Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google's harvest of medical data includes names and full details of millions

theguardian.com

Post reply on HN
Print view View original

101–110 of 120 posts

Re: Google's harvest of medical data includes names and full details of millions

#101

Post by altgoogler »

_pgmf wrote: post #90
altgoogler wrote: post #69

Googler here, my opinions are my own, standard disclaimer. I'm not going to comment on this specific case but I do have almost a decade of previous non-Google experience working in clinical documentation technology. As others have said, entering into a BAA with a covered entity, as HIPAA defines it, shouldn't be seen as a controversial action. There are numerous problems in healthcare that are too complex for individ…

I think the issue is the fact that Google, the epitome of faceless/impenetrable data capitalism, is now holding my health records.

You're certainly entitled to that viewpoint. The point is that:

"Google's harvest of medical data includes names and full details of millions"

is hyperbole, when

"Google partners with health system on clinical documentation research" is more accurate.

I'm a proponent of more consumer control over their data, along the lines of GDPR. You could, theoretically, request that your covered entities give you a copy and then delete all of your records from their systems at any time.

Which for consumer data Google already gives you the option to do so (e.g. takeout.google.com)

Re: Google's harvest of medical data includes names and full details of millions

#102

Post by marcinzm »

bduerst wrote: post #97
marcinzm wrote: post #71

Earlier quoted context omitted.

No you don’t, there are fines if you are found in violation but no one is checking on an ongoing basis. Specific entities may privately pay for audits or do so as part of certifications (HiTrust, etc) but that’s not required.

The dept of HHS requires any organization with HIPAA business associate status to regularly undergo audits. Can you fly under the radar and potentially get away with not doing it? Of course, anything is possible. Could a multibillion dollar internet organization beholden to shareholders and under public scrutiny get away with it? Not likely.

>The dept of HHS requires any organization with HIPAA business associate status to regularly undergo audits.

Can you provide a link to this requirement? The HIPAA/HITECH laws provide no requirements for an external audit (and self-audits aren't actually audits) and the HHS, as far as I know, only does small sample random audits unless a complaint was made.

Re: Google's harvest of medical data includes names and full details of millions

#103

Post by drcode »

JohnFen wrote: post #92
drcode wrote: post #91

Earlier quoted context omitted.

Well, I think most people in this comments section would say "blanket consent when signing hospital forms is unacceptable and patients should get notified and paid every time someone uses an element of their data". If that's the standard society wants to adopt, so be it- But it might come at a dramatic cost in slowing down medical innovations. Personally, that seems like a bad tradeoff to me, but who can say for sure…

> patients should get notified and paid every time someone uses an element of their data I don't know about most people here, but I wouldn't say that. Notification or being paid is beside the point. The point is that informed consent should be obtained. You're right that blanket consent forms don't count as "informed consent" for this sort of thing because they don't actually inform you. > Personally, that seems like…

> you'd have no problem giving such consent. I, however, would not be willing to give such consent.

That logic only works if you don't still benefit from the research findings that are obtained from my data. e.g. "tragedy of the commons"

Re: Google's harvest of medical data includes names and full details of millions

#104

Post by perl4ever »

altgoogler wrote: post #101
_pgmf wrote: post #90

Earlier quoted context omitted.

I think the issue is the fact that Google, the epitome of faceless/impenetrable data capitalism, is now holding my health records.

You're certainly entitled to that viewpoint. The point is that: "Google's harvest of medical data includes names and full details of millions" is hyperbole, when "Google partners with health system on clinical documentation research" is more accurate. I'm a proponent of more consumer control over their data, along the lines of GDPR. You could, theoretically, request that your covered entities give you a copy and then…

"takeout.google.com"

Interesting, never heard of that. Where's the delete button?

Of course, I can't hit delete all, because I have no alternative to an Android phone other than Apple.

Re: Google's harvest of medical data includes names and full details of millions

#105

Post by perl4ever »

Braggadocious wrote: post #48

I fear all of this will be used as part of a prediction program to find the best employees based on performance metrics. Imagine if before you even gave an applicant a callback you could see if they've ever had a bout of depression, insomnia, anything that may affect their job performance or the performance of their team. That would be standard part of any background check if that information was available.

The nice thing about the modern world is that nobody has to make the decision to do that or be aware. That sort of discrimination can filter through ML-derived correlations at two, three or more levels removed, and every human being can be as innocent as can be.

