A former UChicago Medicine patient is suing the health system over its sharing thousands of medical records with Google, claiming the health system did not properly de-identify patients' data.
The lawsuit relates to a research partnership UChicago Medicine and Google announced in 2017 to investigate whether historical data housed in electronic health record systems can help predict future medical events when paired with machine learning. As part of the partnership, UChicago Medicine shares patient data with the tech giant.
Matt Dinerstein, who was admitted to UChicago Medicine twice in June 2015, filed the complaint against Google, UChicago Medicine and the University of Chicago in a federal court in Illinois Wednesday.
Dinerstein filed the complaint as a potential class-action lawsuit, arguing UChicago Medicine did not notify patients or gain their consent before disclosing medical records to Google.
UChicago Medicine and Google have said medical records used in their research were de-identified.
However, Dinerstein alleged that claim is "misleading" because the health system shares date stamps and free-text notes with Google. The lawsuit alleges UChicago Medicine violated HIPAA by sharing these date stamps, since Google could conceivably re-identify patients by combining the data with other information the company tracks independently—such as location data from smartphones running Google Maps.
While Google has struck similar research partnerships with the health systems of Stanford University and the University of California at San Francisco, the lawsuit claims only UChicago Medicine provided the company with date stamps and free-text notes.
A 2018 study Google published in Nature's npj Digital Medicine analyzed EHR data from both UCSF and UChicago Medicine. The study notes all EHRs were de-identified, although "dates of service were maintained" in the UChicago Medicine data set, which also contained free-text medical notes. UChicago Medicine provided EHR data from 2009 to 2016 for the study.
On account of this disclosure, Google has "managed to fly under the radar as it pulled off what is likely the greatest heist of consumer medical records in history," the lawsuit alleged.
A UChicago Medicine spokesperson said the claims made in the lawsuit are "without merit," as the health system has complied with relevant patient privacy laws and regulations.
Under HIPAA's privacy regulations, healthcare organizations may disclose de-identified protected health information for research purposes.
UChicago Medicine "entered into a research partnership with Google as part of the medical center's continuing efforts to improve the lives of its patients," the health system spokesperson said in a statement. "That research partnership was appropriate and legal and the claims asserted in this case are baseless and a disservice to the medical center's fundamental mission of improving the lives of its patients."
A Google spokesperson echoed UChicago's sentiment.
"We believe our healthcare research could help save lives in the future, which is why we take privacy seriously and follow all relevant rules and regulations in our handling of health data. In particular, we take compliance with HIPAA seriously, including in the receipt and use of the limited data set provided by the University of Chicago."
The lawsuit alleged Google could use patient data from UChicago Medicine to support its commercial efforts. The lawsuit pointed to a 2017 patent application Google filed for an analytics system that would predict future medical events based on a patient's health history as an example of alleged commercial gain Google may obtain through the partnership.
