From the news article (I don't have time to review the source leak indepently) there doesn't seem to be anything really concerning here. The closest to an indication of anything wrong seems to be that someone raised an issue about the risk of improper employee use of data and a need for training around that in an internal meeting on the project and has not received a formal specific response on that issue from corporate leadership. Having spent a long time in HIPAA-related work, that neither that issue being raised in regard to a new project or the fact that it was raised being merely one of many inputs into a policy generating process that makes general adjustments considering a wide range of concerns, legal parameters, and other issues but not receiving a specific direct response seems...pretty typical. And HIPAA does not require notification or opt-in (or even opt-out opportunity) for data sharing between a covered entityand Business Associate, as BA’s are (while under HITECH independently subject to HIPAA privacy and security rules) basically considered institutional agents of the covered entity to which the covered entity’s authority to have and use data is delegated under the Business Associate agreement.
I don't know if there is really nothing of concern in the dump or the journalists covering it don't have enough understanding of the domain to even distinguish things that would indicate a problem, but what it looks like from the news article is a “whistleblower” making accusations and dumping docs, but nothing substantial and concrete in the docs supporting the thrust of the “whistleblower’s” accusations of wrongdoing.
Boundaries and distributions should be clearly, specifically specified, with any non-essential distributions requiring specific assent, defaulting to none. If there are consequences to sharing, those can be made known. We've been drawn into a circumstance which has long been untenable.
However, their little snafu with SureScripts and Remy Health just got them banned from accessing healthcare history - however there are pending FBI and FTC investigations regarding their mis-management of healthcare data. Worst case, the digital pharmacy Amazon just bought will be barred from sending or receiving digital prescriptions and their HIPAA accreditation will be voided for three years (with a fine).
Seems like a great way to waste a couple hundred million dollars.
> The data is being transferred with full personal details including name and medical history and can be accessed by Google staff
I think a reaction of horror is quite appropriate. Your comment is "whataboutism". Let's discuss this leak without invoking bogeymen.
I'm not going to comment on this specific case but I do have almost a decade of previous non-Google experience working in clinical documentation technology.
As others have said, entering into a BAA with a covered entity, as HIPAA defines it, shouldn't be seen as a controversial action.
There are numerous problems in healthcare that are too complex for individual health systems to tackle. For example:
* Population Health: are there emergent changes in the regional population? What do you do about it? * Continuity of Care: The number of individual providers involved in a particular person's care continues to grow. How can you effectively inform the entire team--across health systems--what's most important for an individual now? How do you make sure nobody drops the ball?
To give you an idea of the scale, I have two examples. The first is MD Anderson Cancer Center in Houston. They used to have 200+ engineers working on their sophisticated home-grown EMR. It was a huge undertaking. But even with MDACC revenue, that development was unsustainable, and they moved to a 3rd party EMR vendor.
Second is the Mayo Health System. Another huge provider with facilities not just in flagship Rochester MN, but in several other sites. Again, there were realities that even at this scale internal development isn't sustainable across the board and they wound up with a $100M+ adoption of a 3rd party vendor.
And this is mostly straight-forward CRUD-level workflows. The technology is straightforward but the workflow expertise is not.
Now, try and solve some bigger problems. You're going to need help to do this at scale, and trying to solve it necessarily means giving access--not control of!--to medical records to drive R&D. It's happening right now, and Google is not the only player doing this at scale. They're not even the largest one.
Lastly HIPAA controls have real teeth, in comparison to the general consumer space (at least in the US).
Also - The deal was only just signed, e.g. the transfer hasn't happened yet?
There's a lot of hearsay in all of this reporting...
Google has entered into similar partnerships on a much smaller scale with clients such as the Colorado Center for Personalized Medicine. But in that case all the data handed over to the search giant was encrypted, with keys being held only on the medical side.
It sounds like they are migrating to Google Cloud for some of their infrastructure.. and someone (and the paper) are sure trying to raise a stink about it. its misleading in a few spots, but not quite lying, hard to tell if its intentional, or technical incompetence.
For example, all storage in google cloud is encrypted, and the keys are rotated every 24 hours by default. There is an audit log you can see, any time anyone at google touches your data. (very, very few people can actually access the keys)
https://cloud.google.com/blog/topics/inside-google-cloud/our...
https://www.hhs.gov/hipaa/for-individuals/guidance-materials...
