Google is being sued in a possible class-action lawsuit in which the tech giant is accused of improper use of sensitive medical data from hundreds of thousands of hospital patients.
The lawsuit, filed Wednesday, is the latest example of how privacy giants from the tech giants to the billion-dollar healthcare industry are being hit.
In recent years, companies, including Microsoft, Apple and Google, have all offered their services to medical institutions, with the promise that they can help organize medical information and use this information to develop new AI diagnostic tools. But these plans are often confronted with resistance from privacy defenders, who say that these data give tech giants an unprecedented picture of the lives of their customers.
The lawsuit in question, what was first reported by The New York Times, deals with a transaction made in 2017 between Google and the University of Chicago Medical Center (also a suspect). Between 2009 and 2016, Google gained access to patient records from the University of Chicago Medicine, which it said would be used to develop new AI tools.
In a blog post at that time, Google said it was ready to begin "accurately predicting medical events – such as whether patients will be admitted to hospital, how long they will stay and whether their health will deteriorate." The company also noted that it would be using "anonymous" medical data "from Chicago that" would be stripped of personally identifiable information. "
The Wednesday trial claims that the company did not do this. "In reality, this data was not sufficiently anonymized and the privacy of the patient was a big risk," he says.
Crucially, the lawsuit says that Google received data on when patients were admitted and discharged from the medical center, a possible violation of privacy legislation for federal health data known as HIPAA. This information, according to the suit, can be combined with location data collected by Google's Android OS to reveal the identity of individual patients.
The rest of the information in the records is detailed. It includes the height, weight and vital functions of people; whether they suffer from diseases such as cancer or AIDS; and reports of recent recent medical procedures, including transplants and abortions.
The suit says that the University of Chicago Medical Center also failed in its duties. "(T) The university has not informed its patients, let alone that they have obtained their explicit consent, before they transfer their confidential medical data to Google for its own commercial profit."
The lawsuit is particularly similar to complaints against Google AI subsidiary DeepMind in the UK. There, DeepMind made a deal in 2015 to gain access to patient records from the British National Health Service (NHS), with which it developed an app for doctors and nurses. An investigation by the UK data watchdog showed that the deal "does not comply with the data protection law" and that DeepMind has made "unforgivable" mistakes while processing the data.
DeepMind later rewrote his contracts with the NHS and established new independent advisory boards to investigate his activities. These signs were closed when the relevant DeepMind department, DeepMind Health, was included in Google.
Google and the University of Chicago Medical Center both deny the allegations set forth in the lawsuit.
A Google spokesperson told it New York Times: "We believe that our healthcare research can help save lives in the future, so we take privacy seriously and follow all relevant rules and regulations in our health treatment." A spokesperson for the University of Chicago also told Times that the claims were "without merit".
Such lawsuits are often started with the intention of attracting more prosecutors. The lawsuit currently focuses on a single complaint from Matt Dinerstein, who was admitted to the Chicago University Medical Center in 2015.