Alphabet’s COVID-19 project underscores privacy concerns with big tech
A NEW COVID-19 project from one of Google’s sister companies is the latest big-tech foray into healthcare to spark privacy concerns.
Verily Life Sciences, a research subsidiary of Alphabet, last week released a website designed to screen users for COVID-19 risk—and, for those who qualify, point them to mobile testing sites set up by the company. It’s part of Project Baseline, a data initiative Verily launched in 2017 to support clinical research and collect enough data to one day “map” human health.
It’s a private project but has been supported by both local and federal officials, developed in collaboration with the California governor’s office. President Donald Trump hyped the effort during a March 13 news conference in the Rose Garden, suggesting that Google engineers were working to quickly launch the screening tool.
“We’re honored to help support such an important public health program,” Verily wrote in a statement announcing the new project. “By connecting people with testing when it’s most needed, we hope to contribute to the efforts to address COVID-19.”
So far, the online screener is only available for those living in two counties in California. Verily has said it plans to scale the capability throughout the state, beginning with areas with high volumes of known cases. The company hasn’t outlined a schedule for the expansion, but said it plans to move into more regions in the “coming days and weeks.”
It’s an ambitious, and admirable, goal, particularly as people living in areas with confirmed COVID-19 cases become concerned about what symptoms to look out for and where to go, said Alain Bernard Labrique, an associate professor at Johns Hopkins Bloomberg School of Public Health and director of the global mHealth initiative at Johns Hopkins University.
“Having vetted and authoritative websites or apps that (people) can use to help either allay their fears or refer them to the appropriate level of clinical support … I think is absolutely needed at this time,” Labrique said.
Reactions to the COVID-19 screener have been mixed, with some applauding involvement of a company known for its powerful artificial intelligence and other technological capabilities, while others questioned how Alphabet intends to use data collected during the screening process.
There’s friction between the value that tech giants can bring to healthcare and the reality that companies want to make a profit, often by mining user data, said Michelle De Mooy, a privacy and data ethics consultant. “Google may very well have some altruistic reasons for wanting to be a resource for public health, but it’s also undeniably interested in gathering data,” she said.
That tension has become a growing point of controversy in healthcare, as more health data begins to flow outside the walls of the hospital—and outside the bounds of HIPAA.
The American Hospital Association, American Medical Association, technology groups and privacy advocates alike have voiced concern over new interoperability regulations issued this month, arguing that they leave gaps in protecting patient privacy. The rules encourage patients to download medical data with apps, which aren’t held to the same privacy standards as providers and payers.
A particular point of concern for Verily’s screening project has been that us
ers are required to log in with a Google account. The project isn’t covered by HIPAA—Verily isn’t working as a business associate of a HIPAA-covered entity, such as a hospital or insurer—raising concerns that data provided during screenings could be linked with other Google services.
Other tech companies and healthcare organizations, including Providence in Washington state and insurer Oscar Health, also offer online assessments to screen for COVID-19 risk. Those tools tend to direct patients to either stay home or seek medical care. While they might suggest COVID-19 testing, users will largely have to initiate calling and scheduling an appointment on their own.
Verily’s screening tool advertises that the company reaches out to users directly via email to schedule testing and to deliver results, which it said is why it requires a Google account. Verily doesn’t allow users to sign up with accounts from other email providers or to self-schedule testing directly with a facility.
“An account connects an identity to data,” De Mooy said. “Google absolutely does not need to require people to connect to or create a Google account.”
The fact that it’s a private project touted by the government has compounded privacy concerns. That could affect some users’ privacy expectations, said Sara Helene Shanti, a partner in law firm Benesch’s healthcare practice.
“The government has promoted something that they can’t really enforce contractually,” Shanti said. “It’s natural to assume that the government is supporting this and advocating for it, and is going to protect your data like they would when you submit your taxes,” she added, as an example.
Verily has stressed that it—not Google—is collecting information from the COVID-19 screener. A Verily spokesperson said that data collected through the online screener won’t be combined with user data stored in Google’s products or services, and that screening data will not be used for advertising purposes.
Verily also plans to delete information collected through the online screener after completing Project Baseline’s COVID-19 testing program and after emergency declarations related to the outbreak expire—unless a user “separately authorizes further retention and use of information,” the spokesperson wrote in an email.
But those assurances haven’t assuaged concerns from privacy advocates, who point out that Verily’s privacy policy for the COVID-19 screener allows the company to share information with “certain service providers engaged to perform services on our behalf,” including Google, which provides services related to cloud and website hosting for the project.
And some have noted that the privacy policy for Project Baseline allows Verily to share user data with business partners, as well as use data for commercial product research and development.
“Why would anyone trust them?” Dr. Deborah Peel, president of advocacy group Patient Privacy Rights, said of Google. “They’re not an agency designed to take care of people. Google is an entity designed to extract maximum revenue.”
Google has a messy history with data privacy in the consumer world. The company last year paid a fine to settle allegations that its YouTube subsidiary had illegally collected data from children without their parents’ consent in order to sell ads, and in 2018 it shut down the Google+ social network after discovering a bug had exposed data on hundreds of thousands of users’ profiles.
Google has had its own set of controversies within healthcare, most recently after details emerged about a massive data-sharing partnership with Ascension.
But Verily and Google are two separate companies—albeit under the same parent company, Alphabet—with different business models and goals. In fact, when it comes to finances, Google tends to buoy its parent company’s more experimental businesses. While Google posted $11.5 billion in operating income last quarter, Alphabet’s dozen or so other subsidiaries—which include Verily—reported a collective $2 billion operating loss. Alphabet doesn’t break out Verily’s earnings individually.
That said, the two companies are related: not only are users of Verily’s project required to have a Google account, but the companies share some of the same leaders, with some of Alphabet’s most high-profile health hires—like former FDA Commissioner Dr. Robert Califf and former ONC chief Dr. Karen DeSalvo— overseeing work in both Google and Verily.
“As a member of the Alphabet company family, Verily— for better or for worse—bears scrutiny for its data protection and privacy practices,” said David Holtzman, an executive adviser for cybersecurity consulting firm CynergisTek and a former senior adviser at HHS’ Office for Civil Rights.
Holtzman said he thinks the online screener will be useful for helping users access information about COVID-19 and testing, and hopes to see it one day expand to regions outside of California. He added that if he were concerned about COVID-19 risk—and eligible to use Verily’s screener—he would do so. It seems others might agree.
A Verily spokesperson said the company isn’t sharing details on how many patients have received testing, but the website quickly reached capacity just hours after going live on March 15, at which point Verily said it could not schedule any more testing appointments. Verily’s website as of last week said it’s working to “rapidly expand test
ing in every way that we can.”