5 ms·

If I'm reading the article correctly, this is allowed by HIPAA already and is already happening (for research purposes and by third party healthcare companies?)

by chunky1994 5y ago

If I'm reading the article correctly, this is allowed by HIPAA already and is already happening (for research purposes and by third party healthcare companies?). I would much rather google handle this data rather than unknown third parties with their own agendas, at least with google, the data comes with privacy risks that are relatively well known and might actually be useful for clinicians due to google's expertise on AI/pattern classification work which is primarily what medical diagnoses is about now (IANAD so perhaps this is incorrect).

ladyanita22 5y ago
oh boy you're gonna be downvoted here...
tedivm 5y ago
HIPAA lets companies share data with other companies as long as it meets two requirements- 1. The company that collects the data (the covered entity) has to have a Business Associate Agreement in place with the company they're sharing it with. This basically affirms that the other company is aware of their HIPAA requirements and intends to follow them. 2. The Business Associate needs to access the data to do the job they were hired for, which in turn should be related to patient care. There are definitely a lot of companies out there doing this already, but I will say that the people with the data are not exactly giving it up easily. HIPAA makes it so that in the event of a breach the Covered Entity is responsible for beach notification to the patients. That means there's a huge incentive for hospitals, radiology groups, and anyone else who collects this data to make sure that the people they share it with have the proper safeguards in place. There are a ton of hoops to jump through, normally including independent third party audits. I've seen a few medical AI companies fail simply because they didn't have the security and no one trusted them with data.
- wins32767 5y ago
  That's true if the data is PHI, which means that it's personally identifiable. Per TFA, Google is using anonymized data. There are a bunch of companies that do this already, for example my last startup had anonymized health records from ~240 million Americans.
  - tedivm 5y ago
    My last startup does this as well, but in our experience deidentification is not nearly as robust as the companies using it claim it is.
    - potatoman22 5y ago
      Case in point: The Netflix prize fiasco.
    - wins32767 5y ago
      We had biostatisticians on staff as well as third party companies review our de-idenitification regularly. From a population level we were quite solid. That said, were I an attacker trying to re-identify a specific person's data it would be hard to do with just basic demographic information but if you combine some specific health knowledge (a couple health problems you know your coworker has) or appointment info (date, type of doctor, stuff that may also come up in common conversations) it gets a lot easier.
- mfer 5y ago
  Even though this happens... Google still makes me nervous because... - Other large companies with other big agendas have violated rules on data sharing to improve performance in other areas. Amazon comes to mind with how they used markeplace data on vendors to produce their own competitive products. Rules are regularly broken. - Will Google let auditors really have enough insight to make sure data is kept in a controlled manner? Google is so secretive. If a data broker started a secure file sharing service I wouldn't trust them. That's how I feel about this.
  - tedivm 5y ago
    I 100% agree- I'd rather see a small company with various security policies than see a company like Google with the data.
  - QuercusMax 5y ago
    As someone who actually works at Google Health (on an unrelated project), it pains me to see folks suggesting that this type of thing could happen. I can tell you with 100% certainty that there is no way in hell that any of the health data for a project like this could possibly ever be used for advertising to patients. Someone on an eng team with access to this data (which is VERY tightly controlled) who have to write a data export pipeline and deliberately export that data to Ads, and someone on the Ads side would then have to deidentify that data and join it with advertising data. Getting someone to write an export pipeline that will be consumed by other folks in Health, and actually get it used in practice is hard enough, when dealing with all the data restrictions. What you're suggesting is just not going to happen. You shouldn't think of Google as one giant org with a big pot of shared data. It's really dozens of orgs, each with their own sub-orgs, which all have their own databases, file storage, etc. Getting access to data owned by a team the next aisle over is hard. Getting access to data from another org is basically impossible without a ton of oversight.
    - tedivm 5y ago
      Google has proven before that they can't be trusted this way. Even when accidents happen their first instinct is to cover it up. > Google exposed the private data of hundreds of thousands of users of the Google+ social network and then opted not to disclose the issue this past spring, in part because of fears that doing so would draw regulatory scrutiny and cause reputational damage, according to people briefed on the incident and documents reviewed by The Wall Street Journal. https://www.wsj.com/articles/google-exposed-user-data-feared-repercussions-of-disclosing-to-public-1539017194 https://www.wsj.com/articles/google-exposed-user-data-feared... The Google reputation is so bad that my previous company was actually asked by customers if we used Google Cloud, with the implication that they wouldn't work with us if we did.
fmakunbound 5y ago
Google, an adtech company, should not have access to patient records – anonymized or not.

