20 ms·
Google's ‘Project Nightingale’ Gathers Personal Health Data on Millions
- EasyTiger_ 7y agoIt's wall-to-wall horrifying news about Google here these days
- umeshunni 7y agoIt's almost like your news sources are biased against one of their major competitors.
- fittslickare 7y agoOr maybe because this supermassive company with its playful logo is up to no good.
- flukus 7y agoIt's more like google is a dystopian spyware company trying to suck in as much data as possible. Not that the news sources are great, but google is genuinely far worse.
- deleted 7y ago[deleted]
- kapuasuite 7y agoThis is alarmist bullshit. “Dystopian?” Really?
- mda 7y agoHN is also an echo chamber though.
- rickncliff 7y agoSurely they could have come up with a less alarmist headline for what seems like a much needed initiative in healthcare innovation. But that's the case for all tech coverage nowadays.
- givinguflac 7y agoYou're blind if you think this is for "healthcare innovation". It's for bolstering what they know about users for advertising, and to combine with their recent Fitbit purchase. How could you possibly still view Google as an innocent company with everyone's best interests at heart?
- rickncliff 7y agoThey employ a lot of talented people and they are among the few organizations that have the resources and will to actually solve these intricate problems, so more power to them as far as I'm concerned.
- ilikehurdles 7y agoTautologically, you've described every organization in the health tech space. Having a surveillance company secretly start transacting patient health information for their own profit isn't a solution in search of any problem I want solved.
- givinguflac 7y agoWhat problem? Please tell me, what is this "solving" besides providing user data without consent to google?
- stevenhuang 7y agoI would examine your biases to see if they are not clouding your judgment and ability to see the other side. Without restraint, these efforts will undeniably bolster their ability to conduct targeted advertisements, which is bad. Hopefully regulation and consumer backlash will take care of that. But you cannot deny the amount of good we stand to gain from an advanced electronic health system. The insights that can be generated from cross correlation of all patient data, the amount of preventative measures that can be taken from detecting problems before they become bigger problems... The benefits far outweigh the negatives. It's unthinkable to have all this data and NOT attempt to find insights in them.
- partingshots 7y agoSuddenly all the investments into genetics, aging, and biotech from Calico / Verily makes sense. I imagine Alphabet’s end goal is some kind of intrinsic understanding of every single person on a biological level in order to better target and serve them ads that fit them.
- throwaway35784 7y agoSpecifically pharmaceutical products. "This pill you don't know about will stave off a genetic condition you don't know you have." Cognitive dissonance overwhelms me.
- shadowgovt 7y agoThat actually sounds pretty useful if they can get away from the problem of conflating correlation for causation, but it's probably not a problem you can solve with big data alone for exactly that reason.
- stevenhuang 7y agoWhat are you trying to say. Won't that at least be a beneficial outcome of having all this data being mined?
- Yizahi 7y agoAaand your deductible has now tripled, enjoy being broke and temporarily healthy. :) (please don't tell me that googlenet would never sell/barter/exchange this data or analyzed results based on it).
- username90 7y ago> please don't tell me that googlenet would never sell/barter/exchange this data or analyzed results based on it Why would they be any less trustworthy than the hospitals or insurance companies who normally has this data?
- hbcondo714 7y ago> Neither patients nor doctors have been notified I guess this isn't a HIPAA violation?
- McDev 7y agoFurther down: ... privacy experts said it appeared to be permissible under federal law. That law, the Health Insurance Portability and Accountability Act of 1996, generally allows hospitals to share data with business partners without telling patients, as long as the information is used “only to help the covered entity carry out its health-care functions.”
- ta1234567890 7y agoThank you and Wow! That is a very broad statement within HIPAA and subject to interpretation, which leaves a huge door open for marketers to "help covered entities carry out their health-care functions"
- dmix 7y agoThe point of HIPAA wasn’t really consumer privacy protection. It’s mostly just a side effect.
- pkaye 7y agoHIPAA has lots of loopholes. For example "Covered entities must implement reasonable safeguards to limit incidental, and avoid prohibited, uses and disclosures." There is no requirements to have sound proof walls. If your neighbor in the shared room overhears a conversation with a doctor, too bad.