This is the most scary part[0]. I'm sure plenty here would disagree, but I simply don't (yet) share your optimism for A.I.
[0] Not that the rest isn't scary.
The casual data-grabbing that they're doing is most-scary to me, since I would hope that my data would never be accessible to them/others as readily as I now suspect it is.
Can I please have my life back please?
It'd be convenient if we could assume perfect personal responsibility, but human behavior doesn't align with that assumption.
Complaint Requirements
Anyone can file a health information privacy or security complaint. Your complaint must:
Be filed in writing by mail, fax, e-mail, or via the OCR Complaint Portal
Name the covered entity or business associate involved, and describe the acts or omissions, you believed violated the requirements of the Privacy, Security, or Breach Notification Rules
Be filed within 180 days of when you knew that the act or omission complained of occurred. OCR may extend the 180-day period if you can show "good cause"
I mean, filing a complaint is free but I imagine it should have a grievance attached to be taken seriously.
login, click on the wheel, and the delete link is at the bottom.
That has no effect on the central theme of the story (which is health care firms partnering with Google as a Business Associate, and thereby sharing patient data).
> Among the documents are the notes of a private meeting held by Ascension operatives involved in Project Nightingale.
The whole article is written like they are trying to tell a spy story which brings into question the credibility that there's any wrong doing.
As a UK based paper Guardian could at least focus on British issues
tl;dr: Unrelated avenue in a field they've been interested in for a long time.
Google and other large companies have made some significant AI advances in the last decade & I think it's in all of our interests to see if these advances can lead to improvements in health care.
Yes, it's scary how much data these companies have collected about us, but there are other things in the world which are even more scary, like heart attacks and cancer. I think we need to stop having an automatic knee-jerk reaction every time a company gets access to our data, especially if proper legal protocols with privacy protections are being followed, as it appears to be in this case.
Of course, I would love to live in a world with 100% perfect personal privacy AND perfect treatments for all diseases, but we don't live in that world: In our world, as we move forward, there are going to be difficult tradeoffs between health innovation and patient data access: We should try to navigate these tradeoffs in a level-headed way, without just insisting on greater walls around all data in every instance.
For different takes on the same story, "Previously" with a link to earlier discussion, may be better.
For evergreen topics (e.g., Bertrand Russell's "In Defence of Idleness", submitted many times through the years, and again a day or so back), "earlier submissions" noting the years, of 2-3 top instances, can point to earlier interesting discussion.
I'm not certain what aspect you are trying to highlight with this example, but readers should know that the MD Anderson implementation of the EPIC EMR system led to a 77% drop in income and layoffs approaching 1,000 people (2016-2017 time frame)[1][2]. I'm not up to date enough to know whether they have ever recovered.
[1] https://www.modernhealthcare.com/article/20170106/NEWS/17010...
[2] https://www.beckershospitalreview.com/finance/md-anderson-po...
You're correct in that literal books could be written about EMR adoption gone wrong. That doesn't change the fact that even super huge mega-health systems can't afford to do it all themselves.
You place more faith in HIPAA than I do. HIPAA does not protect privacy to the degree that most people assume.
> There are numerous problems in healthcare that are too complex for individual health systems to tackle.
True, but that doesn't mean that Google is the right entity to do this. In my opinion, they're the wrong entity, because Google is not exactly trustworthy.
> Google is not the only player doing this at scale. They're not even the largest one.
But they're Google. What this sort of thing means for me is that I need to start asking medical providers if they're participating in this sort of thing with Google (or other companies that I consider bad actors), so I know which ones to avoid using.
That's correct. People would be surprised at the number of HIPAA violations that happen everyday. It is, however, among the strongest and most well-enforced data privacy laws (in the US).
> True, but that doesn't mean that Google is the right entity to do this. In my opinion, they're the wrong entity, because Google is not exactly trustworthy.
You're certainly right to be concerned. I don't share your opinion about Google per se, but this is important data for our society. I'd argue that OpSec at a large provider--let's say Microsoft--is more sophisticated than a start-up. So how does an organization decide who is the "right" entity to deal with?
> But they're Google. What this sort of thing means for me is that I need to start asking medical providers if they're participating in this sort of thing with Google (or other companies that I consider bad actors), so I know which ones to avoid using.
