Despite the widespread expectation that HHS and HIPAA protect patients from unauthorized data-sharing like that of Google and Ascension's "Project Nightingale," technology has advanced far beyond the boundaries of the 1996 law, The Wall Street Journal reports.
"We have these enormous gaps in our regulatory framework," Deven McGraw, a former HHS official, now chief compliance officer for health tech startup Ciitizen, told WSJ. "It was never intended to cover the universe and as that universe expands, it looks less and less adequate."
Project Nightingale, for instance, does not violate HIPAA: The law allows healthcare providers' business partners to handle patient records so long as they protect the data from misuse or unauthorized disclosure. Patient permission is not required for data-sharing under these "business associates agreements," nor are the involved associates required to share how the data is being used if they comply with HIPAA.
Google and Ascension have shared that Project Nightingale is intended to improve potentially life-saving artificial intelligence tools. Those benefits are difficult to oppose, but, WSJ notes, when such advanced technology and large corporations are involved, patients are bound to be wary — and more all-encompassing regulations can help assuage their fears.
"Unless we as a society get comfortable with sharing and analyzing medical data, we're not going to benefit from the presumed benefits," said Nigam Shah, associate director of Stanford University's Center for Biomedical Informatics Research. "If we want that promised land, we have to share data. The challenge is to figure out how to do so in a safe way, and the current regulations and law are not sufficient."
More articles on health IT:
Uber Health encourages partners to leverage PHI to benefit patients
Human-AI collaboration more effective than either working alone: Stanford study
10 healthcare innovations named to Time's '100 Best Inventions of 2019'