3 ms·
There was a legally binding contractual agreement between the two parties Deep Mind & Royal Free. Personally identifiable health-related information is classif
by Silhouette 10y ago
There was a legally binding contractual agreement between the two parties Deep Mind & Royal Free.
Personally identifiable health-related information is classified as sensitive personal data under the DPA, and as such there are particularly strict conditions on processing it. What two organisations write in a contract does not change this.
- aub3bhat 10y agoAgain you are unaware of extremely common business practices such as a BAA agreement. E.g. when a hospital contracts an outsourced lab all it needs is just another BAA agreement that governs sharing and use of the data. http://searchhealthit.techtarget.com/definition/HIPAA-business-associate-agreement-BAA http://searchhealthit.techtarget.com/definition/HIPAA-busine...
- DanBC 10y agoYou keep linking to US stuff, and people keep reminding you that this case is in the UK, subject to UK and EU data protection law. The laws are very different, and there are much stronger protections in the UK.
- Silhouette 10y agoWe're talking about the UK. HIPAA is irrelevant.
- dragonwriter 10y agoHIPAA rules aren't relevant to the United Kingdom; and, even under HIPAA, a BAA is required for certain sharing of data with contracted parties, but isn't on its own sufficient for unlimited sharing of PHI without restriction on use. Heck, even the entity doing direct service has limits on permitted internal uses. The items raised with DeepMind would raise serious concerns under HIPAA of the entities involved were covered by it.