Live data from Hacker News

Google's harvest of medical data includes names and full details of millions

theguardian.com

11–20 of 120 posts

Re: Google's harvest of medical data includes names and full details of millions

#11
post #4

What is actually happening here? A lot of rhetoric about the "Transfer of data" etc, but other times this just reads like a Google Cloud Infrastructure play, with some consulting on top. Also - The deal was only just signed, e.g. the transfer hasn't happened yet? There's a lot of hearsay in all of this reporting...

Note this key part:

Google has entered into similar partnerships on a much smaller scale with clients such as the Colorado Center for Personalized Medicine. But in that case all the data handed over to the search giant was encrypted, with keys being held only on the medical side.

It sounds like they are migrating to Google Cloud for some of their infrastructure.. and someone (and the paper) are sure trying to raise a stink about it. its misleading in a few spots, but not quite lying, hard to tell if its intentional, or technical incompetence.

For example, all storage in google cloud is encrypted, and the keys are rotated every 24 hours by default. There is an audit log you can see, any time anyone at google touches your data. (very, very few people can actually access the keys)

Re: Google's harvest of medical data includes names and full details of millions

#12
post #2

How is this not a criminal breach of HIPAA laws? https://www.hhs.gov/hipaa/for-individuals/guidance-materials...

It's not inherently a HIPAA breach to use cloud hosting for your data. As long as you tick the security and compliance boxes, it's perfectly legit.

Re: Google's harvest of medical data includes names and full details of millions

#14
post #9
post #2

How is this not a criminal breach of HIPAA laws? https://www.hhs.gov/hipaa/for-individuals/guidance-materials...

The article says that it might be: "According to the whistleblower, the security fears raised at that meeting, including concerns that the transfer may be in breach of federal HIPAA rules on data privacy, have so far gone unanswered by Google." That said, most people do not understand how HIPAA works (I am in no way saying you are one of these people). Unless you are a healthcare provider (think doctor) or a business…

I am indeed someone who doesn’t understand how HIPAA works. I have seen instances of healthcare professionals getting jail time for disclosing celebrity health records however. How is google able to legally get access to these records? I suspect they’re not and if so, someone should be held criminally liable for this.

If google is able to get these, what’s stopping anyone else?

Re: Google's harvest of medical data includes names and full details of millions

#15
Any google employees/friends of google employees here with insight as how staff is receiving this news? My guess is like all other egregious abuses of power, the employees will stage a "protest" to feel good about themselves then keep working there.

Re: Google's harvest of medical data includes names and full details of millions

#16
post #2

How is this not a criminal breach of HIPAA laws? https://www.hhs.gov/hipaa/for-individuals/guidance-materials...

HIPAA only applies to Covered Entities: insurers, healthcare providers and clearinghouses (claims processors). This info is in your link.

Re: Google's harvest of medical data includes names and full details of millions

#17
post #16
post #2

How is this not a criminal breach of HIPAA laws? https://www.hhs.gov/hipaa/for-individuals/guidance-materials...

HIPAA only applies to Covered Entities: insurers, healthcare providers and clearinghouses (claims processors). This info is in your link.

From the link below the bullet points:

"In addition, business associates of covered entities must follow parts of the HIPAA regulations."

All vendors must comply with HIPAA laws (ie EMR systems)

Re: Google's harvest of medical data includes names and full details of millions

#18

Any google employees/friends of google employees here with insight as how staff is receiving this news? My guess is like all other egregious abuses of power, the employees will stage a "protest" to feel good about themselves then keep working there.

As opposed to yelling into the void on an anonymous online forum?

Re: Google's harvest of medical data includes names and full details of millions

#19

Any google employees/friends of google employees here with insight as how staff is receiving this news? My guess is like all other egregious abuses of power, the employees will stage a "protest" to feel good about themselves then keep working there.

I don’t see them staging a protest. The issue is too mainstream to earn them any Internet points. However, this is the kind of issue that matters to many people and could affect adversely. Still I think it’s up to the Congress and people to push back on abuses like this.

Re: Google's harvest of medical data includes names and full details of millions

#20
post #6

Earlier quoted context omitted.

Seems like a lot of fake news over a cloud storage deal https://cloud.google.com/blog/topics/inside-google-cloud/our...

Well, that seems a lot less sensational than the article. Covers HIPAA as well.

Without reading the Business Association Agreement it is hard to determine if Google has 'Acceptable Use' of healthcare data. Storing in the cloud is one thing, allowing a Business Associate to siphon that data for other use is another.
Post reply on HN