
Google's ‘Project Nightingale’ Gathers Personal Health Data on Millions - big_chungus
https://www.wsj.com/articles/google-s-secret-project-nightingale-gathers-personal-health-data-on-millions-of-americans-11573496790?mod=rsswn
======
DonaldFisk
Google was recently handed the confidential medical data of 1.6 million
patients treated at a London hospital (Royal Free), for use by Deep Mind, in
breach of the Data Protection Act:
[https://www.theguardian.com/technology/2017/jul/03/google-
de...](https://www.theguardian.com/technology/2017/jul/03/google-
deepmind-16m-patient-royal-free-deal-data-protection-act)

~~~
roddux
I'm actually still so struck how literally _nobody_ seems to give a shit or
even _know_ that this happened. It's really sad.

~~~
chongli
I’m surprised that people are still surprised by this, but then I’ve gotten
pretty cynical at this point.

This phenomenon goes way deeper than people not caring about privacy. It
underlies everything from the bystander effect [1], to the Nuremberg defence
[2], and everything in between.

People just don’t want to organize, generally speaking. The people who do
usually end up as part of the elite. The rest are just focused on their
individual lives.

[1]
[https://en.wikipedia.org/wiki/Bystander_effect](https://en.wikipedia.org/wiki/Bystander_effect)

[2]
[https://en.m.wikipedia.org/wiki/Superior_orders](https://en.m.wikipedia.org/wiki/Superior_orders)

~~~
NeedMoreTea
> People just don’t want to organize, generally speaking

They used to far more. The eighties and nineties disassembled many of the
places and means to organising. Disassembly of civic community, unions,
restrictions on demos, decline of social societies such as Lions Clubs and
others. Now we're all individuals, organising alone.

~~~
acqq
Related:

[https://splinternews.com/organized-labor-is-in-a-life-and-
de...](https://splinternews.com/organized-labor-is-in-a-life-and-death-
struggle-be-ver-1823353601)

"For an entire century, the corporate class in America has dreamed of
destroying organized labor, which eats into their ability to amass endless
profits. They’ve chipped away at unions for 40 years. Now, it is no
exaggeration to say that they are two steps away from total victory."

...

"This is a very scary time. Take it seriously."

------
lalos
For the people defending Google, can someone explain a 'positive' take on
making this arrangement completely in the dark? As far as I know other
companies working on healthcare make big announcements on their partnerships
(see [https://www.apple.com/newsroom/2019/09/apple-announces-
three...](https://www.apple.com/newsroom/2019/09/apple-announces-three-
groundbreaking-health-studies/)). Meanwhile, this is uncovered by an exclusive
leak to WSJ. Why are they hiding it? Competitive advantage or they are aware
of the dubiousness of them doing this sort of moves? Anyways, I hope we get a
better message from Google than "Google spokeswoman said the project is fully
compliant with federal health law and includes robust protections for patient
data. An Ascension spokesman had no immediate comment".

~~~
triceratops
There are a million reasons not to make an announcement until a later stage.
Here's just one: if they announce, and end up not releasing anything (for
whatever reason) people will cynically point to it as another example of
something promising killed by Google.

~~~
patagonia
“cynically”?

------
throwawayhlthcr
While it's not sure what Google is doing here, I can tell what most companies
in the healthcare data space do when dealing with data like this - they use an
external vendor to essentially encrypt the "personally identifiable data"
(mame, exact dob, etc) into some hash tokens before the data hits their
servers from the partners. This would mean the data is still tied to a patient
but not easily identifiable (at least some orgs would run reidentification
risk analyses based on the types of data available within the org). It would
also mean that an org like Google can (assuming it chooses to) still work with
healthcare data without explicitly tying it to all their other data in a
legally compliant manner.

Maybe a HIPAA expert can chime in but I'm reasonably sure it will be a
violation to show you ads on your devices based on your personal healthcare
data that Google obtained without your explicit consent. It might however be
legal if Google uses all the patients healthcare data to train a model that it
can use on all users, though.

~~~
noelsusman
If Google is getting Protected Health Information (names, addresses, dates,
etc.) from providers then they have to sign a Business Associate Agreement,
which effectively makes them a covered entity under HIPAA. They would be
criminally liable for any misuse of the data, which would include using it to
inform their advertising.

Using the data to create a model for use at the providers would be a clearly
proper use of the data. That's standard practice across the industry.

