Filing archives cabinet on a laptop screen

The Right Lesson from the Google-Ascension Patient Privacy Story

By I. Glenn Cohen

As has been well reported in the media, there is a controversy brewing over nonprofit hospital chain Ascension sharing millions of patient records with Google for their project codenamed “Nightingale.” (very Batman, if you ask me!) Most of the discussion so far, and the answers have not yet become pellucid, concerns whether the hospital and Google complied with HIPAA.


This is important, don’t get me wrong, but it is important that conversation not ignore a more important question: Is the existing HIPAA regime adequate to do what we want it to do in an era of big data? As Michelle Mello and I argued in JAMA in August concerning a lawsuit relating to the sharing of medical records between the University of Chicago and Google, these stories expose a “US health data regulatory regime that is showing its age.” In particular, the reliance on patient authorization (especially more blanket front door versions) that have often been the basis for justifying data sharing are not an ethically sufficient way forward. Patients “are rarely given the information and opportunity to ask questions needed to give meaningful informed consent to future uses of their data. Even if those problems could be overcome, it is asking a great deal of patients to imagine and assess how their information may be used and what the risk of reidentification maybe.” Moreover, what happens when the risks and benefits change over time but the authorization remains in place?

We instead recommend seeing authorization as merely one of several possible “governance technologies” and we recommend looking at different approaches. One important one more downstream (at the time of a particular use rather than at the time of collection) and group rather than individual based. We explain how such patient data use committees that have real meaningful patient input can operate.

While the media focuses on whether Google and Ascension have complied with the law, we must also ask the more important question: is that current law working or should it be reformed?

I. Glenn Cohen

I. Glenn Cohen is the James A. Attwood and Leslie Williams Professor of Law at Harvard Law School and current Faculty Director of the Petrie-Flom Center. A member of the inaugural cohort of Petrie-Flom Academic Fellows, Glenn was appointed to the Harvard Law School faculty in 2008. Glenn is one of the world's leading experts on the intersection of bioethics (sometimes also called "medical ethics") and the law, as well as health law. He also teaches civil procedure. From Seoul to Krakow to Vancouver, Glenn has spoken at legal, medical, and industry conferences around the world and his work has appeared in or been covered on PBS, NPR, ABC, CNN, MSNBC, Mother Jones, the New York Times, the New Republic, the Boston Globe, and several other media venues. He was the youngest professor on the faculty at Harvard Law School (tenured or untenured) both when he joined the faculty in 2008 (at age 29) and when he was tenured as a full professor in 2013 (at age 34).

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.