Lawmakers call for HIPAA updates following Google's data deal
Sens. Jacky Rosen (D-Nev.) and Bill Cassidy (R-La.) introduced legislation to stop the sale of health data from consumer wearable devices Thursday as Congress responded to outrage over a data-sharing deal that gave Google access to millions of patients' detailed records.
The arrangement, which Google and the Ascension health system maintained is legal, has irked patient and privacy advocates who find it unacceptable that neither patients nor clinicians gave consent to share their data with the tech giant.
HHS' Office for Civil Rights, which oversees health privacy law, is opening an investigation of the deal to gather "more information about this mass collection of individuals’ medical records with respect to the implications for patient privacy under HIPAA," said the office's director, Roger Severino.
Whether the arrangement is legal or not, discomfort with it apparently led a member of the 250-person team working on the secret project to leak news about the deal. In The Guardian on Thursday, the self-proclaimed whistleblower wrote that "patients and the public have a right to know what’s happening to their personal health information at every step along the way."
Health data experts say such "business associate" agreements are legal and common. Providers aren't required to obtain explicit consent from patients to share data with contractors; Ascension and Google said the agreement would improve risk prediction and patient care.
But it could also motivate Congress to change the HIPAA health law, most of which was created in the 1990s. New laws could require that such arrangements have more buy-in from patients and clinicians.
"There’s a world of difference between standard data-sharing arrangements with a trusted tech company, and a partnership with the world’s biggest advertising firm," Sen. Marsha Blackburn, who leads the Senate Judiciary Committee’s Tech Task Force, told POLITICO.
HIPAA doesn't address newer technologies and data sharing methods, she said, and Google has "proven to be a poor and disrespectful steward of our data, and consumers are rightfully concerned about the company’s motives."
"No patient really expects their information to be shared and used in this manner,” said Joy Pritts, formerly chief privacy officer at ONC.
In the absence of a major HIPAA overhaul, some lawmakers have introduced bills aimed to cover health data gathered outside the traditional health systems. Cassidy has begun trying to organize a hearing examining tech companies' HIPAA compliance, a spokesperson told POLITICO.
The Cassidy and Rosen bill, the Smartwatch Data Act, would require HHS to enforce it for traditional health care groups that share or trade data through consumer devices like fitness trackers.
“The Google/Ascension news has brought needed scrutiny to the security of Americans’ health data," Cassidy said in news release. The arrangement also brings up questions about how Google might use data from devices such as Fitbit, which Google recently announced it was buying, he said.
Sens. Lisa Murkowski (R-Alaska) and Amy Klobuchar (D-Minn.), meanwhile, plugged a separate bill that directs HHS to create privacy rules for tech companies selling wearable devices and consumer genetic testing companies.
“Congress has a responsibility to ensure that our laws keep up with advances in technology and give patients the privacy and protections they expect," Klobuchar said.