If this is important to you, I would strongly encourage it. Our health industry is better when consumers are better informed, and can make informed decisions. Personally, it's more important to me to be able to actually know how much a procedure is going to cost rather than who owns the AI stack behind their clinical decision support system.
Can anyone elaborate?
"Google's harvest of medical data includes names and full details of millions"
is hyperbole, when
"Google partners with health system on clinical documentation research" is more accurate.
I'm a proponent of more consumer control over their data, along the lines of GDPR. You could, theoretically, request that your covered entities give you a copy and then delete all of your records from their systems at any time.
Which for consumer data Google already gives you the option to do so (e.g. takeout.google.com)
The real problem, though, is that this data was transferred without even notifying patients, let alone getting their consent.
Honesty it’s one of the areas where (in the right hands) I think the benefits of collecting large amounts of data for targeting services to people is justified.
Is Google ‘the right hands’? That’s probably worth debating.
>What about patient data? All of Google’s work with Ascension adheres to industry-wide regulations (including HIPAA) regarding patient data, and come with strict guidance on data privacy, security and usage. ... To be clear: under this arrangement, Ascension’s data cannot be used for any other purpose than for providing these services we’re offering under the agreement, and patient data cannot and will not be combined with any Google consumer data.
That said, most people do not understand how HIPAA works (I am in no way saying you are one of these people). Unless you are a healthcare provider (think doctor) or a business that is supporting those providers (think 3rd party tools built specifically for managing healthcare records) it's pretty difficult to have a legitimate HIPAA complaint made against you.
If google is able to get these, what’s stopping anyone else?
"In addition, business associates of covered entities must follow parts of the HIPAA regulations."
All vendors must comply with HIPAA laws (ie EMR systems)
Not because I think what Google did breaks HIPAA laws - there are many sub-threads below that can explain that better than I that this doesn't violate HIPAA - but rather the question helps highlight where we should truly be upset.
What Google did was legal; because of that, we should be upset that the government / regulatory bodies created an environment such that this was legal. Rallying against a publicly traded company of 100's of 1000's of employees for doing something "immoral" is not a productive use of your energy.
(The irony here is I usually am _against_ more regulation!)
It's a similar argument I made with the whole martin shkreli debacle: senators & congressmen/women got their picture day grilling him with the whole "how could you price gouge these poor, sick people?" But his consistent response was, essentially, the inverse: "How could you create an environment where this is totally 100% legal?"
But suddenly this company, Google, makes it immoral? It seems to me that if you care this much about private companies having your data, you should switch to a publicly owned healthcare system.
(i.e. the question in their minds is "Is the data safer in the source repositories?" And it's probably not).
After all, many companies trial new ideas and technology in house.
So would be insightful into what companies like Google do inhouse.
[0]: https://www.zdnet.com/article/google-employees-protest-dont-...
[1]: https://www.theverge.com/2019/7/16/20695964/google-protest-l...
[2]: https://www.cnn.com/2019/05/01/tech/google-employees-protest...
[3]: https://www.vox.com/recode/2019/6/19/18691870/google-employe...
[4]: https://www.theverge.com/2019/5/1/18525473/google-employee-s...
Last thing we should do is have radically open medical data. Some busybody parent could go out and search all the kids in in her kids' school who might have HIV or something. Or imagine all the crazies out there searching for a list of women in their town who have had abortions.
The only thing you do with open medical data is ratchet up the "crazy" in society. In an ideal world where everyone is rational, it's fine. But that world doesn't exist.
Sure, we may want to have properly-designed legislation to come up with standards across databases that make the use of such sensitive data for combining records less necessary, but we better make sure it's well designed or we could end up slowing down medical innovations.
Encouraging is fine, but in the end, consent from individuals should be obtained and if it isn't, that data should be omitted.
If that's the standard society wants to adopt, so be it- But it might come at a dramatic cost in slowing down medical innovations. Personally, that seems like a bad tradeoff to me, but who can say for sure?
You can risk your life to make it more fun, but not more healthy?
Prescriptions in the USA have only really been a thing for the century since the Harrison act, which brought drug smuggling with it.
Practically speaking, that's up to the company -- but the company needs to make sure that their clients are informed and are able to withdraw their data if they're concerned.
