快猫短视频

Update, 8 June 2016: We have updated this story to include new information from the obtained by 快猫短视频 yesterday.

Three weeks ago, 快猫短视频 revealed that Google鈥檚 artificial intelligence company DeepMind has access to the identifiable personal medical information of millions of UK patients through a data-sharing agreement with the Royal Free London NHS Foundation Trust.

Now, a 快猫短视频 investigation has found that Google DeepMind deployed a medical app called Streams for monitoring kidney conditions without first contacting the relevant regulatory authority. Our investigation also asks whether an ethical approval process that covers this kind of data transfer should have been obtained, and raises questions about the basis under which Royal Free is sharing data with Google DeepMind.

DeepMind鈥檚 partnership with the Royal Free provides it with fully identifiable information 鈥� including names, addresses and details of medical conditions 鈥� for the 1.6 million patients treated at Barnet, Chase Farm and the Royal Free each year. It also includes in-depth聽data on all patients treated by the trust in the past five years.

Google and the Royal Free say they are acting in compliance with the rules.

Approval for medical devices

According to guidelines issued by the UK鈥檚 Medicines and Healthcare products Regulatory Agency (MHRA), software like Streams counts as a medical device. The MHRA was set up to ensure that such devices are safe and effective.

When introducing new medical devices, as DeepMind has done with Streams at Royal Free, it is a requirement to first obtain a 鈥淣otice of No Objection鈥� from the MHRA. This is a document stating that the agency has found no objection to the product being brought to market in its current form. Not doing this goes against the Medical Devices Regulations of 2002.

Streams has been running on and off in three live tests since December 2015, according to Royal Free. As of 10 May, according to the public list that the MHRA keeps on registered manufacturers 鈥� which is updated every week 鈥� Google DeepMind was not registered. The MHRA says it prosecutes only as a last resort when a serious offence has been committed, but that prosecution can result in a 拢5000 fine and/or 6 months鈥� imprisonment.

鈥淭hroughout these tests, Streams has always served as an additional information system for clinicians, tested alongside rather than replacing standard hospital safety systems,鈥� Google says.

In a statement to 快猫短视频, the MHRA said that it has been in contact with Google since 4 May.

鈥淲e and our partners at the Royal Free are in touch with MHRA regarding our development work,鈥� Google said in a statement to 快猫短视频 on 13 May. The app is currently offline.

Data transfer

There are questions around the transfer of data itself from Royal Free to Google DeepMind.

鈥淯nder the Data Protection Act 1998, a data controller is required to have a robust contract in place to require a data processor, like Google in this case, to maintain adequate technical and organisational measures to prevent loss or destruction of personal data and to properly govern the processing of that data by the contractor,鈥� Ben Wootton of data protection law firm, Pritchetts Law told 快猫短视频.

Royal Free has said that the 鈥溾�� which 快猫短视频 revealed in April is the contract which governs DeepMind鈥檚 data processing.

鈥淭he information sharing agreement you refer to is not simply a data sharing agreement, but is a legally binding contract that includes clear commitments required for compliance with the Data Protection Act and was prepared specifically in line with relevant ICO guidance,鈥� Royal Free said in a statement.

Privacy campaigners medConfidential say 鈥� an from the UK Renal Registry and from University College London鈥檚 School of Life and Medical Sciences. Royal Free is one of UCL鈥檚 teaching hospitals, while two of DeepMind鈥檚 three co-founders 鈥� Shane Legg and Demis Hassabis 鈥� studied neuroscience at the School of Life and Medical Sciences.聽The agreement was signed on 29 September 2015 by Mustafa Suleyman, a DeepMind co-founder, and by Subir Mondal, Royal Free鈥檚 data protection officer.

鈥淥ur agreement with DeepMind is our standard third-party data sharing agreement, with the trust being the data controller and DeepMind being the data processor,鈥� Royal Free said in an earlier statement.

Terms of processing

As well as Streams, the agreement constrains DeepMind to building tools for 鈥渞eal time clinical analytics, detection, diagnosis and decision support to support treatment and avert clinical deterioration across a range of diagnoses and organ systems鈥�.

Sam Smith of medConfidential and data protection consultant Tim Turner both say that these terms are so vague that they may not give Royal Free enough control over how DeepMind processes data.

According to the Information Commissioner鈥檚 Office, which provides guidance for data controllers and processors, 鈥渢he data controller must exercise overall control over the purpose for which, and the manner in which, personal data are processed鈥�.

make the trust鈥檚 relationship with DeepMind explicit: 鈥淭he board had agreed to enter into a memorandum of understanding with Google DeepMind to form a strategic partnership to develop transformational analytics and artificial intelligence healthcare products building on work currently underway on an acute kidney failure application.鈥�

The Information Commission鈥檚 Office says it is looking into the data-sharing between DeepMind and Royal Free.

