HHS Investigating Google, Ascension's 'Project Nightingale' for HIPAA Violations

Ascension defends the cloud-computing arrangement as HIPAA compliant and "anything but secret"
Peter Wehrwein

The Wall Street Journal broke the story Monday that the Google and St. Louis-based Ascension have come to an agreement that would centralize Ascension’s  siloed patient data into Google’s cloud-computing system.  The project, which the newspaper said was done “in secret,” was named Project Nightingale.

Yesterday, the newspaper reported that the Office for Civil Rights in HHS is investigating whether the “mass collection of individuals’ medical records” was done in way that ensured HIPAA protection. Several lawmakers raised objections.

In a statement posted yesterday on the Ascension’s website, Eduardo Conrado, the executive vice president of strategy and innovations for the health care system, pushed back on the Journal’'s reporting. Conrado said the health care system’s agreement with Google was “anything but secret” and was mentioned on a Google earning call. His statement also says that the patient data is compartmentalized in “Ascension-owned virtual private space” and that Google is not permitted to use it for marketing or research purposes.

“Hospitals and clinical software vendors across the country have converted or are in the process of converting to electronic health records stored in the cloud and soon the entire industry will be adopting this approach,” wrote Conrado, who also said Ascension's arrangement with Google met HIPAA standards.

A Google spokeswoman also defended the arrangement in a statement to the newspaper: “We are happy to cooperate with any questions about the project. We believe Google’s work with Ascension adheres to industry-wide regulations (including HIPAA) regarding patient data, and comes with strict guidance on data privacy, security, and usage.”

Journal reported that Ascension, a Catholic chain of 2,600 hospitals, nursing homes, doctor’s facilities, began sharing with Google personally identifiable information on millions of patients, such as names and dates of birth; lab tests; doctor diagnoses; medication and hospitalization history; and some billing claims and other clinical records. The goal is the creation of a “layer” of patient information that is essentially an entire personal health record, according to the Journal. Artificial intelligence would come up with queries and answers, such as risks of a given treatment plan. “Project Nightingale would then automatically predict and map the outcome of certain procedures or medications,” said the newspaper.