House Democrat presses Google executives for answers on handling of health data

Rep. Pramila Jayapal (D-Wash.) on Friday pressed Google executives for answers on how the company is collecting and protecting sensitive consumer health data as part of a special project with a health care group.

Jayapal sent a letter to Google CEO Sundar Pichai, former Alphabet CEO Larry Page and Google Cloud senior official Tariq Shaukat to express her “concern” about how Google would protect personal health data collected. Google is part of Alphabet.

Jayapal’s concerns stemmed from a Wall Street Journal article last month, which found that Google was partnering with health care group Ascension to gather and analyze the personal health data of millions of American’s as part of a program known as “Project Nightingale.”

“Through Project Nightingale, your companies are likely to acquire over 50 million patient records and gain access to patient data from over 2,600 health care facilities,” Jayapal wrote to the executives.

The House Democrat noted that as Google and Alphabet “have engaged in an ever-widening acquisition of the highly personal health-related information of millions of people, Americans now face the prospect of having their sensitive health information handled by corporations who may misuse it.”

Jayapal asked that the officials send her information on what type of confidential health data Google collects, how the company plans to protect this data against cyberattacks, and whether Alphabet would commit to creating an “opt-in regime” in which users would have to give their consent to their data being collected and used before Alphabet could do so. 

Jayapal emphasized that “people’s lives, bodies and healthcare are precious and merit extreme sensitivity. When people seek medical advice or track their healthcare, they expect privacy.”

She asked that the officials respond to her questions by Jan. 5.

A spokesperson for Google pointed The Hill toward a Q&A posted online last month about Project Nightingale when asked for comment.

In the Q&A, Google wrote that “we believe Google’s work with Ascension adheres to industry-wide regulations … regarding patient data, and comes with strict guidance on data privacy, security, and usage.”

Jayapal’s letter comes after the Department of Health and Human Services’s Office for Civil Rights (OCR) opened an investigation into Google’s health data collection practices in November. OCR is seeking to determine whether Google’s partnership with Ascension violated the Health Insurance Portability and Accountability Act (HIPAA). 

Several other congressional Democrats have also taken an interest in the issue. 

Four other House Democrats, including House Energy and Commerce Committee Chairman Frank Pallone Jr. (N.J.), sent letters to both Google and Ascension last month asking questions about Project Nightingale. The Democrats asked that the companies brief them on the project by Dec. 6.

“While we appreciate your efforts to provide the public with further information about Project Nightingale, this initiative raises serious privacy concerns,” the members wrote last month.

A spokesperson for the House Energy and Commerce Committee did not respond to request for comment on whether the companies have responded to the Democratic members.