Google's Past Data Use Could Impede Its Health Care Push | Hacker News Reader

Google's Past Data Use Could Impede Its Health Care Push

wired.com

57 pointsjonbaer25 comments

Work for a medical billing company owned by a physician group, had somebody in from Google a month or two ago wanting access to a stream of patient data from us in exchange for building some software for us. There was absolutely no detail on what they thought they could build, just that they would see what they could come up with after we started feeding them data.

The architect on our team immediately began laughing in the meeting, as it's clear that Google has absolutely zero idea how HIPAA works.

...Google definitely understands how HIPAA works. GCP and G Suite both have HIPAA compliance to varying degrees. I don't think that person had any chance of getting clearance to do that from the G side, less your side.

From a G Suite / GCP point of view they really only have to worry about the HIPAA Security Rule, most of which can be punted off on the client (they need to audit and control access to the platform, proper breach notifications and a BAA - the rest is mostly up to the client).

Collecting patient health records starts bringing the HIPAA Privacy Rule into play, which they have zero experience with.

Fair enough, but the other statement I still stand by: I don't think that deal would've been signed off on regardless. My impression from working here is that pretty much any use of any data goes through a fairly rigorous review process. I'm sure there was a point in time when that wasn't the case, but today it sure seems to be.

If the guy is high enough up in the hierarchy, there's a good chance that he can sign off on even illegal things.

Looking at how Google is handling the GDPR, for example, there's just as well plenty obvious violations that someone had to sign off on and that are gonna cost them a few billions once they can't drag the lawsuits out any longer. In the meantime, though, they're very likely making enough money to offset that, which is why executives can sign off on illegal things in the first place. It's just a basic risk analysis in the end.

I only take objection to the idea that because one employee in a company made a proposal that was not legal, that this is somehow representative of a company is ran. Engineers aren't lawyers, that's why there's a process for them to speak to lawyers in any sane large company, usually requiring approval for things that are especially important like handling sensitive data. Google isn't even special here.

You know what the really stupid thing is? Looking at the attack surfaces and data values and compromise histories, and having been inside Google to see how it treats PII and been inside a cloud EMR provider to see how it treated PHI, I'd move my data out of that EMR and into Google in a heartbeat. If you're saying that Google would need to learn about a brand new truckload of paperwork, sure. But HIPAA is neither necessary nor sufficient for privacy or security.

The problem is HIPAA doesn't allow one to share data without a reason - in fact it's only to be ACCESSED with a reason even by those with privileges to do so. I would trust Google to keep data safe, but brazenly asking for data without a defined use case is in blatant disregard for the regulations we operate under.

Like I said, I suspect this is mostly a question of learning new paperwork. My experience at Google has been that the security and privacy tooling is granular enough that access can be proposed, vetted, authorized, controlled, and monitored at the level of individual build numbers of individual binaries. I'd guess that the casual assumption was that there'd be a "defined use case" step but that it'd be covered by existing internal procedures, and I'd also guess that in any sane world it would be covered.

(This is, honestly, one of the reasons I call the entire thing stupid and trust HIPAA so little - at that cloud EMR company, every one of the 500+ devs must have had something like a perpetually-active use case of "debugging the product". If it weren't for the fact that I know that that company made it through audits I'd have phoned HHS my first month.)

> (This is, honestly, one of the reasons I call the entire thing stupid and trust HIPAA so little - at that cloud EMR company, every one of the 500+ devs must have had something like a perpetually-active use case of "debugging the product". If it weren't for the fact that I know that that company made it through audits I'd have phoned HHS my first month.)

So you're saying a valid use case to access patient data under HIPAA is for debugging the product? That sounds incredibly unlikely; even at my job we use faked data for this kind of thing. Can you point me to a source for your claim?

I wrote up a bit reply to clarify, but now I'm looking and thinking about it for the first time in a few years, with four years of job experience instead of four days, and realizing that I probably need to be showing this to a lawyer. The "learn to SQL" exercises directed me to manually inspect individual rows in the prod customer database. Even with the managers and senior devs all assuring me that it was okay and the company having survived for twenty years without being fined into oblivion, this is just... unbelievable. :/

> having been inside Google to see how it treats PII and been inside a cloud EMR provider to see how it treated PHI, I'd move my data out of that EMR and into Google in a heartbeat

I'd prefer to not have any of my data in the cloud, or with Google, or in any internet connected system. Seems that's not a choice however.

I've had enough medical problems and paperwork fuckups to be damned thankful that my medical records aren't on paper. And I worked for a couple years on one of the EMRs that "protects" my data. Yes, the situation could be better. It could also be worse, and in ways much more immediate and dramatic than the usual privacy issues.

Having worked on both sides of this, I find this account unlikely at best.

If anything, the medical side is generally a horror show, especially at physician owned groups.

British hospitals have already given them the data. They didn’t even have to pay. Some of the data is annotated meaning if you wanted supervised learning data it’s primo stuff. All free.

Title seems totally unsupported by the article...

There's nothing in here that says anything Google has done in the past impedes anything.

To the contrary, the meat of the article (4/5ths down) says:

> Under UK data protection law, DeepMind is not the “controller” of the clinical data crunched by Streams; its partners are. That means Google doesn’t own the data or get to choose how it is processed and used. Similarly in the US, the federal HIPAA law prevents organizations working with health data from arbitrarily adapting it to new purposes. Worse for Google executives who want to move quickly, the company can’t immediately assume DeepMind’s contracts with hospitals. Those institutions need to give consent, potentially giving them a chance to negotiate different terms.

So actually it's national law that's "impeding" things, not Google's past. Presumably the law is intended to protect people's data, and is working as intended. (And on top of that, nothing in the article actually supports that anything is being "impeded" at all -- seems like that's total speculation by the writer?)

Feels like a totally clickbait headline to me.

Yeah, I'm totally fine with Google being 'impeded' in this way.

This is sad, because I believe tens of millions of lives could be saved by giving all healthcare data to Google to do with as it pleases.

Sure, privacy would probably be impacted, but in my opinion, life and death is more important than privacy.

We're talking far more lives than terrorism here, and we were happy to lose a lot more privacy for that. Probably more lives than guns, car accidents, etc. too.

When we've saved those millions of lives, we can work on ways to get the benefits of both privacy and still saving those lives.

Do you also think that Google should open source all the code and results that it gets from working with that data?

It would be great if they did...

But even if they didn't, they would still have a commercial incentive to get it in the hands of as many people as possible.

> When we've saved those millions of lives, we can work on ways to get the benefits of both privacy and still saving those lives.

In this hypothetical, the genie is out of the bottle unfortunately

It should be a requirement to hand over medical data for research like this.

Why should you get to be treated for cancer without sharing with everyone else data to help make better treatments? Without that data, other people will go through the same treatment and die. That's selfish, and borderline immoral.

Maybe a doctor should be able to come to an agreement with an individual, without injecting the watchful eye of other offices or governments.

Good. It's funny we have HIPAA but yet Google is able to collect significantly more personal information than just healthcare information on us, yet there is not a single regulation they need to truly care about.

> Google didn’t respond to a request for comment on its plans.

This is what’s bothering me. These big foreign companies make promises not to do something. They then go back on their word and do it anyway. They then refuse to speak to the press or parliament.

They’re unaccountable.

Reply on news.ycombinator.com