A former UChicago student sued his alma matter and Google over alleged improper data sharing practices. He purports that they did not properly de-identify patients’ data.
Related to a partnership announced in 2017, the plaintiff, Matthew Dinerstein, filed a complaint in federal court in Illinois this week.
Potential Class Action Lawsuit
Dinerstein filed as a potential class-action lawsuit noting that UChicago Medicine failed to notify patients or obtain their consent prior to disclosing medical records to Google. The defendants claim that they deidentified the patient data, but Dinerstein argues that claim is “misleading,” reports Modern Healthcare. He suggests that both Google and UChicago violated HIPAA by sharing these date stamps, since Google could conceivably re-identify patients by combining the data with other information that the company tracks independently, such as location data from apps on the smartphone running Google Maps.
Data Stamps and Free-Text Notes
Google has entered into multiple partnerships with academic health centers, but the lawsuit claims that in the case of UChicago, they offered Google both date stamps and free-text notes. Google has published results and according to the Modern Healthcare article, potentially Google has “managed to fly under the radar with practices that could be problematic.” It is not clear if there is any evidence of any misuse by the plaintiff.
HIPAA and Clinical Research
HIPAA allows for disclosure of de-identification of protected health information for research purposes. As reported in the article, UChicago Medicine “entered into a research partnership with Google as part of the medical center’s continuing effort to improve the lives of its patients,” a spokesperson stated. They continued, “That research partnership was appropriate and legal, and the claims asserted in this case are baseless and a disservice to the medical center’s fundamental mission of improving the lives of its patients.” Google echoed this position.
The Plaintiff View
The plaintiff believes Google is possibly leveraging research data for commercial purposes. It pointed to a 2017 patent application Google filed for an analytics system that predicts future medical events based on a patient’s health history as an example of possible commercial gain scenarios.
This plaintiff appears to be pushing the envelope. Legal system resources are precious and are not to be drawn into frivolous lawsuits. The plaintiff had better have some serious evidence of malintent. From our point of view, it is not clear where the UChicago and Google research effort misused any personal identifiable data. We will see what comes out in discovery—if the suit makes it that far.