~~~
throwGuardian
What about Google employees looking for damaging data on adversaries? Or
stalkers, looking for information on particular individuals without consent.

Why does Google get PII?

~~~
dimator
To take your argument to its conclusion, what if someone at Ascension wanted
damaging information on one of its patients?

They'd be legally liable. Same as those they sign BAA with.

------
undefined3840
Anyone else find it strange in the US with the self-insured health care plans
(the norm with large companies) your company has complete visibility into
every health care interaction you have while employed through claims data?

~~~
tedsuo
This is not true. I don’t like having my health care tied to my job - they are
orthogonal concerns. But in the US, your employer does not have access to your
healthcare records.

~~~
AlexandrB
If it's a "self-insured" plan[1], your employer potentially has access to all
insurance claims because they _are_ the insurer. That's not the same as access
to complete healthcare records but it's pretty telling information.

[1] [https://www.healthcare.gov/glossary/self-insured-
plan/](https://www.healthcare.gov/glossary/self-insured-plan/)

~~~
chimeracoder
> If it's a "self-insured" plan[1], your employer potentially has access to
> all insurance claims because they are the insurer. That's not the same as
> access to complete healthcare records but it's pretty telling information.

No, companies almost never manage the claims themselves. They underwrite the
plans, but managing claims is cost-prohibitive, as it's outside the core
competency of most large companies.

~~~
marcinzm
Sure but they can get access to the claims data from whomever is managing it
as they're paying for them.

~~~
astura
Hence Tim Armstrong's comments about AOL spending a couple million dollars on
"distressed babies" being the reason 401(k) benefits were cut.

[https://www.newyorker.com/news/amy-davidson/whose-
distressed...](https://www.newyorker.com/news/amy-davidson/whose-distressed-
baby-is-it)

------
rickncliff
Surely they could have come up with a less alarmist headline for what seems
like a much needed initiative in healthcare innovation.

But that's the case for all tech coverage nowadays.

~~~
AlexandrB
The headline is not alarming enough. This is being done without proper consent
from patients and the healthcare "innovation" is likely to be inaccessible to
many of those same patients due to how unaffordable health care (including
preventative care) is in the US.

Edit: It basically doesn't matter what procedure Google's algorithm says you
should get. If your insurance doesn't want to cover it, you're not getting it.

~~~
rickncliff
Evidently "consent" isn't lawfully required. The hope is that any breakthrough
might lower healthcare costs, and in the worst case scenario at least some
patients might benefit which is still a win.

~~~
AlexandrB
> Evidently "consent" isn't lawfully required.

Ethics != law. Just because it's lawful doesn't mean it's ethical or that we
shouldn't be outraged.

Edit: > The hope is that any breakthrough might lower healthcare costs

Perhaps then Google should instead lobby hard for single-payer. Most countries
with a single-payer systems have lower health care costs than the US. It's a
proven solution that _will_ lower costs, not a "hope".

------
rvz
> Staffers across Alphabet Inc., Google’s parent, have access to the patient
> information, documents show...

And now with Fitbit going Google, it appears that Google wants to know
everything about you beyond your name and location. Potentially, serving you
ads over your Fitbit or prescription recommendations driven by these ads.

If this is what Google calls the "future of healthcare", then they need more
luck than ever, as the healthcare industry is extremely regulated when it
comes to healthcare records.

~~~
shadowgovt
I personally suspect the Fitbit acquisition has more to do with making a
reliable wearable personal assistant than "ads over Fitbit." Larry and Sergei
are still into the idea that we're on the cusp of getting the "everybody has a
wearable personal-area-network" part of dystopia cyberpunk futures real soon
now, and they want that wearable PAN to be able to track biometrics (for all
kinds of reasons; it's just one more signal a personal assistant can tie
into).

~~~
jacquesm
> Larry and Sergei are still into the idea that we're on the cusp of getting
> the "everybody has a wearable personal-area-network"

Over my dead body.

~~~
shadowgovt
Especially if you're into extreme hiking and you end up unconscious in a ditch
in the wilderness with no biometric monitor connected to a GPS locator and
cellular radio. ;)

~~~
fittslickare
Unless your family members starts seeing personalized ads about funeral
services and flowers quick enough, they will never suspect you are in urgent
need of medical attention.

