The Wall Street Journal reported on Monday that Google has been working since 2018 on a "secret" project involving patient data with Ascension, the St. Louis-based nationwide health system.

WHY IT MATTERS
The initiative, which WSJ said had drawn some questions, both "technological and ethical," from some Ascension employees about how the information was being analyzed and shared, had reportedly been code-named Project Nightingale.

Google is apparently using the data to help inform its design of new artificial intelligence (AI) and machine learning software for Ascension. WSJ reports that employees at different Alphabet divisions, including Google Brain, have access to the patient information.

Until recently, neither patients nor physicians knew that "at least 150 Google employees already have access to much of the data on tens of millions of patients" across 21 states, according to the article's author Rob Copeland, including "lab results, doctor diagnoses and hospitalization records, among other categories ... including patient names and dates of birth."

But within hours of the WSJ report, Ascension put out a press release explaining its work with Google – and promising that the work is "HIPAA compliant and underpinned by a robust data security and protection effort and adherence to Ascension's strict requirements for data handling."

Beyond that, the health system had no further word on this project's potential patient privacy implications – except to say that one of its chief goals is a modernization of Ascension's infrastructure with help from Google Cloud, and that "key elements" of the work are focused around "data integration, privacy and security and compliance."

Other hoped-for results include real-time communication and collaboration, "securely in real time," with Google's G Suite, and new AI applications to improve quality and access for vulnerable populations, and boost patient and provider satisfaction.

HIPAA does allow providers (and others covered by the privacy law, including health plans and clearinghouses) to share protected health data with their vendors and business partners – but only in certain cases.

"Covered entities may disclose protected health information to an entity in its role as a business associate only to help the covered entity carry out its health care functions – not for the business associate’s independent use or purposes, except as needed for the proper management and administration of the business associate," according to HHS.

THE LARGER TREND
The project bears some similarities to another recent Google collaboration, with the University of Chicago, which has been the subject of an ongoing class action lawsuit. The suit alleges that, despite being deidentified, Google's expertise in data mining and AI makes it "uniquely able to determine the identity" of the medical records shared with it by the university.

Google, the University of Chicago Medical Center and the University of Chicago are listed as defendants in a class action suit that alleges they failed to properly deidentify sensitive patient medical data.

The complaint, filed by Matt Dinerstein in the U.S. District Court for the Northern District Of Illinois, claims UChicago "promised in its patient admission forms that it would not disclose patients' records to third parties, like Google, for commercial purposes."

Instead, the university "did not notify its patients, let alone obtain their express consent, before turning over their confidential medical records to Google for its own commercial gain," the document states.

This past week, the University of Chicago asked for the lawsuit to be dismissed. While Dinerstein claims Google has the ability to identify him, he "admits that Google contractually agreed not to even try to identify anyone as a condition of receiving the data," according to the motion filed by U of Chicago.

ON THE RECORD
"As the healthcare environment continues to rapidly evolve, we must transform to better meet the needs and expectations of those we serve as well as our own caregivers and healthcare providers," said Eduardo Conrado, Ascension's executive vice president of strategy and innovations, in a statement.

"Doing that will require the programmatic integration of new care models delivered through the digital platforms, applications and services that are part of the everyday experience of those we serve," he said.

"By working in partnership with leading healthcare systems like Ascension, we hope to transform the delivery of healthcare through the power of the cloud, data analytics, machine learning, and modern productivity tools – ultimately improving outcomes, reducing costs, and saving lives," added Tariq Shaukat, president of Google Cloud.