- spiznnx 7y agoMy doctor's lobby has a sign that says "please wait in line here, to respect the privacy of other patients", about 4 feet from the desk. The desk itself is probably wider than 4 feet.
- 7y ago
- dvdhnt 7y agoAt this point, can we just pin a post to the top of every message board and forum that says: > [For Profit Company] [verb] [adjective] data of [noun]. The point is, what do people think these thousands of engineers are doing throughout the tech industry? Do people really believe it takes 1k developers to style a login button? Or deploy a kubernetes cluster? It's painfully simple. Capitalism dictates that companies must acquire and explore new methods of generating profit at all costs. Therefore, it should be assumed that an internet company is hoovering as much data as possible until proven otherwise.
- robin_reala 7y agoIn the US maybe. In Europe we have laws against that sort of behaviour, and generally the threat of massive legal fines is an effective counterbalance to the potential gain of data lakes.
- drstewart 7y agoA shame those massive fines don't get applied to IKEA's tax avoidance schemes
- robin_reala 7y agoShrug. You can only fine what’s actually illegal, and tax avoidance currently isn’t. If corporate behaviours are deemed problematic then generally laws are updated to cover that.
- dvdhnt 7y agoMost definitely. My, for a lack of a better word, jaded perspective comes from living in a country where I am constantly bombarded with ads and am forced to fight for any sort of protection from corporations :/
- L0stRegulator 7y agoThere are a lot of derogations in GDPR. These could easily cover the current case in point (and the sharing of data with the UK NHS etc) "The GDPR provides several exemptions and derogations for the use of health data, e.g. in the context of research or public health purposes under certain conditions. Typical procedures in this context include the application of ethical standards for scientific research as mentioned in Recital 33 and the implementation of organisational and technical safeguards as mentioned in Article 89 including anonymisation, pseudonymisation and encryption [2]. Pseudonymisation is generally recommended as long as the research purposes can be fulfilled in this manner. With the condition of such safeguards, the GDPR creates exemptions for researchers to process sensitive health data even beyond the purposes for which they were collected. " from https://www.ncbi.nlm.nih.gov/pmc/articles/PMC5438318/ https://www.ncbi.nlm.nih.gov/pmc/articles/PMC5438318/
- breck 7y agoAwesome! We need grand innovation in the health records space if we truly want to help people be healthier. I hope Google does something great with this plus Fitbit. If anyone is interested in our research in this space, we are aiming to radically improve medical records and healthcare delivery/research as well. We don’t have the resources of Google but everything we’re doing is open and public domain: https://pau.treenotation.org https://pau.treenotation.org
- slashtom 7y agoI completely agree, I work in healthcare data analytics and this is the first step. My hope would be that the government can step in and make your emr (electronic medical record) something akin to your SSN. It is your data and shouldn't belong to the provider. It would require an institutional body/government to standardize the EMR and centralize it, allow the individual to share their EMR key to whom they wish (Google, your company, etc) to help provide analytics to tailoring health care to the individual. Wishful thinking, but I hope Google is able to make significant outcomes with the data to show it is possible.
- big_chungus 7y agoBut in that case, it _really_ belongs to the government, not to you. "Your" SSN isn't yours; the government "owns" the number and uses it to uniquely identify you. I trust my medical records being on paper at my house, not in someone else's database (be it owned by a government or by a company).
- shadowgovt 7y agoOut of curiosity, how does that work when your doctor needs to treat you? And if you suffer cranial trauma and can't remember where you keep those medical records, do you just get worse care from that point forward because your healtcare provider lacks access to your history?
- big_chungus 7y ago
- undefined3840 7y agoAnyone else find it strange in the US with the self-insured health care plans (the norm with large companies) your company has complete visibility into every health care interaction you have while employed through claims data?
- tedsuo 7y agoThis is not true. I don’t like having my health care tied to my job - they are orthogonal concerns. But in the US, your employer does not have access to your healthcare records.
- AlexandrB 7y agoIf it's a "self-insured" plan[1], your employer potentially has access to all insurance claims because they are the insurer. That's not the same as access to complete healthcare records but it's pretty telling information. [1] https://www.healthcare.gov/glossary/self-insured-plan/ https://www.healthcare.gov/glossary/self-insured-plan/
- chimeracoder 7y ago> If it's a "self-insured" plan[1], your employer potentially has access to all insurance claims because they are the insurer. That's not the same as access to complete healthcare records but it's pretty telling information. No, companies almost never manage the claims themselves. They underwrite the plans, but managing claims is cost-prohibitive, as it's outside the core competency of most large companies.
