The transfer of 1.6m patient records to Google’s artificial intelligence company DeepMind Health has been criticised for its “inappropriate legal basis” by the UK’s national data guardian.
In a letter leaked to Sky News, the national data guardian, Dame Fiona Caldicott, warned DeepMind’s partner hospital, the Royal Free, that the patient record transfer was not for “direct care” since the data was initially used to test the app that the two organisations were working on, before patients were treated with it.
The carefully worded letter does not directly state that the data transfer was unlawful, but while trusts are allowed to transfer data for direct care purposes, many other reasons for transferring the data require more explicit approval from regulators – approval the partnership lacks.
The app, Streams, was first announced in February 2016 as a collaboration between the two organisations to diagnose acute kidney injuries in NHS patients. Its creation has led to a long-running row over the nature and propriety of information sharing between the two bodies. The Google subsidiary in particular has been accused of secretly transferring overly large amounts of patient data under a wide remit which would, critics say, allow it to do almost anything it wanted with the information.
Caldicott’s letter addresses a different, and narrower, criticism, however: the rationale under which the data was initially transferred from the Royal Free to DeepMind.
Writing to Prof Stephen Powis, who leads the Royal Free’s side of the collaboration, Caldicott said that the initial legal basis for the transfer – that the data would be used for “direct care” of patients – was unsound as the information was first used to test that the system was implemented correctly.
“It is my view,” Caldicott wrote in the letter dated 20 February, “that the purpose for the transfer of 1.6m identifiable patient records to Google DeepMind was for the testing of the Streams application, and not for the provision of direct care to patients.
“Given that Streams was going through testing and therefore could not be relied up for patient care, any role the application might have played in supporting the provision of direct care would have been limited and secondary to the purpose of the data transfer.”
The national data guardian’s office has confirmed the accuracy of the letter: “The NDG agreed to provide advice on the use of implied consent for direct care as a legal basis for the sharing of data by the Royal Free with DeepMind. While the ICO [Information Commissioner’s Office] investigation is ongoing the NDG will provide any further assistance to the ICO as required, but will not be commenting further on the matter at this point.”
Caldicott also wrote to the ICO the same day. The ICO said that its investigation into the sharing of patient information between the Royal Free NHS Trust and DeepMind was close to conclusion.
An ICO spokesperson said: “We continue to work with the national data guardian and have been in regular contact with the Royal Free and DeepMind who have provided information about the development of the Streams app.”
Both Royal Free and DeepMind argue that providing direct care using an app such as Streams requires a preliminary phase of testing using real patient data before putting it into practice, and that the regulations don’t reflect the real needs of healthcare providers.
A DeepMind spokesperson said: “Safety testing is essential across the NHS, and no hospital would turn a new service live without testing it first. We’re glad the NDG has said that further guidance would be useful to organisations which are undertaking work to test new technologies.”
DeepMind said that it recognises that more public engagement and discussion about new technology in the NHS is required. It said: “We want to become one of the most transparent companies working in NHS IT, appointing a panel of independent reviewers, embarking on a major patient involvement strategy, and starting a groundbreaking project called Verifiable Data Audit.
“We believe that these steps are helping to set a new standard of transparency across the health system.”
The Royal Free said that it took a safety-first approach to testing Streams using real data to check the app was presenting patient information accurately before being put into use.
A Royal Free spokesperson said: “Real patient data is routinely used in the NHS to check new systems are working properly before turning them fully live. No responsible hospital would ever deploy a system that hadn’t been thoroughly tested. The NHS remained in full control of all patient data throughout.”
Saffron Cordery, the director of policy and strategy at the umbrella healthcare body NHS Providers, said that technologies such as Streams “need proper testing and evaluation just like other technologies and drugs to demonstrate that the systems work as planned and do no harm. This requires access to clinical data in the assessment stage in the same way as other new technologies.”
Julia Powles, a researcher at Cornell University in New York who published a critical examination of DeepMind’s original data sharing agreement with the Royal Free, said “in trying to defend themselves, DeepMind and the Royal Free are trying to remake the entire foundations of medical information governance, and that is really concerning.
“DeepMind also deserve some pushback as they continue to trumpet their (still silent) independent reviewers and (still not deployed) technical solutions without addressing the core issue that they’re sitting on too much data and I haven’t seen them make any other argument for keeping it except for the one the NDG has now rejected,” Powles added. “If they have other arguments supporting the legality of the deal, the public deserves to know.”
The Royal Free added: “The Streams app was built in close collaboration with clinicians to help prevent unnecessary deaths by alerting them to patients in need in a matter of seconds. It is now in use at the Royal Free, and is helping clinicians provide better, faster care to our patients. Nurses report that it is saving them hours each day.
“We are proud of the work we have done with DeepMind and will continue to be bold and brave for the benefit of our patients.”