Without notice, Ascension Health may have shared Wisconsin patients' personal records with Google

Appleton Post-Crescent

Google is collecting personal health records of millions of Americans who receive medical care from Ascension Health — Wisconsin's second-largest health provider — according to a Wall Street Journal report.

The St. Louis-based Ascension operates 23 hospitals and over 110 clinics in Wisconsin, according to the Catholic nonprofit's website. Its areas of care include much of the east and central parts of the state from Eagle River to Racine.

Data collection for Project Nightingale, as the effort has been code-named, began last year and accelerated over the summer, according to the Journal. It includes lab results, hospitalization records and doctor diagnoses, as well as personal identifiers.

Neither patients or doctors had been notified of the data-sharing, the Journal reported.

Patient advocate Debby Deutsch wrote in an email to USA TODAY NETWORK-Wisconsin on Monday that even if data analytics and artificial intelligence can help improve health care, "you don't need patient contact info and social security numbers to achieve that."

"Patients are right to be enraged with this violation of their protected health information," wrote Deutsch, who works at Patient Care Partners LLC in Madison.

An Ascension Wisconsin spokesperson declined to share the number of patients in the state whose data has been accessed.

Ascension released a statement Monday saying the health system and Google were working together on a health care "transformation." The statement said work relating to Ascension's engagement with Google was compliant with the 1996 Health Insurance Portability and Accountability Act (HIPAA) and did not make reference to patients' data collection.

HIPAA allows for health systems' business associates, like Google, to obtain patients' private health information without their consent, as long as it's "to help the covered entity carry out its health care functions."

Ascension's statement outlined its Google collaboration in three parts:

Transitioning to Google's cloud services
Transitioning to Google's G Suite, which includes apps like Gmail, Google Docs and Google Calendar
Exploring the use of artificial intelligence and machine learning

According to the Journal report, the Nightingale project aims to identify treatment plans, tests or doctor teams for patients and help a health system generate more revenue from patients.

Google's analysis of large amounts of health data to detect trends in causes and outcomes may fall under the realm of population health, Deutsch said.

For example, if a certain type of cancer is prevalent in a given region or population segment, data analysis would help determine the common characteristics of the patients and what treatments might be most effective.

But patient contact information or personal identification is not needed to pull off such an analysis, Deutsch added.

And there is an added threat that the shared data could be compromised.

"There is no danger of accidental identity breaches if they don't have the data in the first place," she said.

Contact Madeline Heim at 920-996-7266 or mheim@gannett.com. Follow her on Twitter at @madeline_heim.