~~~
shadowgovt
I don't care if they know. I'm more thinking "The paramedic service that I pay
a subscription fee to for LifeAlert-grade monitoring in the event of
disturbing vitals."

------
foota
It's ridiculous to think that Google would use this to serve ads.

~~~
rdiddly
Not ridiculous at all. Ads for (for example) heart pills are on TV now, placed
at great cost, but currently blaring to an audience of mostly disinterested
targets. Imagine being able to cheaply target the subset of those people who
are not just part of a certain demographic, but who actually (for example) saw
a cardiologist or went to the ER on a heart-attack scare in the last 12
months.

~~~
noelsusman
It's not ridiculous because they wouldn't want to do it, it's ridiculous
because it would be illegal.

------
hbcondo714
> Neither patients nor doctors have been notified

I guess this isn't a HIPAA violation?

~~~
bilbo0s
There is a loophole in HIPAA.

Basically, a hospital can give data to a partner if it has to in order to
deliver care. But it was meant for, just as a for instance, your doctor gives
a few DICOM studies to GE because they are going to concert on modifying the
settings on a CT scanner to do some wiz-bang thing everyone thinks will help
the patient. (Maybe even other patients down the line?)

Giving it to Google so they can serve you ads, er, um, I mean, "recommend
different treatments" to you, kind of stretches the letter of the law. And
definitely breaks the spirit of the law in my opinion.

~~~
sukilot
> your doctor gives a few DICOM studies to GE because they are going to
> concert on modifying the settings on a CT scanner

Is that actually allowed without patient consent?

~~~
bilbo0s
No. Patient consent is part of the whole "everyone thinks [it] will help"
part.

Not really sure how Google finagled their access? It's odd when neither the
doctor, nor the patient knows. I wonder if even the hospital administrators
knew? Or is this a decision that was made at the system level and the average
hospital CEO at Ascension was none the wiser?

~~~
froindt
I hate how patient consent is typically implemented. I've seen two ER's
firsthand who have someone come in with a computer, ask some questions about
insurance and all, then say "please sign for the HIPPA privacy form, and again
to release the information to your insurance provider".

For all you know, you're signing away for an assisted suicide and authorizing
your organs to be transplanted. I refuse to sign on the pad, I'm the patient
who asks for it to be printed out on paper, signs it, and gets a copy too.

~~~
ska
That's a bit different that the consent referred to above - this is the
hospital covering themselves.

If you are consenting data for a trial or otherwise sharing with a company for
development, someone (often paid for separately) will typically come and walk
you through the consent form.

------
EasyTiger_
It's wall-to-wall horrifying news about Google here these days

~~~
umeshunni
It's almost like your news sources are biased against one of their major
competitors.

~~~
flukus
It's more like google is a dystopian spyware company trying to suck in as much
data as possible. Not that the news sources are great, but google is genuinely
far worse.

~~~
kapuasuite
This is alarmist bullshit. “Dystopian?” Really?

------
neonate
[http://archive.is/1E5l9](http://archive.is/1E5l9)

