Hacker News Reader

I've seen a ton of responses from people in the industry along the lines of "this is normal" or similar. People who work on this stuff are incredulous that there's even an issue, since everyone's health info is already being uploaded to AWS or something. This is business as usual, they say.

The uproar is taken by people actually working in the business as a sign that the public are ignorant and misinformed. Things are actually HIPPA compliant, they say. This isn't a big deal, they say.

But perhaps the education should be going in the other direction, and the people in the industry should realize they are the ignorant ones for realizing that this is totally not OK for a huge number of people.

Realize that we are absolutely horrified that this data is being shared, that a reasonable response is to say that if HIPPA is OK with this then we need stronger laws, that we don't want faceless algorithms studying our most intimate personal and medical issues at companies we never had a relationship with.

And, especially, we are absolutely fucking certain that we want literally none of it to be seen by employees of the sociopathic tech companies that are surveilling every aspect of our life in order to better manipulate politics, markets, and our society.

The thing to take away here is that people are shocked and horrified at what's apparently business as usual.

But if they're just using Google as cloud storage/compute it's not being shared. Only very few Google employees would have access, they'd have very careful limitations and access on who accessed what - that's not the same as giving to google for some big AI experiment.

> Only very few Google employees would have access

That's "very few" Google employees more than zero. I expect zero Google employees to have access to my medical data. Any number above zero is absolutely not acceptable to me.

> they'd have very careful limitations and access on who accessed what

Yeah, just like Equifax, right?

> That's "very few" Google employees more than zero. I expect zero Google employees to have access to my medical data. Any number above zero is absolutely not acceptable to me.

Heck, people owning my medical data who are not my doctor/GP and related medical professionals is a big no go in my opinion.

Medical data is rather private.

> Heck, people owning my medical data who are not my doctor/GP and related medical professionals is a big no go in my opinion.

Not even "owning", but having.

Having even "anonymized" data is not acceptable to me.

I share that perception. For me, this is a sign that people working with the data, probably should not work with this data. They don't really make a good case.

And saying this is business as usual is extremely disingenuous, since the distribution of information was completely different just a few years ago.

One of the challenges is how do you distinguish the kinds of outrage? It seems to me like the majority of outrage is based on falsehood (Ascension is selling data to Google to use for ads). Then there are some people where the very idea of medical data being managed by cloud providers is unacceptable. The presence of the first shadows the latter and makes the whole thing come across as misinformed.

> Realize that we are absolutely horrified that this data is being shared, that a reasonable response is to say that if HIPPA is OK with this then we need stronger laws, that we don't want faceless algorithms studying our most intimate personal and medical issues at companies we never had a relationship with.

I absolutely 150% agree with you and I know others off of HN who do as well.

> we don't want faceless algorithms studying our most intimate personal and medical issues

So you don't want an advanced algorithm to analyze your vitals and detect your cancer at an early stage?

Technology has more than doubled our life expectancy. More technology could do even more so. The fact that it's a faceless algorithm, and not a creepy biased human, should be a comfort. But you're reacting like this is all going to harm you, when it's way more likely to do the opposite.

> we are absolutely horrified that this data is being shared

People always fear the things they don't understand. That doesn't mean that fear is justified, by a long shot.

> So you don't want an advanced algorithm to analyze your vitals and detect your cancer at an early stage?

That’s correct, I don’t want that.

And if one day I change my mind and make the choice to opt-in to a system that works like that, I still won’t ever want Google to be involved in it.

Given that early detection increases chances of survival[1] considerably, you may not have a chance to opt-in later. Which raises interesting questions about whether society might force you to participate in having your data analyzed, similar to say, vaccinating.

1: https://www.canaryfoundation.org/wp-content/uploads/EarlyDet...

Oh, I see. A brand's values and reputation, as well as your own personal choices, are more important to you than your health.

From the original WSJ article...

> Staffers across Alphabet Inc., Google’s parent, have access to the patient information, documents show, including some employees of Google Brain, a research science division credited with some of the company’s biggest breakthroughs.

I'm struck by the wide access of those within Alphabet to health information that's not anonymous.

Is this how other healthcare companies are doing it?

One reading of this is that it's a cross-departmental collaboration, rather than just a single division.

Maybe and sort of.

Alphabet is a conglomerate, right. Alphabet is the parent company that owns Google, LLC. I'm personally surprised to see talk of the data crossing the Google / Alphabet company boundary. That makes it cross company collaboration, right?

That's the difference everyone here is talking about though. Normally in the healthcare industry, you engage a cloud provider, and it's "you store this data for us." Full Stop. You don't look at it. You don't analyze it. You don't share it. You don't touch it. It's our data, not yours.

