A patient sues their hospital after it shares sensitive medical data with Google

A recent lawsuit filed against The University of Chicago Medical Center states that its choice to share patients' information with Google is a far more harmful disclosure than if hackers were to breach the hospital's systems. It's shockingly been described as "the greatest heist of consumer medical records in history". Sadly, I feel this won't be the last case of criminally inappropriate data-sharing we see this year or even this month.

Direct link to the lawsuit here in PDF form.

--

More details from E&T:

According to the class action lawsuit (which was filed by a patient in the US District Court for Northern Illinois) the agreement allows for too much personal information to be shared, such as doctor’s notes and date stamps. The lawsuit argues that Google would be capable of determining the identity of every patient from their medical records, such as by matching data entered into Google Maps, Calendar, or Search to determine when individuals had appointments at the hospital.

If individuals were identifiable from their health records, this would violate the 1996 Health Insurance Portability and Accountability Act (HIPAA), which governs how healthcare information can be protected while being shared between organisations.

“The personal medical information obtained by Google is the most sensitive and intimate information in an individual’s life, and its unauthorised disclosure is far more damaging to an individual’s privacy” than being targeted by hackers, the lawsuit says. The lawsuit argues that the records “were not sufficiently anonymised and put the patients’ privacy at grave risk”.

—

If you enjoy The Data Exhaust and the topics of surveillance capitalism, cyber security, life with technology, and information privacy, we gladly accept tips and donations, however small, in the form of Bitcoin:

3MB1z7MswieMiYYSFzMnwabPgy8JaptMgV