Google patient data deal with HCA Healthcare accused of violating patient privacy

A deal struck between US hospital chain HCA Healthcare and Google that gave the latter access to patient records at hundreds of hospitals and thousands of heathcare sites, prom pting concerns by privacy advocates and rights groups. What happened HCA Healthcare, a major US hospital chain, entered into a partnership with Google Cloud that allowed the tech giant access to patient records from over 180 hospitals and 2,000 healthcare sites. The collaboration aimed to enhance operational efficiencies and develop algorithms for patient monitoring and medical decision-making. However, s imilar to Google’s Project Nightingale , privacy advocates raised concerns that sensitive patient data could be monetised or misused by the technology company, despite the data having been anonymised. Concerns were also expressed about the security of patient data, given a spate of high-profile ransomware attacks in the months leading up to the announcement of the deal. US healthcare privacy laws permit hospitals to share information with suppliers, and allow researchers to analyse patient data without their permission. Healthcare companies can then use that information however they want. Why it happened P art of a broader digital transformation strategy within HCA Healthcare that intends to improve clinical workflows and patient care through data analytics , the partnership was initiated to leverage HCA's extensive data from approximately 32 million annual patient encounters to create advanced decision support tools for healthcare providers. However, Google's business model and seemingly insatiable appetite for personal data to feed its various businesses, notably search engine advertising, raised concerns about what it would do with highly sensitive third-party health data. Furthermore, existing US healthcare privacy laws permit such data sharing under certain conditions, leading to concerns about the adequacy of these regulations in protecting patient privacy. What it means The deal underscores the growing intersection of technology and healthcare, highlighting the need for updated privacy laws that address modern data-sharing practices. As healthcare systems increasingly rely on partnerships with tech companies to enhance care delivery through data analytics and AI, ensuring robust safeguards for patient information becomes critical. The situation sparked discussions about the ethical implications of such collaborations and the potential necessity for legislative reforms to better protect patient rights in an evolving digital landscape. System 🤖 Developer: Alphabet/Google Country: USA Sector: Health Purpose: Increase operating efficiency Technology: Machine learning Issue: Accountability ; Consent; Privacy/surveilla nce ; Security; Transparency Timeline ⏰ May 2021. HCA and Google Cloud announce a multi-year deal to build a data analytics platform using 32 million annual patient records. August 2022. HCA begins implementing the MEDITECH Expanse system to integrate clinical data with Google’s cloud architecture. Early 2023. 75 emergency room physicians begin testing Google’s AI (via Augmedix) to automate clinical notes from patient conversations. July 5, 2023. HCA identifies that 27 million rows of data from an external email storage location were posted on an online forum. July 10, 2023. HCA officially reports the breach, confirming that 11 million patients across 20 states had personal information stolen. August 29, 2023. Despite the breach, HCA and Google announce an expanded collaboration to use Large Language Models (LLMs) for nurse handoffs. Late 2023. 27 separate lawsuits regarding the breach are consolidated into a single case in the Middle District of Tennessee. July 2025. A federal judge grants preliminary approval for a multi-million dollar settlement fund to compensate breach victims. October 27, 2025. The court conducts the final review of the settlement terms and the proposed "Security Commitments" HCA must maintain. November 6, 2025.

Date it happened

2021-05-01

Organisation involved

HCA Healthcare; Google

This is a record of what was reported, not a finding that anyone broke the law. If it names your organisation and you believe it is wrong, the corrections process is free and open to everyone.