Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google's harvest of medical data includes names and full details of millions

theguardian.com

Post reply on HN
Print view View original

81–90 of 120 posts

Re: Google's harvest of medical data includes names and full details of millions

#81

Post by dragonwriter »

dredmorbius wrote: post #63
TaylorAlexander wrote: post #54

Earlier quoted context omitted.

Not defending the article (I’ve not read it), but I suppose I probably would be horrified with the status quo. I really wish we had a more consent based data culture. I suppose I don’t know how that would be designed. But lots of real things are horrifying and it’s not necessarily fine just that something is normal.

My view is that consent is oversold. If I "consent" to a boilerplate agreement handed me moments before an action is taken, have I really? Boundaries and distributions should be clearly, specifically specified, with any non-essential distributions requiring specific assent, defaulting to none. If there are consequences to sharing, those can be made known. We've been drawn into a circumstance which has long been unten…

> If I "consent" to a boilerplate agreement handed me moments before an action is taken, have I really?

A not uncommon practice with HIPAA “disclosures” is to sign an electronic device that records the signature (and provides no evidence that the document your signature is associated with is anything like the one you were given) prior to being provided with documents. So, yeah, the practices around consent with PHI suck pretty hard.

Re: Google's harvest of medical data includes names and full details of millions

#83

Post by JohnFen »

altgoogler wrote: post #69

Googler here, my opinions are my own, standard disclaimer. I'm not going to comment on this specific case but I do have almost a decade of previous non-Google experience working in clinical documentation technology. As others have said, entering into a BAA with a covered entity, as HIPAA defines it, shouldn't be seen as a controversial action. There are numerous problems in healthcare that are too complex for individ…

> As others have said, entering into a BAA with a covered entity, as HIPAA defines it, shouldn't be seen as a controversial action.

You place more faith in HIPAA than I do. HIPAA does not protect privacy to the degree that most people assume.

> There are numerous problems in healthcare that are too complex for individual health systems to tackle.

True, but that doesn't mean that Google is the right entity to do this. In my opinion, they're the wrong entity, because Google is not exactly trustworthy.

> Google is not the only player doing this at scale. They're not even the largest one.

But they're Google. What this sort of thing means for me is that I need to start asking medical providers if they're participating in this sort of thing with Google (or other companies that I consider bad actors), so I know which ones to avoid using.

Re: Google's harvest of medical data includes names and full details of millions

#84

Post by JohnFen »

umeshunni wrote: post #5
yRetsyM wrote: post #4

What is actually happening here? A lot of rhetoric about the "Transfer of data" etc, but other times this just reads like a Google Cloud Infrastructure play, with some consulting on top. Also - The deal was only just signed, e.g. the transfer hasn't happened yet? There's a lot of hearsay in all of this reporting...

Seems like a lot of fake news over a cloud storage deal https://cloud.google.com/blog/topics/inside-google-cloud/our...

It's not just a cloud storage deal. The medical data is being used by Google for research purposes (training AI, apparently). Who knows what else Google will do with it now or in the future?

The real problem, though, is that this data was transferred without even notifying patients, let alone getting their consent.

Re: Google's harvest of medical data includes names and full details of millions

#85

Post by JohnFen »

mattmanser wrote: post #61
OnlineGladiator wrote: post #41

Earlier quoted context omitted.

When there's an obvious breach, hopefully. How would we even know if Google were abusing this data though? Does anyone have access to it besides Google? Are we literally asking Google to regulate itself with this data? EDIT: I guess I don't understand. Once we give Google the sensitive information, how do we have any way of knowing what they do with it? I'm guessing an audit on all of Google's data is out of the ques…

The point of this article is that a whistleblower is saying "they're not controlling access properly". While the Grauniad is trying to spin it to sound worse, the whole point is Google are providing data processing services to a valid HIPAA processor via Google Cloud, not that they nefariously bought the data to integrate it with the search results. Much like health data stored on AWS with a dedicated internal projec…

> not that they nefariously bought the data to integrate it with the search results.

I don't think that anyone is claiming they are intending to do this.

Re: Google's harvest of medical data includes names and full details of millions

#86

Post by JohnFen »

shadowgovt wrote: post #76
Aaronstotle wrote: post #15

Any google employees/friends of google employees here with insight as how staff is receiving this news? My guess is like all other egregious abuses of power, the employees will stage a "protest" to feel good about themselves then keep working there.

I don't think they see this as an egregious abuse of power. Googlers trust Google to do a pretty decent job of securing private information almost all of the time; this isn't an area of moral concern for them. (i.e. the question in their minds is "Is the data safer in the source repositories?" And it's probably not).

The problem is that Googlers (like far too many tech companies) view data as being secure if outsiders can't get access to it. They don't count access by themselves as a security issue, even though it objectively is.

Re: Google's harvest of medical data includes names and full details of millions

#87

Post by JohnFen »

drcode wrote: post #67

I know I'm very much in the minority here, but just like we should have more open borders and more open software, we should encourage more openness around medical data. Google and other large companies have made some significant AI advances in the last decade & I think it's in all of our interests to see if these advances can lead to improvements in health care. Yes, it's scary how much data these companies have coll…

> we should encourage more openness around medical data.

Encouraging is fine, but in the end, consent from individuals should be obtained and if it isn't, that data should be omitted.

Re: Google's harvest of medical data includes names and full details of millions

#88

Post by drcode »

legulere wrote: post #68
drcode wrote: post #67

I know I'm very much in the minority here, but just like we should have more open borders and more open software, we should encourage more openness around medical data. Google and other large companies have made some significant AI advances in the last decade & I think it's in all of our interests to see if these advances can lead to improvements in health care. Yes, it's scary how much data these companies have coll…

I know how hard it is to get enough medical data to do research. But why do you need names? Correlate diseases with first names?

They probably get all the data in fragments from different EHR systems, pharmacy records, diagnostic monitors, etc etc and need ways of knowing which records belong to the same patient.

Sure, we may want to have properly-designed legislation to come up with standards across databases that make the use of such sensitive data for combining records less necessary, but we better make sure it's well designed or we could end up slowing down medical innovations.

Re: Google's harvest of medical data includes names and full details of millions

#89

Post by _pgmf »

dragonwriter wrote: post #42

If entering into a BAA under HIPAA for work involving PHI is “harvest”, and you're worried that this reaches “millions” for Google, you probably don't want to think about the deals public and private firms in the healthcare and health insurance/payments space have with Amazon and Microsoft. From the news article (I don't have time to review the source leak indepently) there doesn't seem to be anything really concerni…

The article says

> The data is being transferred with full personal details including name and medical history and can be accessed by Google staff

I think a reaction of horror is quite appropriate. Your comment is "whataboutism". Let's discuss this leak without invoking bogeymen.

Re: Google's harvest of medical data includes names and full details of millions

#90

Post by _pgmf »

altgoogler wrote: post #69

Googler here, my opinions are my own, standard disclaimer. I'm not going to comment on this specific case but I do have almost a decade of previous non-Google experience working in clinical documentation technology. As others have said, entering into a BAA with a covered entity, as HIPAA defines it, shouldn't be seen as a controversial action. There are numerous problems in healthcare that are too complex for individ…

I think the issue is the fact that Google, the epitome of faceless/impenetrable data capitalism, is now holding my health records.
Post reply on HN