ladyanita22 5y ago

oh boy you're gonna be downvoted here...

tedivm 5y ago

HIPAA lets companies share data with other companies as long as it meets two requirements- 1. The company that collects the data (the covered entity) has to have a Business Associate Agreement in place with the company they're sharing it with. This basically affirms that the other company is aware of their HIPAA requirements and intends to follow them. 2. The Business Associate needs to access the data to do the job they were hired for, which in turn should be related to patient care. There are definitely a lot of companies out there doing this already, but I will say that the people with the data are not exactly giving it up easily. HIPAA makes it so that in the event of a breach the Covered Entity is responsible for beach notification to the patients. That means there's a huge incentive for hospitals, radiology groups, and anyone else who collects this data to make sure that the people they share it with have the proper safeguards in place. There are a ton of hoops to jump through, normally including independent third party audits. I've seen a few medical AI companies fail simply because they didn't have the security and no one trusted them with data.

wins32767 5y ago
That's true if the data is PHI, which means that it's personally identifiable. Per TFA, Google is using anonymized data. There are a bunch of companies that do this already, for example my last startup had anonymized health records from ~240 million Americans.
- tedivm 5y ago
  My last startup does this as well, but in our experience deidentification is not nearly as robust as the companies using it claim it is.
  - potatoman22 5y ago
    Case in point: The Netflix prize fiasco.
  - wins32767 5y ago
    We had biostatisticians on staff as well as third party companies review our de-idenitification regularly. From a population level we were quite solid. That said, were I an attacker trying to re-identify a specific person's data it would be hard to do with just basic demographic information but if you combine some specific health knowledge (a couple health problems you know your coworker has) or appointment info (date, type of doctor, stuff that may also come up in common conversations) it gets a lot easier.
mfer 5y ago
Even though this happens... Google still makes me nervous because... - Other large companies with other big agendas have violated rules on data sharing to improve performance in other areas. Amazon comes to mind with how they used markeplace data on vendors to produce their own competitive products. Rules are regularly broken. - Will Google let auditors really have enough insight to make sure data is kept in a controlled manner? Google is so secretive. If a data broker started a secure file sharing service I wouldn't trust them. That's how I feel about this.
- tedivm 5y ago
  I 100% agree- I'd rather see a small company with various security policies than see a company like Google with the data.
- QuercusMax 5y ago
  As someone who actually works at Google Health (on an unrelated project), it pains me to see folks suggesting that this type of thing could happen. I can tell you with 100% certainty that there is no way in hell that any of the health data for a project like this could possibly ever be used for advertising to patients. Someone on an eng team with access to this data (which is VERY tightly controlled) who have to write a data export pipeline and deliberately export that data to Ads, and someone on the Ads side would then have to deidentify that data and join it with advertising data. Getting someone to write an export pipeline that will be consumed by other folks in Health, and actually get it used in practice is hard enough, when dealing with all the data restrictions. What you're suggesting is just not going to happen. You shouldn't think of Google as one giant org with a big pot of shared data. It's really dozens of orgs, each with their own sub-orgs, which all have their own databases, file storage, etc. Getting access to data owned by a team the next aisle over is hard. Getting access to data from another org is basically impossible without a ton of oversight.
  - tedivm 5y ago
    Google has proven before that they can't be trusted this way. Even when accidents happen their first instinct is to cover it up. > Google exposed the private data of hundreds of thousands of users of the Google+ social network and then opted not to disclose the issue this past spring, in part because of fears that doing so would draw regulatory scrutiny and cause reputational damage, according to people briefed on the incident and documents reviewed by The Wall Street Journal. https://www.wsj.com/articles/google-exposed-user-data-feared-repercussions-of-disclosing-to-public-1539017194 https://www.wsj.com/articles/google-exposed-user-data-feared... The Google reputation is so bad that my previous company was actually asked by customers if we used Google Cloud, with the implication that they wouldn't work with us if we did.

fmakunbound 5y ago

Google, an adtech company, should not have access to patient records – anonymized or not.