Re: Google's harvest of medical data includes names and full details of millions

#106

Post by perl4ever »

legulere wrote: post #68
drcode wrote: post #67

I know I'm very much in the minority here, but just like we should have more open borders and more open software, we should encourage more openness around medical data. Google and other large companies have made some significant AI advances in the last decade & I think it's in all of our interests to see if these advances can lead to improvements in health care. Yes, it's scary how much data these companies have coll…

I know how hard it is to get enough medical data to do research. But why do you need names? Correlate diseases with first names?

On the other hand, it's been shown that even without information defined as PII, it's very easy to identify individuals from a combination of other data points. When you're dredging the ocean for correlations, this will just automatically catch everybody anyway, whether intentionally or not.

Re: Google's harvest of medical data includes names and full details of millions

#107

Post by dredmorbius »

dragonwriter wrote: post #81
dredmorbius wrote: post #63

Earlier quoted context omitted.

My view is that consent is oversold. If I "consent" to a boilerplate agreement handed me moments before an action is taken, have I really? Boundaries and distributions should be clearly, specifically specified, with any non-essential distributions requiring specific assent, defaulting to none. If there are consequences to sharing, those can be made known. We've been drawn into a circumstance which has long been unten…

> If I "consent" to a boilerplate agreement handed me moments before an action is taken, have I really? A not uncommon practice with HIPAA “disclosures” is to sign an electronic device that records the signature (and provides no evidence that the document your signature is associated with is anything like the one you were given) prior to being provided with documents. So, yeah, the practices around consent with PHI s…

I would flat out refuse.

Re: Google's harvest of medical data includes names and full details of millions

#108

Post by jobigoud »

dredmorbius wrote: post #63
TaylorAlexander wrote: post #54

Earlier quoted context omitted.

Not defending the article (I’ve not read it), but I suppose I probably would be horrified with the status quo. I really wish we had a more consent based data culture. I suppose I don’t know how that would be designed. But lots of real things are horrifying and it’s not necessarily fine just that something is normal.

My view is that consent is oversold. If I "consent" to a boilerplate agreement handed me moments before an action is taken, have I really? Boundaries and distributions should be clearly, specifically specified, with any non-essential distributions requiring specific assent, defaulting to none. If there are consequences to sharing, those can be made known. We've been drawn into a circumstance which has long been unten…

This why there is the concept of informed consent.

Re: Google's harvest of medical data includes names and full details of millions

#109

Post by dredmorbius »

jobigoud wrote: post #108
dredmorbius wrote: post #63

Earlier quoted context omitted.

My view is that consent is oversold. If I "consent" to a boilerplate agreement handed me moments before an action is taken, have I really? Boundaries and distributions should be clearly, specifically specified, with any non-essential distributions requiring specific assent, defaulting to none. If there are consequences to sharing, those can be made known. We've been drawn into a circumstance which has long been unten…

This why there is the concept of informed consent.

Actually, that's not accurate in this case.

If you inform me, then hand me a pre-printed document with a huge set of conditions on it, or worse as another response notes, simply collect my signature, it's not that I'm not enformed. It's that I'm not empowered to act on the basis of that information in any meaningful way.

It's a sham.

I'm a fan of the power of etymologies to reveal if not necessarily the present meanings of words, the paths by which they've arrived to the present. In the case of consent:

c. 1300, "agree, give assent; yield when one has the right, power, or will to oppose," from Old French consentir "agree; comply" (12c.) and directly from Latin consentire "agree, accord," literally "feel together," from assimilated form of com "with, together" (see con-) + sentire "to feel" (see sense (n.)).

https://www.etymonline.com/word/consent

(A true gem of the Internet.)

Re: Google's harvest of medical data includes names and full details of millions

#110

Post by coleifer »

altgoogler wrote: post #101
_pgmf wrote: post #90

Earlier quoted context omitted.

I think the issue is the fact that Google, the epitome of faceless/impenetrable data capitalism, is now holding my health records.

You're certainly entitled to that viewpoint. The point is that: "Google's harvest of medical data includes names and full details of millions" is hyperbole, when "Google partners with health system on clinical documentation research" is more accurate. I'm a proponent of more consumer control over their data, along the lines of GDPR. You could, theoretically, request that your covered entities give you a copy and then…

Moving the goalposts.
Post reply on HN