Federal inquiry opened into Google health data deal

Google’s partnership with Ascension, the nation’s largest nonprofit health system, is the subject of a federal inquiry, a senior official told The Hill Wednesday.

The Office for Civil Rights (OCR) in the Department of Health and Human Services (HHS) “will seek to learn more information about this mass collection of individuals’ medical records to ensure that HIPAA protections were fully implemented,” Roger Severino, the office’s director, said in a statement, referring to the federal law restricting the release of medical information.

{mosads}The inquiry was first reported by The Wall Street Journal on Tuesday.

The project, codenamed “Nightingale,” received little attention until the Journal publicly reported details of it for the first time on Monday.

The partnership to collect and analyze health data received swift backlash from lawmakers and privacy advocates concerned about sensitive patient information.

One of large concerns shared was whether the deal violated the Health Insurance Portability and Accountability Act and its rules on handling health care data, which the HHS OCR is now investigating.

In a press release posted hours after the Journal report, Google said Ascension was using Google’s cloud services to “securely manage their patient data, under strict privacy and security standards,” including HIPAA.

Google pointed The Hill to a Q&A on their site where the tech giant said “we are happy to cooperate with any questions about the project.”

The Hill has reached out to Ascension for comment on the reported inquiry.

Subject matter experts who spoke to The Hill agreed that the partnership is likely not a HIPAA violation because of the broad definition of “business associate” in the 1996 law and an exception for data used for quality improvements.

Several lawmakers expressed dismay over the agreement, including Sens. Amy Klobuchar (D-Minn.) and Lisa Murkowski (R-Alaska) who have introduced legislation to expand health data protections in an increasingly online world.

“Like many Americans, I’m concerned to hear about details surrounding the so called Project Nightingale and its gathering of personal health data for millions of people,” Murkowski told The Hill in a statement.

“That’s why I’ve been working with my colleague, Senator Klobuchar, on advancing legislation to keep up with new health technologies, by ensuring we are protecting consumers’ private health data on apps and wearable devices like Fitbits. While the companies involved said the initiative is compliant with federal law, it’s imperative that we determine that there are in fact robust protections in place for patient data. If we can’t do that, we need to fix this loophole.”

–Updated at 11:30 a.m.