- marcinzm 7y agoSure but they can get access to the claims data from whomever is managing it as they're paying for them.
- astura 7y agoHence Tim Armstrong's comments about AOL spending a couple million dollars on "distressed babies" being the reason 401(k) benefits were cut. https://www.newyorker.com/news/amy-davidson/whose-distressed-baby-is-it https://www.newyorker.com/news/amy-davidson/whose-distressed...
- rvz 7y ago> Staffers across Alphabet Inc., Google’s parent, have access to the patient information, documents show... And now with Fitbit going Google, it appears that Google wants to know everything about you beyond your name and location. Potentially, serving you ads over your Fitbit or prescription recommendations driven by these ads. If this is what Google calls the "future of healthcare", then they need more luck than ever, as the healthcare industry is extremely regulated when it comes to healthcare records.
- shadowgovt 7y agoI personally suspect the Fitbit acquisition has more to do with making a reliable wearable personal assistant than "ads over Fitbit." Larry and Sergei are still into the idea that we're on the cusp of getting the "everybody has a wearable personal-area-network" part of dystopia cyberpunk futures real soon now, and they want that wearable PAN to be able to track biometrics (for all kinds of reasons; it's just one more signal a personal assistant can tie into).
- jacquesm 7y ago> Larry and Sergei are still into the idea that we're on the cusp of getting the "everybody has a wearable personal-area-network" Over my dead body.
- shadowgovt 7y agoEspecially if you're into extreme hiking and you end up unconscious in a ditch in the wilderness with no biometric monitor connected to a GPS locator and cellular radio. ;)
- jacquesm 7y agoWhen you're into extreme stuff you should take extreme precautions. The chances of me ending up unconscious in a ditch in the wilderness are nil. This wasn't always the case and I'd make sure to plot my route and have check-in points set up in advance which is the way to do that. Your fall into the ditch may destroy your fancy gear and then what? But that stuff certainly won't hurt to bring along on a risky trek (and on plenty that don't look all that risky, the weather can really get you).
- rgrieselhuber 7y agoHow to opt out?
- neonate 7y agohttp://archive.is/1E5l9 http://archive.is/1E5l9
- foota 7y agoIt's ridiculous to think that Google would use this to serve ads.
- givinguflac 7y agoIn what universe is it ridiculous to think an advertising company would use user data for ads? You google fanboys are delusional
- pcora 7y agoyea right. same thing with facebook asking for phone numbers for two factor. they would NEVER use that for ads, right?
- sukilot 7y agoOne of the huge differences between Facebook and Google is that Google took care to never use that 2nd-factor for anything except account recovery.
- nickthemagicman 7y agoThey use your location data to serve ads. Why wouldn't they use your health care data? Is this a satire comment?
- rdiddly 7y agoNot ridiculous at all. Ads for (for example) heart pills are on TV now, placed at great cost, but currently blaring to an audience of mostly disinterested targets. Imagine being able to cheaply target the subset of those people who are not just part of a certain demographic, but who actually (for example) saw a cardiologist or went to the ER on a heart-attack scare in the last 12 months.
- noelsusman 7y agoIt's not ridiculous because they wouldn't want to do it, it's ridiculous because it would be illegal.
- 7y ago
- throwawayhlthcr 7y agoWhile it's not sure what Google is doing here, I can tell what most companies in the healthcare data space do when dealing with data like this - they use an external vendor to essentially encrypt the "personally identifiable data" (mame, exact dob, etc) into some hash tokens before the data hits their servers from the partners. This would mean the data is still tied to a patient but not easily identifiable (at least some orgs would run reidentification risk analyses based on the types of data available within the org). It would also mean that an org like Google can (assuming it chooses to) still work with healthcare data without explicitly tying it to all their other data in a legally compliant manner. Maybe a HIPAA expert can chime in but I'm reasonably sure it will be a violation to show you ads on your devices based on your personal healthcare data that Google obtained without your explicit consent. It might however be legal if Google uses all the patients healthcare data to train a model that it can use on all users, though.
