Both the HHS Office for Civil Rights (OCR) and top lawmakers on the House Committee on Energy and Commerce are looking into whether Google and St. Louis-based Ascension violated HIPAA regulations as part of a project they’re conducting.[1] The investigations come following multiple press reports that Ascension had inappropriately shared protected health information (PHI) with Google.
Last month, Ascension said it had signed a three-pronged deal. Two parts of the deal involve Ascension working with Google to transition to Google’s cloud platform and to transition its G Suite productivity and collaboration tools.
“While we appreciate your efforts to provide the public with further information about Project Nightingale, this initiative raises serious privacy concerns,” Pallone and the subcommittee chairs wrote. “For example, longstanding questions related to Google’s commitment to protecting the privacy of its own users’ data raise serious concerns about whether Google can be a good steward of patients’ personal health information.”
Pallone and the subcommittee chairs also cited reports that Google employees had access to and could download the information, and raised concerns about Ascension’s decision not to notify patients that Google would have access to their PHI.
Google has come under fire before over privacy issues. In June, the University of Chicago Medical Center and Google were sued in a potential class action lawsuit that accuses the hospital of sharing with Google hundreds of thousands of patients’ records without first stripping off potentially identifying information, such as doctors’ notes and date stamps.[4] Google said it followed HIPAA rules in that case, and the medical center denied the allegations.
Concerns also have been raised about Google’s role in a deal involving imaging supplied by the National Institutes of Health (NIH). In that incident, Google was about to post more than 100,000 chest X-rays online when it was told that some of them still contained potentially identifying details, The Washington Post reported.[5]
The incident, which took place in 2017, was intended to showcase how Google’s machine learning tool, TensorFlow, could be used to train computers to understand which images contained the markings of different diseases. Google also planned to make the raw X-ray data available to outside artificial intelligence researchers via its cloud.
NIH shared the images with Google employees in the summer of 2017, and the Post reported that NIH and Google worked together to scrub personal data from the files. Still, as Google prepared to post the images, NIH contacted Google to say its researchers found dozens of images with personally identifying information, including dates for the X-rays and distinctive jewelry patients were wearing when the X-rays were taken. Google deleted all of the images over privacy concerns and told NIH it would not move forward with the project, according to the article.
