The Google whistleblower. The medical data of millions of Americans is at risk

I'm the Google whistleblower. The medical data of millions of Americans is at risk

Anonymous

When I learned that Google was acquiring the intimate medical records of 50 million patients, I couldn’t stay silent. ‘I was worried too about the security aspect of placing vast amounts of medical data in the digital cloud.’

Thu 14 Nov 2019 11.36 ESTLast modified on Thu 14 Nov 2019 13.11 EST

I didn’t decide to blow the whistle on Google’s deal, known internally as the Nightingale Project, glibly. The decision came to me slowly, creeping on me through my day-to-day work as one of about 250 people in Google and Ascension working on the project.

When I first joined Nightingale I was excited to be at the forefront of medical innovation. Google has staked its claim to be a major player in the healthcare sector, using its phenomenal artificial intelligence (AI) and machine learning tools to predict patterns of illness in ways that might some day lead to new treatments and, who knows, even cures.

Here I was working with senior management teams on both sides, Google and Ascension, creating the future. That chimed with my overall conviction that technology really does have the potential to change healthcare for the better.

But over time I grew increasingly concerned about the security and privacy aspects of the deal. It became obvious that many around me in the Nightingale team also shared those anxieties.

After a while I reached a point that I suspect is familiar to most whistleblowers, where what I was witnessing was too important for me to remain silent. Two simple questions kept hounding me: did patients know about the transfer of their data to the tech giant? Should they be informed and given a chance to opt in or out?

The answer to the first question quickly became apparent: no. The answer to the second I became increasingly convinced about: yes. Put the two together, and how could I say nothing?

So much is at stake. Data security is important in any field, but when that data relates to the personal details of an individual’s health, it is of the utmost importance as this is the last frontier of data privacy.

With a deal as sensitive as the transfer of the personal data of more than 50 million Americans to Google the oversight should be extensive. Every aspect needed to be pored over to ensure that it complied with federal rules controlling the confidential handling of protected health information under the 1996 HIPAA legislation.

Working with a team of 150 Google employees and 100 or so Ascension staff was eye-opening. But I kept being struck by how little context and information we were operating within.

What AI algorithms were at work in real time as the data was being transferred across from hospital groups to the search giant? What was Google planning to do with the data they were being given access to? No-one seemed to know.

Above all: why was the information being handed over in a form that had not been “de-identified” – the term the industry uses for removing all personal details so that a patient’s medical record could not be directly linked back to them? And why had no patients and doctors been told what was happening?

I was worried too about the security aspect of placing vast amounts of medical data in the digital cloud. Think about the recent hacks on banks or the 2013 data breach suffered by the retail giant Target – now imagine a similar event was inflicted on the healthcare data of millions.

I am proud that I brought this story to public attention. Since it broke on Monday several Congress members have expressed concerns including the Democratic presidential candidate Senator Amy Klobuchar of Minnesota who said the deal raised “serious privacy concerns”.

A federal inquiry has been launched into whether HIPAA protections have been fully followed.

I can see the advantages of unleashing Google’s huge computing power on medical data. Applications will be faster; data more accessible to doctors; new channels will be opened that might in time find cures to certain conditions.

But the disadvantages prey on my mind. Employees at big tech companies having access to personal information; data potentially being handed on to third parties; adverts one day being targeted at patients according to their medical histories.

I’d like to hope that the result of my raising the lid on this issue will be open debate leading to concrete change. Transfers of healthcare data to big tech companies need to be shared with the public and made fully transparent, with monitoring by an independent watchdog.

Patients must have the right to opt in or out. The uses of the data must be clearly defined for all to see, not just for now but for 10 or 20 years into the future.

Full HIPAA compliance must be enforced, and boundaries must be put in place to prevent third parties gaining access to the data without public consent.

In short, patients and the public have a right to know what’s happening to their personal health information at every step along the way. To quote one of my role models, Luke Skywalker: “May the force be with you”.

https://www.theguardian.com/commentisfree/2019/nov/14/im-the-google-whistleblower-the-medical-data-of-millions-of-americans-is-at-risk