Google's harvest of medical data includes names and full details of millions

A not uncommon practice with HIPAA “disclosures” is to sign an electronic device that records the signature (and provides no evidence that the document your signature is associated with is anything like the one you were given) prior to being provided with documents. So, yeah, the practices around consent with PHI suck pretty hard.

Obviously you have not.

I wouldn't say this is consent being "oversold", but rather yet another way that the concept of consent is being actively undermined into a legal fiction.

This is also why the GDPR has the provision for revoking permission to your data at any time - to counter its rights being otherwise nullified through contracts of adhesion.

I think then that the example does not prove your point. It would have been vastly better, financially and medically, for MDACC to have continued with their in-house EMR.

Practically speaking, that's up to the company -- but the company needs to make sure that their clients are informed and are able to withdraw their data if they're concerned.

The larger part of what's wrong with this particular deal is that it was done in secret. Patients and doctors were not informed of this until after data has begun to be transferred. They should have been, and patients should have been given the option to remove their data from the dataset and find another health care provider if they wish.

> Personally, it's more important to me to be able to actually know how much a procedure is going to cost rather than who owns the AI stack behind their clinical decision support system.

I agree that knowing costs is very important, but we're miles away from that being a thing that is possible. In the meantime, I think it's important not to backslide in other areas such as this one.

I'd also say that my concern isn't really about who owns the stack, or the cloud. That sort of battle was lost years ago. My concern is the ability of Google to access that information.

Interesting, never heard of that. Where's the delete button?

Of course, I can't hit delete all, because I have no alternative to an Android phone other than Apple.

There are obvious concerns around data security here, but the article is very heavily distorting facts to drive outrage.

Does anybody enforce this or do we just take Google at their word?

Per their press release (https://cloud.google.com/blog/topics/inside-google-cloud/our...), Google is playing the role of a BA as a part of this deal. They have signed a business associate agreement (BAA), as HIPAA requires. This agreement will have defined the permitted uses for the PHI that Ascension is transmitting to Google.

Basically this all sounds utterly ordinary. It's 2019 and even healthcare companies want to be in The Cloud (and especially want to be associated with AI and ML). My last company stored lots PHI in AWS. AWS signed a BAA with us. Now, if someone at Google with access to this PHI misuses it (e.g., accesses it for an invalid reason or sells it on the black market), then they could be in violation of HIPAA and face penalties. But the mere fact that a covered entity is transferring data to a business associate in no way suggests a HIPAA violation its own.

(Disclosure: I work at Google, but know nothing about this project.)

As a Business Associate of a health care provider organization, with an agreement in place binding them to the same rules for that data the principal they serve would have, which is enforceable not only by the principal, and by patients, but also directly against Google by the government.

> If google is able to get these, what’s stopping anyone else?

Nothing is stopping anyone else from offering the kinds of services to health care providers and insurers that involve patient data under a BAA; most health care providers and insurers have numerous Business Associates performing various functions involving patient data, including, in many cases, large tech firms like Microsoft, Amazon, and, sure, Google. If anything, Google is behind in this space in terms of volume because of Amazon, Microsoft, and some more specialized forms in the healthcare space have stronger enterprise sales positions in general, and, especially for Microsoft and some of the more specialized forms, more established relations with firms in the space that make it a lower “activation energy” to engage those firms as BAs.

It doesn't preclude other crimes whether from hackers but doesn't technically guarantee them in Google's part. Technically the provider could have just given sensitive information like complete idiots because they were asked.

Why not?

Having said that, my job in the healthcare IT world is building interfaces, i.e. facilitating the transfer of health data from one system to another. Most likely what's going on here is Google and Ascension have a project together, and part of that project is either an interface or a data dump from Ascension to Google for the purposes stated in the article. I haven't read all the information, but generally the data will be "de-identified", which some interpret as sufficient to avoid HIPAA violations.

Neither company is small or ignorant; they both had their lawyers look at the contract and they signed off on it. So either the lawyers at both companies are mistaken or mislead, or somewhere after the initial scoping the scope changed (which, btw, happens all the time) and nobody updated legal or felt the need to update management or raise a concern

And that's concerning, regardless of which option it is. Either the legal teams at both companies are ill-informed or outright ignorant (perhaps intentionally), or there are no checks -- and no responsible project managers -- in place to prevent this from occurring. Somewhere along the line, someone should have suggested that this was perhaps not cool, and taken the issue up the chain of command. Most healthcare companies have a well established process in place for that, and I can't believe either of these would be different in that respect.

You can risk your life to make it more fun, but not more healthy?

Prescriptions in the USA have only really been a thing for the century since the Harrison act, which brought drug smuggling with it.

I don't know about most people here, but I wouldn't say that. Notification or being paid is beside the point. The point is that informed consent should be obtained.

You're right that blanket consent forms don't count as "informed consent" for this sort of thing because they don't actually inform you.

> Personally, that seems like a bad tradeoff to me

Which is fair -- you'd have no problem giving such consent. I, however, would not be willing to give such consent.

I put a lot of effort into reducing the amount of data that Google (and Facebook, Amazon, etc.) can get about me. If/when my medical provider just hands my data over to them, that's a very serious betrayal of trust and undermines my ability to protect myself from those companies.

I find that completely unacceptable, particularly because medical care is not exactly an optional thing.