Disclaimer: Googler here, my opinions are my own.
I have no non-public knowledge of this topic besides these two Guardian reports, and the Google public blog post on the same subject[1].
I do, however, have nearly a decade in non-Google work experience working in clinical documentation technologies for a company who had BAAs with literally dozens of health companies.
I simply do not understand the objection this whistle-blower is raising. As far as I understand it, the controversy is simply because Google is involved.
> Above all: why was the information being handed over in a form that had not been “de-identified"
DeID is typically used at the edges of an IT system, and is tailored to the rights of certain users accessing the system. If you have a system that says, "A ha! There's a patient with a 5mm AAA with no evidence of follow-up! They need a procedure STAT!", you obviously need to have the original documentation to know who to contact.
There are ways to keep PHI (identifying info) separated from documentation, but if Google is both the cloud storage provider and doing R&D, both sides of that system would fall on the Google side of the fence.
The bulk transfer of documents was almost certainly done via HL7v2 messages which, IIRC, don't have any built-in mechanism for redacting PHI, and if it did usually health systems lack the expertise do this consistently between all BAAs they contract with.
> I was worried too about the security aspect of placing vast amounts of medical data in the digital cloud.
I mean, yeah, this is an important set of data. In previous years the issues were people walking out of the health system with their laptop and it getting stolen with 1ks of records on it. Cloudification has certainly reduced the vectors to steal large quantities of data.
> data potentially being handed on to third parties;
Their BAA specifically prevents this.
> adverts one day being targeted at patients according to their medical histories.
Again, the law specifically prevents this use. These are all hypothetical scenarios.
> Full HIPAA compliance must be enforced, and boundaries must be put in place to prevent third parties gaining access to the data without public consent.
There simply is no evidence that full HIPAA compliance isn't being followed.
> Employees at big tech companies having access to personal information
Thousands of employees at Ascension have this level of access. I personally had access to millions of health care records. BUT! There were auditing systems in place. If you attempted to use that access outside of the scope of your job, you're fired, no second chance.
> To quote one of my role models, Luke Skywalker: “May the force be with you”.
Are you kidding me? Is this satire?
> In short, patients and the public have a right to know what’s happening to their personal health information at every step along the way.
In short, the concerns here are all hypothetical. There's no basis of any wrong doing. There is no proposal to actually address these concerns in a practical way.
[1] https://cloud.google.com/blog/topics/inside-google-cloud/our...