- oakmad 7y agoThere would definitely be a BAA in place between between the providers and Google. My business has one with Google for hosting our cloud data. You know those forms you sign about HIPAA when you visit a provider? One of the things they say is the provider will only share data when a BAA is in place - well that the HIPAA rule: "The Privacy Rule allows covered providers and health plans to disclose protected health information to these “business associates” if the providers or plans obtain satisfactory assurances that the business associate will use the information only for the purposes for which it was engaged by the covered entity, will safeguard the information from misuse, and will help the covered entity comply with some of the covered entity’s duties under the Privacy Rule." https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/business-associates/index.html https://www.hhs.gov/hipaa/for-professionals/privacy/guidance...
- oakmad 7y agoThere would definitely be a BAA in place between between the providers and Google. My business has one with Google for hosting our cloud data. You know those forms you sign about HIPAA when you visit a provider? One of the things they say is the provider will only share data when a BAA is in place - well that the HIPAA rule: "The Privacy Rule allows covered providers and health plans to disclose protected health information to these “business associates” if the providers or plans obtain satisfactory assurances that the business associate will use the information only for the purposes for which it was engaged by the covered entity, will safeguard the information from misuse, and will help the covered entity comply with some of the covered entity’s duties under the Privacy Rule." https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/business-associates/index.html https://www.hhs.gov/hipaa/for-professionals/privacy/guidance...
- ende 7y agoWe really need a second Bill of Rights.
- big_chungus 7y agoEasy to make that argument when you're not providing any detail and so are giving others no way to respond. What would you put in it, and why?
- xvx 7y agoAt some point in the future I believe there will be insurance comparison sites dealing with health, and using this ‘private’ data to tailor quotes to each customer. Zero privacy. Then comes spam coupons for Viagra and low cost hemorrhoid treatments.
- mudil 7y agoJust like hackers that violate people’s privacy, Google is in the same business, only under the disguise of “ terms of service “ and other legal shields. It follows us daily from website to website, from location data to usage data, and on on. Surveillance capitalism is contrary to our values.
- shadowgovt 7y ago"Our values" aren't universal. I benefit from it on the whole; it's okay by me.
- jschwartzi 7y agoYou would if you held views or had elements of your personal life exposed that were contrary to mainstream thought. Complete data about a person is all that's needed to create the most pervasive fascist society that the world has ever seen. And all it takes is us saying we value the convenience of having our data shared. Sure Google has mostly benign reasons for wanting this data, but putting it in a big warehouse means it's a juicy target for anyone who wants to oppress you for any reason. There's a reason the secret police in the USSR had records about everyone. Because the only way to really effectively guarantee compliance is to ensure that you know exactly what the subject is doing at all hours of the day, even when they think they're in private. The shitty thing about this is there's effectively no way to opt out. Just being alive in this time is enough for these companies to gather an unbelievably creepy amount of information about you.
- shadowgovt 7y agoExposure of private data is counter to surveillance capitalism. The "capitalism" part is scarcity of aggregated data without value to be gained for data exchange; the company knows something about a person that other companies don't, and that has competitive value. It's not "surveillance capitalism" to collect and then publish a pile of damaging data on a person; it's just sloppy, and makes people less inclined to do business with the company that screwed up (on average). I trust Google specifically with my data because Google has some real good incentives to keep it private. Fascism is fascism, and I find it interesting (in a cognitive-dissonance sense) how many of my European peers are leery of data collection by a Google but are extremely comfortable with their respective governments running universal healthcare systems. Aren't those governments one fascist dictator away from all that centralized government health data being used to drive a mass extermination? It sounds a lot like people's real disagreement is on choice of master of the data, not whether data aggregation has utility to them.
- hogFeast 7y agoNot evil. Remember. Totally not evil.
- DonaldFisk 7y agoGoogle was recently handed the confidential medical data of 1.6 million patients treated at a London hospital (Royal Free), for use by Deep Mind, in breach of the Data Protection Act: https://www.theguardian.com/technology/2017/jul/03/google-deepmind-16m-patient-royal-free-deal-data-protection-act https://www.theguardian.com/technology/2017/jul/03/google-de...
- hirundo 7y agoI hope they find a way to properly anonymize the data and move forward. A minimum price to charge would be to make the results public. Even better would be a way for the public to analyse that data via Deep Mind, like an observatory telescope with public access time. There is likely life saving data to be found here. It would be a shame for privacy concerns to prevent studying it.
