/Google’s ‘Project Nightingale’ Triggers Federal Probe

Google’s ‘Project Nightingale’ Triggers Federal Probe


A federal regulator has opened an inquiry into an effort by Google and the country’s second-largest health system to amass the detailed medical information of millions of Americans.

The data on about 50 million patients of St. Louis-based Ascension was until recently scattered across 40 data centers in more than a dozen U.S. states. In an all-in bet first reported by The Wall Street Journal on Monday, Google and the Catholic nonprofit health system are moving that data into the cloud—with potentially big changes on tap for doctors and patients.

News of “Project Nightingale” and its scope quickly drew criticism from lawmakers and patients over privacy concerns, prompting regulators to act on Tuesday.

The Office for Civil Rights in the Department of Health and Human Services “will seek to learn more information about this mass collection of individuals’ medical records to ensure that HIPAA protections were fully implemented,” office director Roger Severino said in a statement to the Journal.

HIPAA refers to the federal Health Insurance Portability and Accountability Act of 1996, which generally allows hospitals to share data with business partners without telling patients as long as the information is used “only to help the covered entity carry out its health-care functions.”

A Google spokeswoman declined to comment on the HHS inquiry.

The data includes personally identifiable information like names and birth dates; lab tests; doctor diagnoses; medication and hospitalization history; and some billing claims and other clinical records.

Its new destination is Google’s “cloud,” essentially software storage able to be accessed remotely, including by some of the search giant’s employees.

Paging Nurse Google

The tech giant is teaming with Ascension on an ambitious project to crunch patient data for treatment and administrative purposes.

How ‘Project Nightingale’ intends to use data

1. Patient checks into hospital, doctor’s office or senior care center.

2. Doctors/nurses examine the patient, input data into computers.

Data that is

shared includes:

Name

Date of Birth

Address

Family members

Allergies

Immunizations

Radiology scans

Hospitalization

records

Lab tests

Medications

Medical conditions

3. Data instantly flows to Google’s ‘Project Nightingale’ system. The system may suggest the following outcomes, among others:

Replacement or addition of doctors

to patient’s team.

Additional enforcement of narcotics policies.

Ascension may bill more or for different procedures.

Treatment plans, suggests tests, flags unusual deviations in care.

How ‘Project Nightingale’ intends to use data

1. Patient checks into hospital, doctor’s office or senior care center.

2. Doctors/nurses examine the patient, input data into computers.

Data that is

shared includes:

Name

Date of Birth

Address

Family members

Allergies

Immunizations

Radiology scans

Hospitalization

records

Lab tests

Medications

Medical conditions

3. Data instantly flows to Google’s ‘Project Nightingale’ system. The system may suggest the following outcomes, among others:

Additional enforcement of narcotics policies.

Replacement or addition of doctors

to patient’s team.

Ascension may bill more or for different procedures.

Treatment plans, suggests tests, flags unusual deviations in care.

How ‘Project Nightingale’ intends to use data

1. Patient checks into hospital, doctor’s office or senior care center.

2. Doctors/nurses examine the patient, input data into computers.

Data that is

shared includes:

Name

Date of Birth

Address

Family members

Allergies

Immunizations

Radiology scans

Hospitalization

records

Lab tests

Medications

Medical conditions

3. Data instantly flows to Google’s ‘Project Nightingale’ system. The system may suggest the following outcomes, among others:

Replacement or addition of doctors to patient’s team.

Additional enforcement of narcotics policies.

Ascension may bill more or for different procedures.

Treatment plans, suggests tests, flags unusual deviations in care.

How ‘Project Nightingale’ intends to use data

1. Patient checks into hospital, doctor’s office or senior care center.

2. Doctors/nurses examine the patient, input data into computers.

Data that is

shared includes:

Name

Date of Birth

Address

Family members

Allergies

Immunizations

Radiology scans

Hospitalization

records

Lab tests

Medications

Medical conditions

3. Data instantly flows to Google’s ‘Project Nightingale’ system. The system may suggest the following outcomes, among others:

Treatment plans, suggests tests, flags unusual deviations in care.

