'I expected better from Google': Tech chiefs at 3 top US hospitals shared their concerns as health systems and tech giants get cozy
- In November, Google's work with the second largest health system in the US came to light, raising questions about how Google will use the patient information that's being transferred to its cloud.
- Health systems are considering moving patient records from their own data servers to cloud providers like Google.
- We spoke to the experts who deal with patient data for major hospitals. They shared their perspectives on health systems moving to the cloud and considerations for groups making the transition.
- "I expected better from Google," John Kravitz, the chief information officer at Geisinger Health System in Pennsylvania, told Business Insider.
- Subscribe to Dispensed, Business Insider's weekly healthcare newsletter.
- Click here for more BI Prime stories.
When news broke in November that Google was quietly working with the second-largest health system in the US, it was met with loud concerns about how much private health information the tech giant had access to and how it might use it.
The health system, Ascension, is transferring the personal and medical information of 50 million patients onto Google's cloud network. In return, Google gains access to the data, Business Insider reported. Google has said that "a limited number" of Google employees have access to full patient data as part of the deal.
The US Department of Health and Human Services has since said it's seeking more information on the partnership, and a number of US lawmakers have also expressed concern.
Many health systems are contemplating moving their information from data servers they operate to cloud providers like Google, Microsoft, or Amazon, as they grapple with the challenge of managing and securing large amounts of patient information. The hope is that moving to the cloud would free health systems from having to invest in costly data centers, ultimately saving them money.
Longer term, through some of the partnerships tech companies promise to work side-by-side with the health systems to develop artificial intelligence tools that can benefit the industry. Google, for instance, is developing a patient information search tool that's similar to its internet search function.
Privacy and security concerns dominate at major health systems
We spoke to the top tech executives at three health systems, all of whom work with the tech giants in some capacity, though none of them have put their electronic health records on the cloud. They laid out their hesitations with making the move, in large part because of privacy and security concerns.
They told us that the idea that there might be additional uses of the electronic health record information to build tools - rather than simply storing the information - is what surprised them about the work that Google is doing with Ascension.
Some of the tech chiefs Business Insider spoke with are hesitant to entrust their data to the cloud, because they'd have less oversight of the security of that data. They said they have questions about how much of a technology advantage moving to the cloud would actually provide, and doubts about how much money they'd really save.
Privacy, they said, is paramount.
"That's the scary part," John Kravitz, the chief information officer at Geisinger Health System in Pennsylvania, told Business Insider. "Not everyone's just willing to jump into this two feet."
Geisinger currently runs its own data centers and works with some vendors that run applications that tend to be hosted on private clouds.
Kravitz said he was stunned when he read the Google-Ascension news.
"I expected better from Google," Kravitz said. "I did not expect this. Now they're trying to put a spin on it where it's, you know, it's going to be something that'll, that'll be better for big changes to support docs and patients. I think they're trying to put a positive spin on something that may not be as positive as expected. That's where I would be really cautious about this."
The move to the cloud
Amazon, Microsoft, and Google have been landing major cloud deals in healthcare. In July, the health information technology giant Cerner said it had made Amazon Web Services its preferred cloud provider as it moved its business from its own data centers to the cloud. Mayo Clinic in September signed Google as its cloud and artificial-intelligence partner. In July, West Coast-based Providence St. Joseph Health signed a cloud deal with Microsoft.
"Mayo Clinic will manage access to all data using rigorous long-standing institutional controls and will specifically authorize the use of data for joint research projects that solve health care problems," Mayo spokeswoman Duska Anastasijevic said in a statement. "No partners, including Google, will have independent access to Mayo's private patient data. It is important to note that Google will be contractually prohibited from combining Mayo data with any other data."
Across the business, health systems have to choose what they'd liked to do themselves and what outside companies can do better, Toby Cosgrove, the former head of Cleveland Clinic explained.
Cosgrove, who's now a top Google health advisor, said there's a race to convince hospitals to move to the cloud, and that tech companies are offering other tools and services to try to sway them.
"There's no doubt that that is more secure in the cloud than it is the data centers of most hospitals across the country," Cosgrove said.
New York's Northwell Health System, which operates 23 hospitals and made $11.5 billion in revenue in 2018, works with cloud providers including Oracle, Microsoft, and Google, and some of its business partners use Amazon Web Services. Northwell doesn't keep data from its electronic medical records on the cloud, instead housing it in data centers it operates.
A 'cautious, diligent, thorough' approach
John Bosco, the CIO of Northwell said that when working with cloud providers, he's carefully paying attention to where the cloud providers are keeping the data, who from the cloud provider has access to it, and how information that's sent to the cloud will be used.
"We are, as I think most big health systems are, very cautious, diligent, thorough in our approach to our systems and especially being out in the cloud or anywhere outside of data centers," Bosco said.
What gave the tech experts at health systems particular pause about the deal between Google and Ascension was the potential for Google to use the massive amount of patient data it'd have to get an even more complete picture of its consumers. The information contained in a health record includes sensitive data from names and dates of birth to lab results, medications and diagnoses.
"Google already knows everything about everybody," Andrew Kasarskis, the chief digital officer at Mount Sinai in New York told Business Insider. "Google, unlike almost every other company out there, has incredible ability to know who somebody is, so in fact, by partnering with Google you're doing a couple things that you're not doing,when you're partnering with other companies."
Google has said it isn't combining Ascension patient data with other consumer data it collects. The company said that the patient can only be used to provide services to Ascension under the companies' business agreement. Ascension has said that the partnership follows privacy laws, and that the companies are taking strong steps to protect patient data.
In Google-Ascension deal, 'a whole lot of patient data' is being shared
Close to 150 Google employees are able to access Ascension's data, internal documents show. The data includes patients' names, contact information, diagnoses, and medication orders.
"I was surprised. I think this has been #1 on a scale we haven't seen before," Bosco said.
"You're talking about a whole lot of patient data," he added.
Over the past year, Google has been building up its Google Health division, hiring former Geisinger CEO David Feinberg to run the unit. Recently, the Google Health team has revealed more details about the search tool for electronic health records that it's working on.
The Health Insurance Portability and Accountability Act, known as HIPAA, is meant to protect the privacy of patients' health information while allowing health systems to share patient information with business partners. That can include software companies providing electronic health records and billing vendors.
HIPAA was enacted in 1996, before there were considerations of how patient data could be used by business associates, such as using machine learning to build search tools like the kind Google is working on.
Geisinger is evaluating a move to the cloud
"These point to the fact that we probably need updates to the way we regulate what can be done with data in a way that's transparent and supports a patient's needs to understand where the information goes and how it's used," Kaskaris said.
Kravitz is in the middle of evaluating whether Geisinger should make its transition to the cloud, and he anticipates he'll make a decision in the next six months. He's curious to see if the move would actually save money, and he's working to get a better understanding of the privacy protections public cloud providers have in place, he said.
"I'm very cautious that I'm making prudent sound financial decisions and decisions that protect the life of the organization moving forward," Kravitz said.