- EasyTiger_ 7y agoInteresting how you're glossing over the fact this violated the Data Protection Act.
- NeedMoreTea 7y agoEven if they did there have been many, many HN stories of data being deanonymised absurdly easily, and health data tends to unique very quickly indeed. How many females in a (county|country|postcode} born on 5 March 1942 are there with a kidney problem? Particularly in the UK where a postcode, even the locality selector (the first half, e.g. M50, NW11) is more precise than many US zipcodes that can cover many square miles. A full UK postcode narrows it down to within the street - a dozen or two houses usually. What if there is associated medical data like medications or chronic conditions - diabetes, arthritis etc? To make it suitable for study a) keep it within the NHS or relevant health authority - perhaps allowing an airgapped DeepMind server to come in process locally and afterwards get wiped or shredded, or b) remove all personal data including gender, dates, associated medical info of any type - i.e. render it almost useless for study. Oh and c) imprison all the management who agreed to share this data without patient consent and in breach of DPA, and require Google to remove all trace under audit.
- lalos 7y agoFor the people defending Google, can someone explain a 'positive' take on making this arrangement completely in the dark? As far as I know other companies working on healthcare make big announcements on their partnerships (see https://www.apple.com/newsroom/2019/09/apple-announces-three-groundbreaking-health-studies/ https://www.apple.com/newsroom/2019/09/apple-announces-three...). Meanwhile, this is uncovered by an exclusive leak to WSJ. Why are they hiding it? Competitive advantage or they are aware of the dubiousness of them doing this sort of moves? Anyways, I hope we get a better message from Google than "Google spokeswoman said the project is fully compliant with federal health law and includes robust protections for patient data. An Ascension spokesman had no immediate comment".
- sukilot 7y agoApple's product is launched commercially. Google's alleged product is still in the research phase. Neither company touts its research projects that aren't out in public yet. Google's launched healthcare products are here: https://cloud.google.com/solutions/healthcare/ https://cloud.google.com/solutions/healthcare/ It's hard to say what's going on in the WSJ article, since it has no details.
- deleted 7y ago[deleted]
- triceratops 7y agoThere are a million reasons not to make an announcement until a later stage. Here's just one: if they announce, and end up not releasing anything (for whatever reason) people will cynically point to it as another example of something promising killed by Google.
- patagonia 7y ago“cynically”?
- blueboo 7y agoEh? It's obvious: this is a pilot project where PII is screened out.
- peterwwillis 7y agoI know everyone these days likes to run around like chickens with their heads cut off when they see an article about Google or Facebook and data, but please try and calm down. First of all, Google has already been involved in health, and will continue to do so, as the health market is 3.5 Trillion dollars. Last week they announced plans to develop a search product for electronic health records. If it works, it has the potential to make health care more efficient (as in costing you less and working out better for you). https://news.ycombinator.com/item?id=21508205 https://news.ycombinator.com/item?id=21508205 Second, lots of companies collect, process, or transmit your health records. Companies you know nothing about, and that you never scrutinize. This is perfectly legal, as HIPAA (https://en.wikipedia.org/wiki/Health_Insurance_Portability_and_Accountability_Act https://en.wikipedia.org/wiki/Health_Insurance_Portability_a...) provides wide leeway for companies to handle your data, as long as it is under a chain of business contracts and compliance requirements that originate with your health care provider, insurer, etc. Under the Privacy Rule, you have rights that you can exercise to verify this is all being done properly. (However, complaints will probably be ignored as HHS isn't funded properly to deal with them) If you want to collect your internet pitchforks and go after someone, please start with the government. The rules in place are okay, but they don't mean anything without effective enforcement.
- peterwwillis 7y agoI love that this is just factual information about businesses that deal with health records, and it's still downvoted to hell. HN: where politeness and irrationality go hand in hand
- ijiiijji1 7y agoGoogle "do no evil" .. yeah, right.
- fmajid 7y agoNightingale? Cuckoo, more like it.