The larger part of what's wrong with this particular deal is that it was done in secret. Patients and doctors were not informed of this until after data has begun to be transferred. They should have been, and patients should have been given the option to remove their data from the dataset and find another health care provider if they wish.
> Personally, it's more important to me to be able to actually know how much a procedure is going to cost rather than who owns the AI stack behind their clinical decision support system.
I agree that knowing costs is very important, but we're miles away from that being a thing that is possible. In the meantime, I think it's important not to backslide in other areas such as this one.
I'd also say that my concern isn't really about who owns the stack, or the cloud. That sort of battle was lost years ago. My concern is the ability of Google to access that information.
Interesting, never heard of that. Where's the delete button?
Of course, I can't hit delete all, because I have no alternative to an Android phone other than Apple.
I think then that the example does not prove your point. It would have been vastly better, financially and medically, for MDACC to have continued with their in-house EMR.
...until they (too) fall victim to "a rogue engineer" (or a "patient") coming in and plugging something into an open USB port on the workstation.
Per their press release (https://cloud.google.com/blog/topics/inside-google-cloud/our...), Google is playing the role of a BA as a part of this deal. They have signed a business associate agreement (BAA), as HIPAA requires. This agreement will have defined the permitted uses for the PHI that Ascension is transmitting to Google.
Basically this all sounds utterly ordinary. It's 2019 and even healthcare companies want to be in The Cloud (and especially want to be associated with AI and ML). My last company stored lots PHI in AWS. AWS signed a BAA with us. Now, if someone at Google with access to this PHI misuses it (e.g., accesses it for an invalid reason or sells it on the black market), then they could be in violation of HIPAA and face penalties. But the mere fact that a covered entity is transferring data to a business associate in no way suggests a HIPAA violation its own.
(Disclosure: I work at Google, but know nothing about this project.)
As a Business Associate of a health care provider organization, with an agreement in place binding them to the same rules for that data the principal they serve would have, which is enforceable not only by the principal, and by patients, but also directly against Google by the government.
> If google is able to get these, what’s stopping anyone else?
Nothing is stopping anyone else from offering the kinds of services to health care providers and insurers that involve patient data under a BAA; most health care providers and insurers have numerous Business Associates performing various functions involving patient data, including, in many cases, large tech firms like Microsoft, Amazon, and, sure, Google. If anything, Google is behind in this space in terms of volume because of Amazon, Microsoft, and some more specialized forms in the healthcare space have stronger enterprise sales positions in general, and, especially for Microsoft and some of the more specialized forms, more established relations with firms in the space that make it a lower “activation energy” to engage those firms as BAs.
It doesn't preclude other crimes whether from hackers but doesn't technically guarantee them in Google's part. Technically the provider could have just given sensitive information like complete idiots because they were asked.
Why not?
Having said that, my job in the healthcare IT world is building interfaces, i.e. facilitating the transfer of health data from one system to another. Most likely what's going on here is Google and Ascension have a project together, and part of that project is either an interface or a data dump from Ascension to Google for the purposes stated in the article. I haven't read all the information, but generally the data will be "de-identified", which some interpret as sufficient to avoid HIPAA violations.
Neither company is small or ignorant; they both had their lawyers look at the contract and they signed off on it. So either the lawyers at both companies are mistaken or mislead, or somewhere after the initial scoping the scope changed (which, btw, happens all the time) and nobody updated legal or felt the need to update management or raise a concern
And that's concerning, regardless of which option it is. Either the legal teams at both companies are ill-informed or outright ignorant (perhaps intentionally), or there are no checks -- and no responsible project managers -- in place to prevent this from occurring. Somewhere along the line, someone should have suggested that this was perhaps not cool, and taken the issue up the chain of command. Most healthcare companies have a well established process in place for that, and I can't believe either of these would be different in that respect.
You should read what both Google and Ascension has said about this -- the data is intentionally not being de-identified, although it's not clear as to what the rationale for that decision is.
Even if it were, though, de-identification isn't actually very effective, particularly if you have easy access to a mountain of other personal data (such as Google has).
> Neither company is small or ignorant; they both had their lawyers look at the contract and they signed off on it.
I'm quite certain that, at worst, both companies think that they can get away with this legally. Even if it's entirely legal, though, that in no way means it's right or acceptable.
