ICO finds DeepMind NHS deal did not protect patient privacy

Android, Google, silicone valley

The UK’s Information Commission (ICO) has found that a UK hospital did not adequately protect patient privacy in its data sharing deal with Google.

The ICO looked into the data handed over by the Royal Free NHS Foundation Trust as part of its trials into new ways to detect kidney injuries.

It was claimed that the hospital had not sufficiently informed patients about how their data would be used.

Medical details for around 1.6 million patients was provided to Google’s DeepMind division in the trial last year.

It was intended that this information would be used to create a system that could detect and diagnose patients at risk of developing acute kidney injury (AKI). This led to the creation of an app called ‘Streams’ which was developed to help doctors spot the signs of AKI.

Information commissioner Elizabeth Denham said that attempts to use data in new ways needed to be managed more carefully.

“The price of innovation does not need to be the erosion of fundamental privacy rights,” she said.

There has been no fine imposed onto the trust, with it instead signing an agreement to change the way it used data.

The Royal Free issued a statement emphasising that it had co-operated fully with the investigation and welcomed the results and guidance it had received.

“We accept the ICO’s findings and have already made good progress to address the areas where they have concerns,” it said.

“We passionately believe in the power of technology to improve care for patients and that has always been the driving force for our Streams app.”

Google has also said that it welcomed the “thoughtful resolution” and added that it would assess its involvement with the scheme.

“We underestimated the complexity of the NHS and of the rules around patient data, as well as the potential fears about a well-known tech company working in health,” wrote Dominic King.

Details of the deal between DeepMind and the Royal Free became public early in 2016, and caused concern over the sharing of information without informing the public.

At the time, Google DeepMind said the report had “major errors” that misrepresented the way it and the Royal Free had used data.