If what you're saying is true, Ascension, for some reason, has a deal with its cloud provider that allows Google to search through, analyze, etc etc etc. It sounds like all sorts of rights were given to Google. That's an irregular agreement. It's not normally how things are done.

That's a very naive view of what happens. It's exactly how things are done, except that it's a one-stop shop.

The reality is that there is a fig leaf of privacy. HIPPA protects you from the office staff gossiping about your medical conditions. When you are admitted to the hospital, your prescriptions are sent to data aggregators in near real-time, your claims are sent to your insurer and subrogation in near real-time, etc.

Each one of these downstream providers perform their own analysis on the data. The prescription data is sold to pharmaceutical companies and wholesalers to provide KPIs for the sales organization. The insurance and subrogation people sell de-personalized data to marketing companies. The marketing companies can trivially figure out who most people are.

The end result is that you can easily get a list of every person in a zipcode who is pregnant (with estimated due date), has diabetes, had a stroke, etc.

We're talking about cloud providers here, not pharmaceutical or insurance providers. There are different levels of interaction required to accomplish different operational objectives. Giving a cloud provider this sort of access is, as I said initially, highly irregular. There is just not that same level of collaboration needed with your cloud provider.

Just as a for instance, there are very good operational reasons on your side that pharmaceutical partners need the data to be reasonably certain that the 1000 doses of highly controlled substance X that they previously sent to you, or distributed on your behalf, were administered to people who both required the medication, and who actually exist. That pharmaceutical partner needs to have the ability to be certain of this prior to sending you, or distributing for you, the 10000 additional doses you are all of a sudden requesting.

By contrast, there is no operational reason on your side that a cloud provider needs to know the names and addresses of the patients in your database.

Cloud providers can provide all sorts of services. Who says they are just selling dumb storage services?

If you use Office 365, they process your data to do analytics. Some they expose to you (Delve, MyAnalytics), others they don’t.

In government, they do even more. Medicaid systems are usually run by third parties, who also sell services to providers to optimize billing.

> I work for a large US based corp that focuses on technology and data services for the healthcare field. We have massive amounts of PHI for the majority of people who have visited a provider within the country.

The real question here is: why can't I opt-out ? I want a easy button when I do anything medical to say "no, don't use my health data for any of this stuff". And the current CA privacy law does not provide this, unlike GDPR, which sucks.

This I exactly it. In Texas, there is always a check box about sharing. I opt out 100% of the time. This only covers a specific use case though and there are still tons of sharing agreements in place that I can't do anything about. I'd opt out of all of them if I could but at least knowing how many places my data exist would be a start.

GDPR does not provide this unfortunately. Just last week a bill in Germany was enacted which allows the medical data of all insured people to be shared with medical companies. There is no opt-out.

I believe GDPR does provide that, but consent is not required to process data if that processing is "necessary for compliance with a legal obligation to which the controller is subject". So if an EU member state makes a law that requires insurance companies to export your medical data wholesale to medical companies, GDPR does not give you an option to opt out. Really the only solution there is either to a) move elsewhere b) vote for people who don't want to enact such laws.

The irony, of course, (as anyone with failed ML launch at Google knows, haha) is that internally Google has extremely strong privacy practices and safeguards and probably is the best organization to actually handle this data correctly.

As for de-anonymization, of course raw data should be pre-anonymized: anonymization is a major source of mistakes in the data, often rendering data useless, and needs to be done correctly by the people who know how to do it correctly.

It is not just because "everybody" is doing crazy shit, that it is OK to do it.

Then you should blame the industry rather than a newcomer to the industry who tries to follow the industry standard?

No one should be excused for unethical behavior just because it’s standard industry practice.

Also, this shows the massive disconnect between those who make money from said data and those who provide that data.

Who is being accused of being unethical?

I think the highlight point, that is new information (AFAIK) in this article is that 150 Google employees are working on this project. So this isn't "Ascension is hosting their data in the cloud", it's "Google is working with health data".

IIUC, this is also an industry standard practice as long as it's covered by their BAA. The question would be whether the actual content in the BAA makes sense or not, but I think the requirement for a BAA is pretty specific.

https://www.hhs.gov/hipaa/for-professionals/covered-entities...

To the best of my knowledge, the BAA has not been published, so we have no idea what it says.

But what seems clear is that a ton of complete medical data, including names and other identifying data, has been handed to Google for its use in what sounds like training an ML system.

That we don't know what restrictions are in place (if any) is a large part of why this is so alarming.