Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google's harvest of medical data includes names and full details of millions

theguardian.com

Post reply on HN
Print view View original

31–40 of 120 posts

Re: Google's harvest of medical data includes names and full details of millions

#31

Post by bduerst »

izacus wrote: post #26
SEJeff wrote: post #2

How is this not a criminal breach of HIPAA laws? https://www.hhs.gov/hipaa/for-individuals/guidance-materials...

Google's press release actually adresses HIPAA: https://cloud.google.com/blog/topics/inside-google-cloud/our...

Important part:

>What about patient data? All of Google’s work with Ascension adheres to industry-wide regulations (including HIPAA) regarding patient data, and come with strict guidance on data privacy, security and usage. ... To be clear: under this arrangement, Ascension’s data cannot be used for any other purpose than for providing these services we’re offering under the agreement, and patient data cannot and will not be combined with any Google consumer data.

Re: Google's harvest of medical data includes names and full details of millions

#32

Post by izacus »

excalibur wrote: post #21
umeshunni wrote: post #5

Earlier quoted context omitted.

Seems like a lot of fake news over a cloud storage deal https://cloud.google.com/blog/topics/inside-google-cloud/our...

This is not "fake news" at all. This is the same factual event covered with a different spin. Use of the term "fake news" to describe reporting that is merely slanted in a direction you don't like--rather than presenting demonstrably false information as fact--is completely unwarranted, and is doing terrible damage to our social institutions.

This is a TEXTBOOK case of fake news - a newspaper owned by Google competitor spinning purchase of space on encrypted Cloud Storage and Google Apps productivity suite as a big medical data mining attempt by Google to drive a political agenda.

There are obvious concerns around data security here, but the article is very heavily distorting facts to drive outrage.

Re: Google's harvest of medical data includes names and full details of millions

#33

Post by bogwog »

umeshunni wrote: post #5
yRetsyM wrote: post #4

What is actually happening here? A lot of rhetoric about the "Transfer of data" etc, but other times this just reads like a Google Cloud Infrastructure play, with some consulting on top. Also - The deal was only just signed, e.g. the transfer hasn't happened yet? There's a lot of hearsay in all of this reporting...

Seems like a lot of fake news over a cloud storage deal https://cloud.google.com/blog/topics/inside-google-cloud/our...

Did you even read the article you linked to?

> What is the work we’re doing with Ascension? Back in July, on our Q2 earnings call, we announced “Google Cloud’s AI and ML solutions are helping healthcare organizations like Ascension improve the healthcare experience and outcomes.

"AI and ML solutions" sounds like a lot more than just data storage.

They have complete access to the entire database of names, addresses, medical history, etc. and are playing with it to develop products to later sell to other healthcare providers. Without the knowledge or consent of the patients.

Also in that article:

> under this arrangement, Ascension’s data cannot be used for any other purpose than for providing these services we’re offering under the agreement, and patient data cannot and will not be combined with any Google consumer data.

If I had a nickel for every time a tech giant outright lied about how they handle data, I'd be able to afford SV rent.

Re: Google's harvest of medical data includes names and full details of millions

#35

Post by OnlineGladiator »

bduerst wrote: post #31
izacus wrote: post #26

Earlier quoted context omitted.

Google's press release actually adresses HIPAA: https://cloud.google.com/blog/topics/inside-google-cloud/our...

Important part: >What about patient data? All of Google’s work with Ascension adheres to industry-wide regulations (including HIPAA) regarding patient data, and come with strict guidance on data privacy, security and usage. ... To be clear: under this arrangement, Ascension’s data cannot be used for any other purpose than for providing these services we’re offering under the agreement, and patient data cannot and wil…

> and patient data cannot and will not be combined with any Google consumer data.

Does anybody enforce this or do we just take Google at their word?

Re: Google's harvest of medical data includes names and full details of millions

#36

Post by buboard »

twobat wrote: post #13
rayuela wrote: post #8

So what do we do to stop this? What recourse do people directly affected by this have?

GDPR should kick in long before medical data is on the table.

laws protecting medical data are stricter and preceded gdpr by many years

Re: Google's harvest of medical data includes names and full details of millions

#37

Post by papln »

OnlineGladiator wrote: post #35
bduerst wrote: post #31

Earlier quoted context omitted.

Important part: >What about patient data? All of Google’s work with Ascension adheres to industry-wide regulations (including HIPAA) regarding patient data, and come with strict guidance on data privacy, security and usage. ... To be clear: under this arrangement, Ascension’s data cannot be used for any other purpose than for providing these services we’re offering under the agreement, and patient data cannot and wil…

> and patient data cannot and will not be combined with any Google consumer data. Does anybody enforce this or do we just take Google at their word?

Does anyone enforce any law?

Re: Google's harvest of medical data includes names and full details of millions

#38

Post by papln »

SEJeff wrote: post #14
mercwear wrote: post #9

Earlier quoted context omitted.

The article says that it might be: "According to the whistleblower, the security fears raised at that meeting, including concerns that the transfer may be in breach of federal HIPAA rules on data privacy, have so far gone unanswered by Google." That said, most people do not understand how HIPAA works (I am in no way saying you are one of these people). Unless you are a healthcare provider (think doctor) or a business…

I am indeed someone who doesn’t understand how HIPAA works. I have seen instances of healthcare professionals getting jail time for disclosing celebrity health records however. How is google able to legally get access to these records? I suspect they’re not and if so, someone should be held criminally liable for this. If google is able to get these, what’s stopping anyone else?

> I suspect they’re not

Why not?

Re: Google's harvest of medical data includes names and full details of millions

#39

Post by vineyardmike »

chooseaname wrote: post #23

> Google could go on to use its AI analytics to predict outcomes for individual patients, they posited. This is the most scary part[0]. I'm sure plenty here would disagree, but I simply don't (yet) share your optimism for A.I. [0] Not that the rest isn't scary.

I know several smart people at google, and I dont want to be critical of individuals. BUT it seems sometimes like google-the-company is of the mentality that they're smart, and with enough data and some ML chops they can solve anything, and frankly I'm not as confident - but I don't find it scary.

The casual data-grabbing that they're doing is most-scary to me, since I would hope that my data would never be accessible to them/others as readily as I now suspect it is.

Re: Google's harvest of medical data includes names and full details of millions

#40

Post by papln »

rayuela wrote: post #8

So what do we do to stop this? What recourse do people directly affected by this have?

https://www.hhs.gov/hipaa/filing-a-complaint/complaint-proce...

Complaint Requirements

Anyone can file a health information privacy or security complaint. Your complaint must:

Be filed in writing by mail, fax, e-mail, or via the OCR Complaint Portal

Name the covered entity or business associate involved, and describe the acts or omissions, you believed violated the requirements of the Privacy, Security, or Breach Notification Rules

Be filed within 180 days of when you knew that the act or omission complained of occurred. OCR may extend the 180-day period if you can show "good cause"

Post reply on HN