A whistleblower who works in Project Nightingale, the secret transfer of the personal medical data of up to 50 million Americans from one of the largest healthcare providers in the US to Google, has expressed anger that patients are being kept in the dark about the massive deal.
The anonymous whistleblower has posted a video on the social media platform Daily Motion that contains a document dump of hundreds of images of confidential files relating to Project Nightingale. The secret scheme, first reported by the Wall Street Journal, involves the transfer to Google of healthcare data held by Ascension, the second largest healthcare provider in the US.
The data is being transferred with full personal details including name and medical history and can be accessed by Google staff. Unlike other similar efforts it has not been made anonymous though a process of removing personal information known as de-identification.
The whistleblower introduces the video with the words: “I must speak out about the things that are going on behind the scenes.”
The disclosed documents include highly confidential outlines of Project Nightingale, laying out the four stages or “pillars” of the secret project. By the time the transfer is completed next March, it will have passed the personal data of 50 million or more patients in 21 states to Google, with 10 million or so files already having moved across – with no warning having been given to patients or doctors.
Private meeting
Among the documents are the notes of a private meeting held by Ascension operatives involved in Project Nightingale. In it they raise serious concerns about the way that patients’ personal health information will be used by Google to build new artificial intelligence and other tools.
The notes say that one employee “expressed concerns of individuals downloading patient data – need to make sure everyone is trained to not be able to do that”.
According to the whistleblower, the security fears raised at that meeting, including concerns that the transfer may be in breach of federal HIPAA rules on data privacy, have so far gone unanswered by Google.
Project Nightingale is understood to be by far the largest data transfer of its kind so far in the healthcare field. It will cover the entire spread of Ascension, a Catholic network of some 2,600 hospitals, clinics and other medical outlets.
Google has entered into similar partnerships on a much smaller scale with clients such as the Colorado Centre for Personalised Medicine. But in that case all the data handed over to the search giant was encrypted, with keys being held only on the medical side.
The deal between Google and Ascension to go ahead with the data transfer was formally signed on Monday, hours after the Wall Street Journal broke the story.
The Guardian does not know the identity of the whistleblower. He is one of about 300 employees working on Project Nightingale, approximately half on the Google side and half with Ascension.
Widespread anxiety
In an interview with the Guardian, they explained deciding to go public. They cited widespread anxiety among Project Nightingale employees about the secrecy of the transfer and about how Google was being given access to personal information of millions of patients.
They had family members, they said, who have been through the health system and who were worried about even their body weight being shared with doctors. They would be alarmed to learn that their names, addresses, date of birth, medical conditions, lab records, hospitalisation history and more might be included in the Project Nightingale data given to Google.
“Most Americans would feel uncomfortable if they knew their data was being haphazardly transferred to Google without proper safeguards and security in place. This is a totally new way of doing things. Do you want your most personal information transferred to Google? I think a lot of people would say no.”
The whistleblower also expressed concern that so much sensitive and potentially valuable data was being amassed by one big tech company. Google could go on to use its AI analytics to predict outcomes for individual patients, he posited.
“In the future such risks are only likely to grow. This is the last frontier of extremely sensitive data that needs to be protected,” they said.
This is not the first time that Google has ended up in hot water over its efforts to become the dominant player in healthcare data and analytics. In 2017 the transfer of 1.6 million patient records at the Royal Free hospital in London to the company’s artificial intelligence arm DeepMind Health was found to have an “inappropriate legal basis” by the UK’s watchdog on data.
The ambition of Google's parent company Alphabet is to develop new AI tools that can help predict health patterns and improve treatment. Google recently announced plans to buy Fitbit Inc for $2.1 billion, aiming to enter the wearables market and invest in digital health.
Statements
Both Google and Ascension have released statements in the wake of the disclosure of Project Nightingale insisting that it conforms with HIPAA and all federal health laws. They said that patient data was protected.
Google Cloud told the Wall Street Journal that the aim was “ultimately improving outcomes, reducing costs, and saving lives”.
In a statement, Ascension said: “All work related to Ascension’s engagement with Google is HIPAA compliant and underpinned by a robust data security and protection effort and adherence to Ascension’s strict requirements for data handling.”
In the video, the whistleblower begs to disagree. In annotations that run over the leaked documents, it suggests that in future Google might be able to sell or share the data with third parties, or create patient profiles against which they can advertise healthcare products.
“Patients haven’t been told how Ascension is using their data and have not consented to their data being transferred to the cloud or being used by Google. At the very least patients should be told and be able to opt in or opt out,” the whistleblower writes. –Guardian