------
ende
We really need a second Bill of Rights.

~~~
big_chungus
Easy to make that argument when you're not providing any detail and so are
giving others no way to respond. What would you put in it, and why?

------
skybrian
I haven't studied this, but they do claim they're handling it right:

"All work related to Ascension’s engagement with Google is HIPAA compliant and
underpinned by a robust data security and protection effort and adherence to
Ascension’s strict requirements for data handling."

[https://www.businesswire.com/news/home/20191111005613/en/Asc...](https://www.businesswire.com/news/home/20191111005613/en/Ascension-
Google-working-healthcare-transformation/)

Maybe HIPAA isn't strong enough?

------
mancerayder
I've seen past instances of articles like this getting flagged here - possibly
by a large amount of Googlers/ HR? I'm glad this didn't occur (yet).

------
killjoywashere
This is a compilation and revision of my comments nested deeper in the thread.
Let's start from the absurdum argument that was posed:

> There's no incentive for them [Google] to improve health care for the
> patients

Ignoring the fact that Google is staffed by humans, and humans have a deep
visceral response to engaging in healthcare, the healthcare systems they are
collaborating with (e.g. Mayo) are _strongly_ motivated to improve health of
their patients, particularly in capitated models like accountable care
organizations. Mayo is actually pretty famous for adopting the ACO model. Note
the author on this article (1) from Mayo Clinic Proceedings is by David
Shulkin, who went on to become the Secretary of Veterans Affairs.

You may also be interested to know Ascension is another ACO (2).

So why would an ACO be motivated to work with Google? Because they know
reducing diagnostic variance is almost certainly identical to improving
quality of diagnosis, which will reduce poor outcomes and reduce malpractice,
cost of overtreatment, cost of undertreatment, and so on.

Further, let me present evidence that I believe indicates Google Health is
going to be laser-focused on improving care and will actively shed any work
that doesn't advance that goal. Not only their business actions, but also
their leadership choices.

In terms of business actions, lets look at the NHS brew-haha. Hard to blame
Google for NHS screwing up the research protocol that led to the specific 1.6M
patient records being transferred to Deep Mind. And they corrected that
research process years ago. Do you really think Google wants to be seen
anywhere near the mishandling of private information? That presents an
existential risk to their business. They passed muster with Mayo (a deal that
no doubt had to pass muster with Shulkin among other world-renown physicians
and administrators). They have deals with McKesson, Cleveland Clinic, and now
Ascension. These are major players.

Their leadership choices give you additional insight on their motives. Their
new Chief Health Officer is Karen DeSalvo, former National Coordinator for
Health IT and Acting Assistant Secretary of HHS (and no doubt candidate for
next Secretary of HHS). David Feinberg, their new VP for Health, is coming
from serving as CEO of Geisinger and UCLA prior to that. These people are
reputationally allergic to mixing medicine with adtech.

Finally, keep in mind that healthcare is widely regarded as one of the
_weakest_ points in Western cyber security. Bringing in grown-ups sounds like
a phenomenal move to me.

Would it be nice if the company's core business wasn't adtech? I suppose. But
for all the reasons above, I genuinely believe Google getting into this space
is a better net outcome than the status quo.

(1)
[https://www.mayoclinicproceedings.org/article/S0025-6196(12)...](https://www.mayoclinicproceedings.org/article/S0025-6196\(12\)00565-4/abstract)

(2) [https://www.beckershospitalreview.com/acos-to-
know-2019.html](https://www.beckershospitalreview.com/acos-to-know-2019.html)

~~~
the-rc
> They passed muster with Mayo (a deal that no doubt had to pass muster with
> Shulkin among other world-renown physicians and administrators

I used to work at both Mayo and Google.

Mayo isn't shy about the need to protect their name and reputation. They
consider it one of their most valuable assets, if not the most valuable. After
all, they built it over a century of hard work. Sometimes it borders on
excessive. If you went to a conference, unless you were presenting, it was
suggested for you to just say you're "from a large medical institution in the
Midwest". If you sold them software or services, you were allowed to use their
name (trademark) in the list of customers on your website, but only if the
list had at least 4-5 names and it was in alphabetical order.

The day Mayo signed, also in light of their past collaboration with IBM (I was
around in the BlueGene days...), I knew that Google must have committed large
amounts of money and resources to the partnership. For those who are not
aware, Dr Plummer at Mayo pretty much came up with the modern idea of a
medical record a century ago and even had a sort of human-powered Google for
records, keeping them in the basement, calling them up over intercom and
delivering them over tubes.

------
fmajid
Nightingale? Cuckoo, more like it.

------
FreedomToCreate
Data being used for services is inevitable, but at this point we really need
two things. 1 - Laws around how shared data can be used that are more
comprehensive 2 - A secure database either managed by private companies or the
government (with strong oversight) that allows companies who want to use the
data to access it but not store it. The key is that the companies using the
data and the companies storing the data cannot be controlled or owned by the
same entity. The companies who store the data also cannot be allowed to make
money based on the type of data. They would need to be limited to only
monetizing the cost of distributing the data. There will also be need to
police that companies do not store the data they have access to.

------
GreeneConcerned
How can I opt out of this???

------
partingshots
Suddenly all the investments into genetics, aging, and biotech from Calico /
Verily makes sense.