- ggggtez 7y agoI read the article, but I'm a little confused. Health data is generally freely for sale in the USA, as long as you store it securely. Is there some reason to suspect they are lying when they say the data is stored according to federal laws? I mean, other than it being available to 150 people (a lot perhaps, but not exactly wide open), I didn't really see anything that sounded out of place in terms of the data side? Maybe I just can't get on board with the panic about the "data is the new oil" this time. Or is it just the worry that eventually the data pipeline could spring a leak?
- j88439h84 7y ago> Health data is generally freely for sale in the USA, as long as you store it securely. Huh, I didn't know that. Where does one buy it?
- GreeneConcerned 7y agoHow can I opt out of this???
- skybrian 7y agoI haven't studied this, but they do claim they're handling it right: "All work related to Ascension’s engagement with Google is HIPAA compliant and underpinned by a robust data security and protection effort and adherence to Ascension’s strict requirements for data handling." https://www.businesswire.com/news/home/20191111005613/en/Ascension-Google-working-healthcare-transformation/ https://www.businesswire.com/news/home/20191111005613/en/Asc... Maybe HIPAA isn't strong enough?
- Paraesthetic 7y agoWhile they steal your data from Fitbit. Fantastic
- killjoywashere 7y agoThis is a compilation and revision of my comments nested deeper in the thread. Let's start from the absurdum argument that was posed: > There's no incentive for them [Google] to improve health care for the patients Ignoring the fact that Google is staffed by humans, and humans have a deep visceral response to engaging in healthcare, the healthcare systems they are collaborating with (e.g. Mayo) are strongly motivated to improve health of their patients, particularly in capitated models like accountable care organizations. Mayo is actually pretty famous for adopting the ACO model. Note the author on this article (1) from Mayo Clinic Proceedings is by David Shulkin, who went on to become the Secretary of Veterans Affairs. You may also be interested to know Ascension is another ACO (2). So why would an ACO be motivated to work with Google? Because they know reducing diagnostic variance is almost certainly identical to improving quality of diagnosis, which will reduce poor outcomes and reduce malpractice, cost of overtreatment, cost of undertreatment, and so on. Further, let me present evidence that I believe indicates Google Health is going to be laser-focused on improving care and will actively shed any work that doesn't advance that goal. Not only their business actions, but also their leadership choices. In terms of business actions, lets look at the NHS brew-haha. Hard to blame Google for NHS screwing up the research protocol that led to the specific 1.6M patient records being transferred to Deep Mind. And they corrected that research process years ago. Do you really think Google wants to be seen anywhere near the mishandling of private information? That presents an existential risk to their business. They passed muster with Mayo (a deal that no doubt had to pass muster with Shulkin among other world-renown physicians and administrators). They have deals with McKesson, Cleveland Clinic, and now Ascension. These are major players. Their leadership choices give you additional insight on their motives. Their new Chief Health Officer is Karen DeSalvo, former National Coordinator for Health IT and Acting Assistant Secretary of HHS (and no doubt candidate for next Secretary of HHS). David Feinberg, their new VP for Health, is coming from serving as CEO of Geisinger and UCLA prior to that. These people are reputationally allergic to mixing medicine with adtech. Finally, keep in mind that healthcare is widely regarded as one of the weakest points in Western cyber security. Bringing in grown-ups sounds like a phenomenal move to me. Would it be nice if the company's core business wasn't adtech? I suppose. But for all the reasons above, I genuinely believe Google getting into this space is a better net outcome than the status quo. (1) https://www.mayoclinicproceedings.org/article/S0025-6196(12)00565-4/abstract https://www.mayoclinicproceedings.org/article/S0025-6196(12)... (2) https://www.beckershospitalreview.com/acos-to-know-2019.html https://www.beckershospitalreview.com/acos-to-know-2019.html
- FreedomToCreate 7y agoData being used for services is inevitable, but at this point we really need two things. 1 - Laws around how shared data can be used that are more comprehensive 2 - A secure database either managed by private companies or the government (with strong oversight) that allows companies who want to use the data to access it but not store it. The key is that the companies using the data and the companies storing the data cannot be controlled or owned by the same entity. The companies who store the data also cannot be allowed to make money based on the type of data. They would need to be limited to only monetizing the cost of distributing the data. There will also be need to police that companies do not store the data they have access to.
- mancerayder 7y agoI've seen past instances of articles like this getting flagged here - possibly by a large amount of Googlers/ HR? I'm glad this didn't occur (yet).