Google got 1.6m patients’ data ‘inappropriately’
Google‘s artificial intelligence arm received the personally identifying medical records of 1.6 million patients on an “inappropriate legal basis”, according to the most senior data protection adviser to the NHS.
Sky News has obtained a letter sent to Professor Stephen Powis, the medical director of the Royal Free Hospital in London, which provided the patients’ records to Google DeepMind.
It reveals that the UK‘s most respected authority on the protection of NHS patients’ data believes the legal basis for the transfer of information from Royal Free to DeepMind was “inappropriate”.
The development raises fresh concerns about how the NHS handles patients’ data after last week’s cyberattack on hospitals and GP surgeries, which could have been prevented if staff had followed guidance issued a month earlier.
While there are strict legal protections ensuring the confidentiality of patients’ records, under common law patients are “implied” to have consented to their information being shared if it was shared for the purpose of “direct care”.
However, this basis was not valid in the arrangement between Royal Free and DeepMind in the view of Dame Fiona Caldicott, the National Data Guardian at the Department of Health, who has contributed to an investigation into the deal.
As Dame Fiona writes, she had informed Royal Free and DeepMind in December that she “did not believe that when the patient data was shared with Google DeepMind, implied consent for direct care was an appropriate legal basis”.
DeepMind, originally a British business that was acquired by Google in 2014, received the data of 1.6 million NHS patients to test a smartphone app called Streams.
Streams is a healthcare app which can detect if patients are suffering from acute kidney injuries and then rapidly inform clinicians so that they may receive potentially life-saving treatment.
Prof Powis had stressed that “a quarter of deaths from (acute kidney injuries) are preventable if clinicians are able to intervene earlier and more effectively”.
Dame Fiona did not dispute the value of the app for patients, but in the letter to Prof Powis she explained that in her “considered opinion” the “purpose for the transfer of 1.6 million identifiable patient records to Google DeepMind was for the testing of the Streams application, and not for the provision of direct care to patients”.
“My considered opinion therefore remains that it would not have been within the reasonable expectation of patients that their records would have been shared for this purpose,” she wrote.