I imagine Alphabet’s end goal is some kind of intrinsic understanding of every
single person on a biological level in order to better target and serve them
ads that fit them.

~~~
shadowgovt
It always tickles my funny bone to see people attempt to tie every Google move
to "How do we use this for ads?"

It's the opposite; Google's seeing that their revenue stream is very near a
monoculture and they know monocultures can't last forever. A lot of their
initiatives (cloud, video, wearables) are trying hard to find an alternate
revenue stream that will be as profitable as ads so that when the industry
inevitably crashes (not because of anything specific they can predict, but
because all industries eventually do) they're not powering their entire empire
off of a single river that just dried up.

~~~
phkahler
Sure. Their biggest business outside of search is YouTube. But that doesnt
make much money on subscriptions, its ads...

~~~
dragonwriter
With Premium and TV, they are making a big push to change the YouTube revenue
model away from as dependence.

~~~
JaRail
Don't forget gaming. They're going after the Twitch business model there.
Combining that with traditional YouTube and Stadia offers a very robust social
gaming platform. They're basically going after digital entertainment all
across the board, looking for opportunities to leverage cloud/ai to leapfrog
encumbants.

------
breck
Awesome! We need grand innovation in the health records space if we truly want
to help people be healthier. I hope Google does something great with this plus
Fitbit. If anyone is interested in our research in this space, we are aiming
to radically improve medical records and healthcare delivery/research as well.
We don’t have the resources of Google but everything we’re doing is open and
public domain: [https://pau.treenotation.org](https://pau.treenotation.org)

~~~
slashtom
I completely agree, I work in healthcare data analytics and this is the first
step.

My hope would be that the government can step in and make your emr (electronic
medical record) something akin to your SSN. It is your data and shouldn't
belong to the provider.

It would require an institutional body/government to standardize the EMR and
centralize it, allow the individual to share their EMR key to whom they wish
(Google, your company, etc) to help provide analytics to tailoring health care
to the individual.

Wishful thinking, but I hope Google is able to make significant outcomes with
the data to show it is possible.

~~~
breck
Awesome! We are on the same page on a lot of things.

> It is your data and shouldn't belong to the provider.

Agreed! What do you think of the concept of the "Copy/Paste Test"? The idea is
a good EHR should allow you to copy/paste your entire medical history into an
email in a non-fragile way. If it can't do that, it's not a good EHR. We think
this one dimension encompasses a lot of sub dimensions of what goes into a
well designed EHR system.

> It would require an institutional body/government to standardize the EMR and
> centralize it

We're thinking the opposite: decentralized, git backed, concatenative
grammars. You eventually probably would indeed have one grammar rise to the
top, but the idea is to allow anyone to view, suggest edits, and fork the
collection of grammars. Here is the current collection of Pau Grammar files:
[https://github.com/treenotation/pau/tree/master/grams](https://github.com/treenotation/pau/tree/master/grams).
Note: this isn't even v1 yet, but the core ideas are there.

~~~
ska
> The idea is a good EHR should allow you to copy/paste your entire medical
> history into an email in a non-fragile way.

On the surface, this seems to be a poor test. Are you using it as a proxy for
a patient to be able to get their EHR records out or something else?

~~~
breck
> Are you using it as a proxy for a patient to be able to get their EHR
> records out or something else?

It's a proxy to test a lot of dimensions at once: not only how accessible the
records are to the patient (facilitating care, particularly in acute
settings), but also how well designed the grammar and schemas are. Well
designed grammars and schemas should survive copy/pasting easily. Any errors
should be quickly and readily identified with the potential for
autocorrections.

VA created a very cool thing called Blue Button
([https://www.va.gov/bluebutton/](https://www.va.gov/bluebutton/)). It is a
step toward passing the copy/paste test. Any veteran can download their
complete medical history in a single file. The schema isn't there yet and
parsing these things is a pain, but a step in the right direction.

~~~
ska
Ok, that makes more sense.

I guess initially I would think of this as a round-trip requirement. In theory
at least I should be able to download the entirety of my history (in an
appropriate format); delete the record on the EHR; re-upload my history and
end up with the identical EHR record mutatis mutandis.

Sticking "email" in there had me thinking your were focused on transmission.

~~~
breck
> I guess initially I would think of this as a round-trip requirement. In
> theory at least I should be able to download the entirety of my history (in
> an appropriate format); delete the record on the EHR; re-upload my history
> and end up with the identical EHR record mutatis mutandis.

