Google’s Totally Creepy, Totally Legal Health-Data Harvesting

These days, digital behavior is already used to determine all kinds of real-world outcomes. Google and Facebook can infer your emotional state and predict your chance of depression based on your behavior. Children’s YouTube videos were used in scientific research about using artificial intelligence to diagnose autism. Insurance companies use social-media posts to determine premiums. For years, lending institutions have done the same to evaluate creditworthiness. It’s unsettling. It’s legal.

Google says it doesn’t combine its user data with Ascension patient data. But the fact remains that the data it already has on all its users are tremendously revealing. Your IP address contains information about where you live, which in turn is associated with social determinants of health such as income, employment status, and race. Search terms such as nearest food pantry or nearest HIV test can offer further clues about income level, sexual orientation, and so on.

“HIPAA’s an exceptionally low bar,” says Travis Good, a medical doctor and privacy specialist. “None of that [search] data, whether you’re searching for STI clinics or Plan B or a dermatologist, none of that’s covered under HIPAA.”

A recent report from the Financial Times, done in collaboration with Carnegie Mellon University, notes that Google, like Amazon and Microsoft, collects data entered into popular health and diagnosis sites. Google’s ad service, DoubleClick, receives prescription names from Drugs.com, for example, while WebMD’s symptom checker shares information with Facebook. The data are not anonymized, and the legal experts interviewed argued that the collection may violate European Union privacy law.

Your very online existence—the sites you access, where you access them from, the ads you click on—gives Google the kind of holistic, robust, up-to-date view of your health that was largely unimaginable a decade ago. “The hype, or hope, is that as you gather more and more info, and when you’re able to combine [different data sets], you’re able to come up with super-tailored care pathways and eventually treatments,” Good says. “So it’s not just, you’re 35 and have pancreatic cancer. It’s, you’re 35, have pancreatic cancer, here’s your medical history, your family history, and genetic markers for oncology, and here’s the care pathway just for you.”

Creating tailored medical treatments for countless patients at scale requires an enormous amount of data that need to be standardized, tested for accuracy and bias, stored securely, processed rapidly, and made comprehensible enough that doctors can understand and confer with one another on a patient’s best care. This is Google’s specialty. It doesn’t need your consent; it already has your information.

Sidney Fussell is a staff writer at The Atlantic, where he covers technology.