“Project Nightingale” now facing federal inquiry
By Jalen Maki
According to reporting from the Wall Street Journal, Google has been collecting the medical information of millions of Ascension patients in a data transfer that has sparked privacy concerns and is now at the center of a federal inquiry.
“Project Nightingale,” which is reportedly set to be completed in March, will see the medical information of 50 million or more Americans transferred from Ascension, a St. Louis-based nonprofit Catholic health system and the second-largest healthcare provider in the country, to Google, for storage and analysis in a cloud system designed by the tech giant.
The transfer of medical data from a health care system to a business partner is legal under the Health Insurance Portability and Accountability Act, or HIPAA, if that information is used “only to help the covered entity carry out its healthcare functions—not for the business associate’s independent use or purposes,” according to the Department of Health and Human Services.
Patients were reportedly not notified of the transfer.
The Wall Street Journal’s reporting states up to 150 Google employees may have had access to patients’ medical data, which was reportedly not “de-identified,” meaning patients’ personal information was not removed.
Ascension has hospitals in Tomahawk, Merrill, Rhinelander and Woodruff, along with about 150 others in 21 states.
The deal between Google and Ascension was first reported by the Wall Street Journal on Monday, Nov. 11, and was signed hours later, formally green-lighting the data transfer. However, the Wall Street Journal’s reporting states the two entities have been working together on the project since last year.
Eduardo Conrado, Executive Vice President of Strategy and Innovations at Ascension, said in a statement from Tuesday, Nov. 12, that the arrangement was “anything but secret.”
“In fact, Google first announced its work with us in July, on its Q2 earnings call,” he stated. “Acute care administrative and clinical leaders across Ascension have been informed of the work, enterprise-wide webinars have been held, and the clinical leaders of our employed physician group have been informed in detail about the project. In our deployment sites, front-line nurses and clinicians have not only been informed but have actively participated in the project.”
Ascension did not comment on whether Ascension patients, or all Ascension staff, were notified of the partnership and/or data transfer in any other ways besides the Google earnings call prior to Nov. 11.
In a statement from Nov. 11, released shortly after the Wall Street Journal story was published, Ascension said it is working with Google “to optimize the health and wellness of individuals and communities, and deliver a comprehensive portfolio of digital capabilities that enhance the experience of Ascension consumers, patients and clinical providers across the continuum of care.”
The collaboration will include both the transfer of the data to the Google-designed cloud system and the exploration of “artificial intelligence/machine learning applications that will have the potential to support improvements in clinical quality and effectiveness, patient safety, and advocacy on behalf of vulnerable populations, as well as increase consumer and provider satisfaction,” the statement says.
Tariq Shaukat, President of Google Cloud, said in the release, “By working in partnership with leading healthcare systems like Ascension, we hope to transform the delivery of healthcare through the power of the cloud, data analytics, machine learning, and modern productivity tools—ultimately improving outcomes, reducing costs, and saving lives.”
Google and Ascension have already been testing software that will allow medical providers to “search a patient’s electronic health record by specific data categories and create graphs of the information, like blood test results over time,” according to The New York Times. Improved patient data access and patient care, along with the ability to “glean insights from the data to help treatment,” are the ultimate goals, the Times story states.
Numerous Ascension employees involved in Project Nightingale reportedly expressed concerns about whether all of the Google software involved in processing Ascension patient data complies with the HIPAA, which restricts how doctors, health systems and their business associations may handle identifiable patient data.
In the Nov. 11 statement, Ascension said, “All work related to Ascension’s engagement with Google is HIPAA compliant and underpinned by a robust data security and protection effort and adherence to Ascension’s strict requirements for data handling.”
In a blog post from Nov. 11, Google said the Ascension data “cannot be used for any other purpose than for providing these services we’re offering under the agreement, and patient data cannot and will not be combined with any Google consumer data.”
The Department of Health and Human Services’ Office for Civil Rights, which enforces the HIPAA, opened an inquiry into Project Nightingale on Tuesday, Nov. 12, according to the Wall Street Journal. The office will “seek to learn more information about this mass collection of individuals’ medical records to ensure that (the HIPAA) protections were fully implemented,” office director Roger Severino said in a statement to the publication.
In the past, Google has faced scrutiny and has been punished for its handling of user data.
The company paid a $170 million penalty to the Federal Trade Commission in September to settle accusations that YouTube violated the law when it knowingly tracked and sold ads targeted to children. The penalty was the largest ever under the Children’s Online Privacy Protection Act.
The deal between Google and Ascension comes at a time when tech companies are trying to obtain a larger foothold in the healthcare industry. In recent years, Google, Apple, Amazon and Microsoft, known as the “Big 4” tech companies, have been “leveraging their own core business strengths to reinvent healthcare by developing and collaborating on new tools for patients, care providers, and insurers that will position them for healthcare domination,” states Healthcare Weekly.