Replacement or addition of doctors

to patient’s team.

Additional enforcement of narcotics policies.

Ascension may bill more or for different procedures.

Ascension has more than 2,600 facilities like hospitals and nursing homes in 21 states and Washington, D.C. Neither doctors nor patients have been formally notified of the arrangement.

“The optics are bad. The legal argument is tenuous. Ethically, this is a bad strategy. They need to tell people what they are doing,” said Ellen Wright Clayton, a professor of biomedical ethics at Vanderbilt University.

Share Your Thoughts

How do you view the alliance between a tech company and a health care provider? Join the conversation below.

Ms. Clayton said Google risks running afoul of the rules if it uses the health data to perform independent research outside the direct scope of patient care.

Google, which is a unit of Alphabet Inc., declined to comment on whether it would conduct research. People familiar with the project say the company’s staffers are still parsing through Ascension’s unwieldy patchwork of data collections, and aren’t yet positive what insights might be found or eventually produced.

Down the line, experts say, Google could reap tens of millions of dollars—if not more—by repeating its Ascension work for other health-care clients.

Google cloud President Tariq Shaukat, in a blog post late Monday, said the company aimed to help “modernize Ascension’s infrastructure,” as well as give Ascension staffers tools to communicate and build functions that the health system could use to improve care.

In meetings and presentations reviewed by the Journal, Google has laid out deep ambitions for the project. Google executives describe the goal as a “layer” of patient information that is essentially an entire personal health record. Artificial intelligence would immediately jump in with suggested questions, and its own answers, such as risks of a given treatment plan. Project Nightingale would then automatically predict and map the outcome of certain procedures or medications.

Doctors and other Ascension medical staff, as well as Google employees, would be able to pull up far-flung patient data faster than under Ascension’s current system.

Conceptual images of the software under construction show an interface much like Google’s flagship search engine. Begin to type in a first name, and Google will produce a drop-down menu featuring other patients with similar names. A single click reveals metabolic data, medications, phone numbers and even the patient’s temperature.

Tech giants like Amazon and Apple are expanding their businesses to include electronic health records — which contain data on diagnoses, prescriptions and other medical information. That’s creating both opportunities and spurring privacy concerns. Here’s what to know. Photo Composite: Heather Seidel/ The Wall Street Journal (Originally published Jan. 9, 2019)

Project Nightingale software would be able to automatically read scanned images such as MRIs and upload related data to a central network accessible to Ascension and some Google employees.

The concept gave some Ascension patients pause.

“Google is not doing this out of the goodness of their heart,” said Tim Wiesner, a 63-year-old retired nurse and Ascension patient in Wichita, Kan. He said he was disappointed not to have been notified of the data sharing directly by his doctor. “It just seems deceitful. I’m sure they are going to make money off our information.”

Google declined to comment on any profit-making plans. It isn’t being paid for the work for now, but Ascension is incurring costs as it trains its staff in the search giant’s systems, people familiar say.

Google and Ascension have signed what is known as a business associate arrangement, which specifies when a health-care vendor can access patient data. Ascension retains ownership of the data, people familiar with the matter said. Neither Google nor Ascension would give details on who at the search giant can access data.

The breadth of the project has angered some politicians.

“Blatant disregard for privacy, public well-being, & basic norms is now core to Google’s business model. This abuse is beyond shameful,” tweeted Sen. Richard Blumenthal (D., Conn.), a frequent critic of the technology giants.

“Some of the solutions we are working on with Ascension are not yet in active clinical deployment, but rather are in early testing,” Mr. Shaukat said. “This is one of the reasons we used a code name for the work—in this case, ‘Nightingale.’”

Write to Rob Copeland at rob.copeland@wsj.com

Copyright ©2019 Dow Jones & Company, Inc. All Rights Reserved. 87990cbe856818d5eddac44c7b1cdeb8

Original Source