University of Chicago Medical Center's data sharing with Google puts patient privacy at risk, lawsuit alleges

About two years ago, the University of Chicago Medical Center touted a new, ambitious partnership with tech giant Google, one aimed at finding patterns in patients' medical records that might help predict medical issues.

That partnership is now the subject of a potential class-action lawsuit filed Wednesday against the hospital, the University of Chicago and Google, alleging that the hospital turned over to the tech giant hundreds of thousands of medical records containing "sensitive and intimate information" without patients' consent. The lawsuit alleges that the data wasn't sufficiently stripped of identifying information.

The case comes at a time when hospitals and tech companies are increasingly trying to use data to improve patient care—all without exposing sensitive patient information.

The hospital shared electronic health records of patients it treated between 2009 and 2016 with Google, according to the lawsuit, filed in U.S. District Court for the Northern District of Illinois. Google and the hospital claimed individuals could not be identified from the medical records, but the records contained times and dates of treatment as well as notes from providers, the lawsuit alleges.

"Google—as one of the most prolific data mining companies—is uniquely able to determine the identity of almost every medical record the University released," according to the lawsuit.

The lawsuit also alleges that Google sought the records to help it create its own electronic health record system.

University of Chicago Medical Center spokeswoman Lorna Wong called the lawsuit's claims "without merit" in a statement. She said the hospital is committed to protecting patient privacy.

"The Medical Center entered into a research partnership with Google as part of the Medical Center's continuing efforts to improve the lives of its patients," Wong said. "That research partnership was appropriate and legal and the claims asserted in this case are baseless and a disservice to the Medical Center's fundamental mission of improving the lives of its patients."

Google also defended its work.

"We believe our healthcare research could help save lives in the future, which is why we take privacy seriously and follow all relevant rules and regulations in our handling of health data," Google said in a statement. "In particular, we take compliance with HIPAA seriously, including in the receipt and use of the limited data set provided by the University of Chicago."

HIPAA, or the Health Insurance Portability and Accountability Act, is a federal law that requires privacy protections for certain health information.

The lawsuit accuses the hospital, university and Google of consumer fraud, deceptive business practices and breaching contracts with patients to keep their information private, among other things.

The man who brought the case, Matt Dinerstein, is described in the lawsuit as an Illinois resident who was admitted to the hospital twice in 2015. Dinerstein believes his confidential medical information was given to Google, though he never gave written consent for the hospital to share that information with Google, according to the lawsuit.

"Similarly, he did not give Defendant Google permission to use his medical records for any purpose, let alone for a commercial purpose," the lawsuit states.

According to the lawsuit, Google was interested in using machine learning models to predict health events, such as heart attacks. "But Google had difficulty gaining a foothold in the predictive health analytics industry," the lawsuit says. In 2008, Google developed a service to allow people to store their personal health information and medical records on a Google platform but discontinued the service, the lawsuit says.

It then tried a different strategy, buying a startup called DeepMind that focused on bringing artificial intelligence and machine learning to health care, the lawsuit alleges.

"Following this acquisition, Google, in part through DeepMind, embarked on a campaign, veiled as well-intentioned research, to obtain millions of medical records from health care organizations," the lawsuit alleges.

When the University of Chicago Medical Center announced its partnership with Google in 2017, it said the research held much potential for patient care. An article on University of Chicago Medicine's website, from shortly after the announcement, said predictive models "could help prevent unplanned hospital readmissions, avoid costly complications and save lives."

Last year, researchers from Google, University of Chicago Medicine, the University of California-San Francisco, and Stanford University published a study finding that software models using de-identified data from medical records could predict readmissions to the hospital, prolonged length of stay, discharge diagnoses, and early deaths in the hospital. University of Chicago Medicine said in an article on its website about the study that, for the project, information including names, dates of birth, Social Security numbers and other unique characteristics were removed from the records before they were shared with Google.

Google has similar partnerships with the University of California-San Francisco and Stanford University, but Jay Edelson, the attorney who filed the lawsuit on behalf of Dinerstein, said he's not aware of any similar lawsuits against those institutions.

©2019 Chicago Tribune
Distributed by Tribune Content Agency, LLC.