16.05.17
Patient data shared with Google on ‘inappropriate legal basis’, says NDG
The transfer of almost two million patient records from Royal Free London NHS FT to Google’s artificial intelligence arm DeepMind may have been co-ordinated on an “inappropriate legal basis”, the national data guardian, Dame Fiona Caldicott, has argued.
In a letter leaked to SkyNews, Dame Fiona told Prof Stephen Powis, Royal Free’s medical director, that the decision to transfer data of 1.6 million patients to DeepMind as part of the testing stage of Google’s Streams app with the justification of ‘implied consent’ from patients may not hold up after all.
She argued that when work is taking place to develop new technology, this “cannot be regarded as direct care, even if the intended end result when the technology is deployed is to provide direct care”.
“Implied consent is only an appropriate legal basis for the disclosure of identifiable data for the purposes of direct care if it aligns with people’s reasonable expectations, i.e. in a legitimate relationship,” wrote Dame Fiona in the letter, dated 20 February.
“When I wrote to you in December, I said that I did not believe that when the patient data was shared with Google DeepMind, implied consent for direct care was an appropriate legal basis.”
While claiming that she and her team “entirely accept the importance of careful clinical safety testing of any new technology or application before it can be relied upon for patient care”, their view was nevertheless that the massive data transfer was for app testing only, and not for the provision of direct care.
“Given that Streams was going through testing and therefore could not be relied upon for patient care, any role the application might have played in supporting the provision of direct care would have been limited and secondary to the purpose of the data transfer,” the national data guardian wrote.
“My considered opinion therefore remains that it would not have been within the reasonable expectation of patients that their records would have been shared for this purpose.”
Her letter, which formed part of her contribution to an investigation into the matter led by data watchdog ICO, also raises fresh concerns about the confidentiality of data sharing in the NHS after last week’s mammoth hacking breach.
In a statement, however, a spokesperson from Royal Free said the foundation trust used a “safety-first approach” in testing Streams – an app designed to prevent unnecessary deaths linked to acute kidney injuries – using real data.
“This was to check that the app was presenting patient information accurately and safely before being deployed in a live patient setting. Real patient data is routinely used in the NHS to check new systems are working properly before turning them fully live,” added the spokesperson. “No responsible hospital would ever deploy a system that hadn’t been thoroughly tested. The NHS remained in full control of all patient data throughout.
“This project, designed to help prevent unnecessary deaths using new technology, is one of the first of its kind in the NHS and there are always lessons we can learn from pioneering work. We take seriously the conclusions of the NDG, and are pleased that they have asked the Department of Health to look closely at the regulatory framework and guidance provided to organisations taking forward this type of innovation, which is essential to the future of the NHS.”
Prof Powis of the Royal Free also told SkyNews that his organisation has been “very grateful to Dame Fiona for her support [and] advice during this process and we would absolutely welcome further guidance on this issue”.
The ICO also told the broadcaster that its investigation into Google’s use of data in the NHS is now “close to conclusion”.