors.

Google’s partnership with Ascension requires no permission from any patient or government regulator. In the U.S., it’s legal for medical facilities to share patient data with business partners, such as electronic health record companies.

Dianne Bourque is a lawyer specializing in health law. She says HIPAA protects patients but also aims to improve healthcare quality. She says, “If you’re shocked that your entire medical record just went to a giant company like Google, it doesn’t make you feel better that it’s reasonable under HIPAA. But it is.”

Data Privacy Concerns

The two organizations are already developing software allowing providers to filter a patient’s electronic health data by categories. The provider can even create graphs using the information. Seeing blood sugar levels by visit over time is easier to digest than reading a table of values. Ideally, providers would be able to improve patient care and treatment plans because of better data features.

Google is also working on developing artificial intelligence (AI) that can read electronic health records and predict or identify maladies. To improve machine learning models, it’s normal to train them on mountains of data. What’s concerning about this is the fact that numerous Google employees working on this AI initiative now have access to Ascension’s data. This means they may be able to see information like name, race, birthday, treatment history, and illness documentation.

A few Ascension employees have already raised concerns with Google employees downloading patient health data. They’re also concerned about if the Google software complies with federal HIPAA privacy laws and regulations.

In an official announcement, however, Ascension noted that the deal is compliant with laws and regulations. The software, they said, aligns with Ascension’s “strict requirements for data handling.” The company stores its data in a private repository on Google’s cloud platform. Ascension said Google would not be able to use the data for any reason other than developing applications for Ascension providers.

Exactly how many patient records are already in Google Cloud is unknown.

Google’s Legal Battles

Google has paid several hefty fines for violating privacy laws, and it’s fighting fines for violating anti-trust laws.

In 2017, it was found that London-based medical provider, Royal Free National Health Service Foundation Trust (RFNHSFT), violated data protection laws when it gave patient health records to DeepMind without letting patients know beforehand. DeepMind is an AI lab owned by Google’s parent company, Alphabet.

In 2018, DeepMind announced it was transferring the RFNHSFT medical records team to Google after it previously said it wouldn’t link Google accounts to patient data.

In June 2019, the University of Chicago, its medical center, and Google were sued in a potential class-action lawsuit. The lawsuit alleges that the medical center shared hundreds of thousands of medical records with Google without properly expunging the records of identifiable and sensitive information. Dates of visits and treatments were also still attached to the records, which later became a topic of contention when Google confirmed its use of the UC Medical Center records from 2009 to 2016.

Normally, having timestamps of visits and procedures is helpful for establishing timelines. But, the lawsuit alleges, Google mapped those timestamps to time-based data from other Google applications, like location data from mobile phones.

Because timestamps aren’t classified as identifiable information, Google said in a statement, the company complied with HIPAA law. As a result, the company has filed for the lawsuit to be dismissed.

What’s Next?

Ultimately, all Ascencion patient data may eventually be uploaded to Google Cloud. Tariq Shaukat, the president of Google Cloud, says Ascension’s computing infrastructure will be moved to the cloud. Google’s cloud platform will also host Ascension’s other tools for doctors and nurses.

To alleviate any concerns, Tariq has stated that, “All work related to Ascension’s engagement with Google is HIPAA-compliant and underpinned by a robust data security and protection effort.” Further, Tariq emphasized that the partnership aims “to transform the delivery of health care.”

The number of patient records that Ascension deals with comes close to 50 million. When doctors have to file HIPAA requests to gain access to a patient’s data, why shouldn’t we impose the same regulations on Google?

What do you think of Google’s recent partnership with Ascension and planned acquisition of Fitbit? Do you think it will lead to a healthier future for us all? Or are you worried about how the tech titan may use all of this new information? Let us know your thoughts in the comments!