I like this test! Yes, passing the copy/paste test should pass this test as
well.

------
rgrieselhuber
How to opt out?

~~~
pcora
Move to another country?

~~~
Yizahi
Another planet more like

------
mudil
Just like hackers that violate people’s privacy, Google is in the same
business, only under the disguise of “ terms of service “ and other legal
shields. It follows us daily from website to website, from location data to
usage data, and on on. Surveillance capitalism is contrary to our values.

~~~
shantly
Google's _core business_ and overriding concern is voyeurism and stalking.
They're creepy as hell. It should be framed in those, accurate, terms at every
opportunity. It doesn't matter _why_ they're doing it—those are the actions
they're taking. They're creepy, voyeuristic stalkers, to the core. It's a
vital part of their income stream, inseparable from and often motivating
everything else they do.

I mean granted most of the other tech giants aren't far off from them. But
that just means _none_ of them should get a pass on that crap.

~~~
sukilot
Remember to include every business that buys ads from Google as well.

------
xvx
At some point in the future I believe there will be insurance comparison sites
dealing with health, and using this ‘private’ data to tailor quotes to each
customer. Zero privacy. Then comes spam coupons for Viagra and low cost
hemorrhoid treatments.

------
dvdhnt
At this point, can we just pin a post to the top of every message board and
forum that says:

> [For Profit Company] [verb] [adjective] data of [noun].

The point is, what do people think these thousands of engineers are doing
throughout the tech industry? Do people really believe it takes 1k developers
to style a login button? Or deploy a kubernetes cluster?

It's painfully simple. Capitalism dictates that companies must acquire and
explore new methods of generating profit at all costs. Therefore, it should be
assumed that an internet company is hoovering as much data as possible until
proven otherwise.

~~~
robin_reala
In the US maybe. In Europe we have laws against that sort of behaviour, and
generally the threat of massive legal fines is an effective counterbalance to
the potential gain of data lakes.

~~~
drstewart
A shame those massive fines don't get applied to IKEA's tax avoidance schemes

~~~
robin_reala
Shrug. You can only fine what’s actually illegal, and tax avoidance currently
isn’t. If corporate behaviours are deemed problematic then generally laws are
updated to cover that.

------
ggggtez
I read the article, but I'm a little confused. Health data is generally freely
for sale in the USA, as long as you store it securely.

Is there some reason to suspect they are lying when they say the data is
stored according to federal laws?

I mean, other than it being available to 150 people (a lot perhaps, but not
exactly wide open), I didn't really see anything that sounded out of place in
terms of the data side?

Maybe I just can't get on board with the panic about the "data is the new oil"
this time. Or is it just the worry that eventually the data pipeline could
spring a leak?

~~~
j88439h84
> Health data is generally freely for sale in the USA, as long as you store it
> securely.

Huh, I didn't know that. Where does one buy it?

------
peterwwillis
I know everyone these days likes to run around like chickens with their heads
cut off when they see an article about Google or Facebook and data, but please
try and calm down.

First of all, Google has already been involved in health, and will continue to
do so, as the health market is 3.5 Trillion dollars. Last week they announced
plans to develop a search product for electronic health records. If it works,
it has the potential to make health care more efficient (as in costing you
less and working out better for you).
[https://news.ycombinator.com/item?id=21508205](https://news.ycombinator.com/item?id=21508205)

Second, _lots of companies collect, process, or transmit your health records_.
Companies you know nothing about, and that you never scrutinize. This is
perfectly legal, as HIPAA
([https://en.wikipedia.org/wiki/Health_Insurance_Portability_a...](https://en.wikipedia.org/wiki/Health_Insurance_Portability_and_Accountability_Act))
provides wide leeway for companies to handle your data, as long as it is under
a chain of business contracts and compliance requirements that originate with
your health care provider, insurer, etc. Under the Privacy Rule, you have
rights that you can exercise to verify this is all being done properly.
(However, complaints will probably be ignored as HHS isn't funded properly to
deal with them)

If you want to collect your internet pitchforks and go after someone, please
start with the government. The rules in place are okay, but they don't mean
anything without effective enforcement.

~~~
peterwwillis
I love that this is just factual information about businesses that deal with
health records, and it's still downvoted to hell.

HN: where politeness and irrationality go hand in hand

