Google and University of Chicago sued over patient records

A partnership between Google and the University of Chicago Medical Center aimed to improve predictive analysis in medicine. But a lawsuit filed by a patient says the alliance shared too much personal information.

The lawsuit, filed Wednesday in US District Court for Northern Illinois, accuses the hospital of sharing hundreds of thousands of patient records with the tech giant without removing date stamps and doctor's notes. The complaint goes on to say that Google is uniquely capable of determining the identity of every medical record shared with it.

"The personal medical information obtained by Google is the most sensitive and intimate information in an individual's life, and its unauthorized disclosure is far more damaging to an individual's privacy " than compromised credit card numbers or Social Security numbers exposed in typical hacks, the lawsuit said.

The partnership uses artificial intelligence to predict medical events, such as how long a patient might be hospitalized and whether their health is deteriorating. AI is one of the hottest trends in the tech world, with companies like Google, Apple and Amazon using the tech to let your phone recognize real-world objects, help you better run your smart home or find a photo in your camera roll. 

But the lawsuit alleges that inclusion of dates violates HIPAA, which requires hospitals to hide personally identifiable information such as names and Social Security numbers. The dates could be combined with detailed geolocation data Google collects from apps, such as Maps or Waze, to determine when certain individuals entered or exited the university's hospital, according to the lawsuit, which seeks class action status.

Google and the University of Chicago on Wednesday defended the value and integrity of the study.

"We believe our health care research could help save lives in the future, which is why we take privacy seriously and follow all relevant rules and regulations in our handling of health data," a Google spokesman said.

The University of Chicago said the lawsuit lacked merit.

"The University of Chicago Medical Center has complied with the laws and regulations applicable to patient privacy," a University of Chicago spokesman said. "The Medical Center is committed to providing excellent patient care and to protecting patient privacy."

Google's access to patient health records has raised privacy concerns before. In 2016, a formerly undisclosed data-sharing agreement between Google and the UK's state-run National Health Service was revealed that allowed vast amounts of data on 1.6 million patients at London hospitals to be passed to Google-owned AI company DeepMind as part of a research program.