There are obvious concerns around data security here, but the article is very heavily distorting facts to drive outrage.
They have viewpoints which include a distrust of very powerful global corporations, and one you may or may not agree with - but it’s nowhere near ‘fake news’.
I don't know about most people here, but I wouldn't say that. Notification or being paid is beside the point. The point is that informed consent should be obtained.
You're right that blanket consent forms don't count as "informed consent" for this sort of thing because they don't actually inform you.
> Personally, that seems like a bad tradeoff to me
Which is fair -- you'd have no problem giving such consent. I, however, would not be willing to give such consent.
I put a lot of effort into reducing the amount of data that Google (and Facebook, Amazon, etc.) can get about me. If/when my medical provider just hands my data over to them, that's a very serious betrayal of trust and undermines my ability to protect myself from those companies.
I find that completely unacceptable, particularly because medical care is not exactly an optional thing.
That logic only works if you don't still benefit from the research findings that are obtained from my data. e.g. "tragedy of the commons"
What you're proposing is that everyone should be subjected to spying because it may lead to some theoretical larger good. That argument also conveniently ignores the theoretical social and personal costs of that spying.
What I'm saying is that everyone has rights that include the right to not be spied on, and a theoretical larger good is not nearly a solid enough reason to strip me of rights.
Getting consent is a way to avoid this deadlock and make everyone happy as well as ensure that nobody get trampled.
Now, while I would never give Google consent for data collection from me, that's because I have zero trust in Google. However, if we're just talking about consent in the general sense, then it's certainly possible to make an argument that would get me to agree to share data. In fact, I do so with a few entities already.
A not uncommon practice with HIPAA “disclosures” is to sign an electronic device that records the signature (and provides no evidence that the document your signature is associated with is anything like the one you were given) prior to being provided with documents. So, yeah, the practices around consent with PHI suck pretty hard.
If you inform me, then hand me a pre-printed document with a huge set of conditions on it, or worse as another response notes, simply collect my signature, it's not that I'm not enformed. It's that I'm not empowered to act on the basis of that information in any meaningful way.
It's a sham.
I'm a fan of the power of etymologies to reveal if not necessarily the present meanings of words, the paths by which they've arrived to the present. In the case of consent:
c. 1300, "agree, give assent; yield when one has the right, power, or will to oppose," from Old French consentir "agree; comply" (12c.) and directly from Latin consentire "agree, accord," literally "feel together," from assimilated form of com "with, together" (see con-) + sentire "to feel" (see sense (n.)).
https://www.etymonline.com/word/consent
(A true gem of the Internet.)
Obviously you have not.
I wouldn't say this is consent being "oversold", but rather yet another way that the concept of consent is being actively undermined into a legal fiction.
This is also why the GDPR has the provision for revoking permission to your data at any time - to counter its rights being otherwise nullified through contracts of adhesion.
Does anybody enforce this or do we just take Google at their word?
EDIT: I guess I don't understand. Once we give Google the sensitive information, how do we have any way of knowing what they do with it? I'm guessing an audit on all of Google's data is out of the question.
Yes, the DHHS Office of Civil Rights enforces HIPAA Privacy and Security rules. That enforcement is reactive of there is no independent regular compliance certification or monitoring required, however, which is a weakness, but the fact that detection of violation can lead to personal as well as institutional penalties, and that those penalties are criminal as well as civil, means it's not a risk that decision-makers tend to be willing to take on just because it would (so long as undetected) provide a business opportunity.
Can you fly under the radar and potentially get away with not doing it? Of course, anything is possible. Could a multibillion dollar internet organization beholden to shareholders and under public scrutiny get away with it? Not likely.
Can you provide a link to this requirement? The HIPAA/HITECH laws provide no requirements for an external audit (and self-audits aren't actually audits) and the HHS, as far as I know, only does small sample random audits unless a complaint was made.
While the Grauniad is trying to spin it to sound worse, the whole point is Google are providing data processing services to a valid HIPAA processor via Google Cloud, not that they nefariously bought the data to integrate it with the search results.
Much like health data stored on AWS with a dedicated internal project team could be accessed by "Amazon" staff. It's kinda the point, the google staff have been brought in to help manage the data.
I don't think that anyone is claiming they are intending to do this.