Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google whistleblower: the medical data of millions of Americans is at risk

theguardian.com

Post reply on HN
Print view View original

21–30 of 83 posts

Re: Google whistleblower: the medical data of millions of Americans is at risk

#21

Post by smolder »

blissofbeing wrote: post #12
triceratops wrote: post #10

Earlier quoted context omitted.

Isn't embarrassment enough? Why do you close the door when you go to the bathroom? In addition, many diseases like STD/STIs or mental illness carry a stigma. Information like that, if inadequately protected, can have a social or even financial cost like losing your job.

Maybe if it was public these diseases wouldn't be so stigmatized. It might have a social impact now, but I see that as the issue.

I think you're underestimating people's ability or inclination to abuse information for personal gain.

Re: Google whistleblower: the medical data of millions of Americans is at risk

#22

Post by summerlight »

ocdtrekkie wrote: post #16
DIVx0 wrote: post #6

I work for a large US based corp that focuses on technology and data services for the healthcare field. We have massive amounts of PHI for the majority of people who have visited a provider within the country. We apply all sorts of stuff to this data, ML, AI or whatever other buzzy tech you can think of. Most of this work happens within our own data centers but there is significant work done within public clouds. We…

I think the highlight point, that is new information (AFAIK) in this article is that 150 Google employees are working on this project . So this isn't "Ascension is hosting their data in the cloud", it's "Google is working with health data".

IIUC, this is also an industry standard practice as long as it's covered by their BAA. The question would be whether the actual content in the BAA makes sense or not, but I think the requirement for a BAA is pretty specific.

https://www.hhs.gov/hipaa/for-professionals/covered-entities...

Re: Google whistleblower: the medical data of millions of Americans is at risk

#23

Post by mfer »

DIVx0 wrote: post #6

I work for a large US based corp that focuses on technology and data services for the healthcare field. We have massive amounts of PHI for the majority of people who have visited a provider within the country. We apply all sorts of stuff to this data, ML, AI or whatever other buzzy tech you can think of. Most of this work happens within our own data centers but there is significant work done within public clouds. We…

From the original WSJ article...

> Staffers across Alphabet Inc., Google’s parent, have access to the patient information, documents show, including some employees of Google Brain, a research science division credited with some of the company’s biggest breakthroughs.

I'm struck by the wide access of those within Alphabet to health information that's not anonymous.

Is this how other healthcare companies are doing it?

Re: Google whistleblower: the medical data of millions of Americans is at risk

#24

Post by summerlight »

temac wrote: post #18
DIVx0 wrote: post #6

I work for a large US based corp that focuses on technology and data services for the healthcare field. We have massive amounts of PHI for the majority of people who have visited a provider within the country. We apply all sorts of stuff to this data, ML, AI or whatever other buzzy tech you can think of. Most of this work happens within our own data centers but there is significant work done within public clouds. We…

It is not just because "everybody" is doing crazy shit, that it is OK to do it.

Then you should blame the industry rather than a newcomer to the industry who tries to follow the industry standard?

Re: Google whistleblower: the medical data of millions of Americans is at risk

#25

Post by Kalium »

mfer wrote: post #23
DIVx0 wrote: post #6

I work for a large US based corp that focuses on technology and data services for the healthcare field. We have massive amounts of PHI for the majority of people who have visited a provider within the country. We apply all sorts of stuff to this data, ML, AI or whatever other buzzy tech you can think of. Most of this work happens within our own data centers but there is significant work done within public clouds. We…

From the original WSJ article... > Staffers across Alphabet Inc., Google’s parent, have access to the patient information, documents show, including some employees of Google Brain, a research science division credited with some of the company’s biggest breakthroughs. I'm struck by the wide access of those within Alphabet to health information that's not anonymous. Is this how other healthcare companies are doing it?

One reading of this is that it's a cross-departmental collaboration, rather than just a single division.

Re: Google whistleblower: the medical data of millions of Americans is at risk

#26

Post by JohnFen »

summerlight wrote: post #22
ocdtrekkie wrote: post #16

Earlier quoted context omitted.

I think the highlight point, that is new information (AFAIK) in this article is that 150 Google employees are working on this project . So this isn't "Ascension is hosting their data in the cloud", it's "Google is working with health data".

IIUC, this is also an industry standard practice as long as it's covered by their BAA. The question would be whether the actual content in the BAA makes sense or not, but I think the requirement for a BAA is pretty specific. https://www.hhs.gov/hipaa/for-professionals/covered-entities...

To the best of my knowledge, the BAA has not been published, so we have no idea what it says.

But what seems clear is that a ton of complete medical data, including names and other identifying data, has been handed to Google for its use in what sounds like training an ML system.

That we don't know what restrictions are in place (if any) is a large part of why this is so alarming.

Re: Google whistleblower: the medical data of millions of Americans is at risk

#27

Post by marcinzm »

janlin1999 wrote: post #3

The real story here might be about how many exceptions are allowed within HIPAA, and how often health data gets transferred. My understanding is that patient consent is not necessary for things like research, which Google's AI efforts could be argued to fall under. This makes sense in that requiring researchers to get consent for every piece of patient data would quickly become cost-prohibitive for many types of stud…

>My understanding is that patient consent is not necessary for things like research, which Google's AI efforts could be argued to fall under.

HIPAA allows for entities to share data with other entities which provide a service to the original entity. For example, Hospitals may share data to a billing provider or a claims analytics provider. It’s almost certain that Google is following the letter of the law.

Re: Google whistleblower: the medical data of millions of Americans is at risk

#28

Post by [deleted] »

JohnFen wrote: post #26
summerlight wrote: post #22

Earlier quoted context omitted.

IIUC, this is also an industry standard practice as long as it's covered by their BAA. The question would be whether the actual content in the BAA makes sense or not, but I think the requirement for a BAA is pretty specific. https://www.hhs.gov/hipaa/for-professionals/covered-entities...

To the best of my knowledge, the BAA has not been published, so we have no idea what it says. But what seems clear is that a ton of complete medical data, including names and other identifying data, has been handed to Google for its use in what sounds like training an ML system. That we don't know what restrictions are in place (if any) is a large part of why this is so alarming.

[deleted]

Re: Google whistleblower: the medical data of millions of Americans is at risk

#29

Post by smt88 »

summerlight wrote: post #24
temac wrote: post #18

Earlier quoted context omitted.

It is not just because "everybody" is doing crazy shit, that it is OK to do it.

Then you should blame the industry rather than a newcomer to the industry who tries to follow the industry standard?

No one should be excused for unethical behavior just because it’s standard industry practice.

Re: Google whistleblower: the medical data of millions of Americans is at risk

#30

Post by tmaly »

A single HIPPA violation for a single record alone is costly. There was a Ask HN post a few weeks back where someone posted a medical record horror story. They later deleted the post after pointing out that even programmers are criminally liable.
Post reply on HN