On 24 May, the ICO confirmed that it has no record of any paper or electronic communication from the Royal Free in reference to the DeepMind data-sharing agreement.

Consent

Even if the contract does constrain DeepMind鈥檚 data processing, the Royal Free should still have obtained informed consent from the individuals whose data Google DeepMind is processing, says Turner. In Royal Free and DeepMind鈥檚 case, this means consent from every one of the millions of patients whose sensitive, fully identifiable data has been shared.

The Health and Social Care Information System (HSCIC) is an arm of the Department of Health which deals with digital healthcare. Its says: 鈥淭o lawfully process confidential information you must have the consent of the data subject or a statutory basis.鈥�

says: 鈥淲e will share information with non-NHS organisations only with your permission if the information is required for purposes other than the provision of care to you.鈥�

Google has said that each individual patient鈥檚 consent for their data being shared is implied, because it is providing 鈥渄irect care鈥� to Royal Free鈥檚 patients. On 4 May, DeepMind consultant Hugh Montgomery at University College London told the BBC: 鈥淭here is an assumption of consent that [the Royal Free] can manage that data and share it with people if it鈥檚 for direct clinical patient benefit.鈥�

So the question becomes: is DeepMind providing direct care?

The UK鈥檚 Caldicott guidelines for handling healthcare data 鈥� most recently revised in 2013 鈥� define 鈥渄irect care鈥� as: 鈥渁 clinical, social or public health activity concerned with the prevention, investigation and treatment of illness and the alleviation of suffering of individuals鈥�.

The Streams app is being developed to monitor kidney conditions. In this case, the clinical activity is the potential treatment of individuals who have had blood tests for kidney disease. Streams is not concerned with the treatment of the vast majority of individuals at Royal Free who have not had blood tests for kidney disease. Yet all of those individuals鈥� data has been shared with DeepMind, without their consent.

The Caldicott guidelines give examples of implied consent with a direct care basis: it might be a clinician giving a patient鈥檚 medical files to a colleague who is directly involved in their care, without seeking explicit consent first. Doctors might share confidential information with nurses without obtaining direct consent each time. A physiotherapist may examine a patient鈥檚 medical records before meeting them face to face if that patient has accepted a referral.

Consent might also be implied when patient data is shared with a third-party processor that runs a system for an entire hospital, such as an electronic patient records system. In this case, the services that the third-party processor provides are relevant to each individual in the hospital.

鈥淲hat they鈥檙e trying to do is apply the language of doctors and nurses applying treatment to patients to something that has never happened before,鈥� says Turner. 鈥淚 cannot see how what DeepMind is doing is comparable to the doctor-patient direct care relationship.鈥�

When asked how the trust had obtained patients鈥� consent before sharing data with Google DeepMind, Royal Free gave 快猫短视频 the following statement: 鈥淭he trust is sharing patient data for the purpose of direct care only on the basis of implied consent.鈥�

Referring to the privacy statement which mandates informed sharing, the trust said: 鈥淭he trust鈥檚 privacy statement, which provides a summary of how we use patient data and how consent can be withdrawn, is available to view on our website.鈥�

The Caldicott guidelines state that there are four cases in which identifiable data may be processed: when all patients have given consent; through specific laws, such as when the Secretary of State for Health has given consent on their behalf after ethical approval has been obtained; for reasons of public interest, such as during a national health emergency; or, finally, through a court order.

Ethics

There is an ethical approval process which can cover the kind of data-sharing being carried out at the Royal Free. It鈥檚 called Section 251 assent, a section of the NHS Act 2006 which allows for a patient鈥檚 sensitive identifiable data to be shared without their explicit consent for some purposes other than their care. Assent can be obtained through the Confidentiality Advisory Group, a committee set up by the NHS and run by the Health Research Authority (HRA), designed to ensure that the transfer of sensitive personal medical data is ethical and appropriate.

In situations where consent cannot reasonably be given in practice 鈥� in large research projects, for example 鈥� the CAG review process allows for sensitive medical data to be shared and processed. Successful applications culminate with consent for data processing being given on patients鈥� behalf by the UK Secretary of State for Health, currently Jeremy Hunt.

The HRA confirmed to 快猫短视频 that DeepMind had not started the approval process as of 11 May.

鈥淕oogle is getting data from a hospital without consent or ethical approval,鈥� claims Smith. 鈥淭here are ethical processes around what data can be used for, and for a good reason.鈥�

鈥淪ection 251 assent is not required in this case,鈥� Google said in a statement to 快猫短视频. 鈥淎ll the identifiable data under this agreement can only ever be used to assist clinicians with direct patient care and can never be used for research.鈥�

The explicitly states that DeepMind had already assigned research scientists to the AKI project. The document, dated 28 January 28 2016, was obtained by 快猫短视频 on 7 June through a Freedom of Information Act request.

The Computational Health Informatics lab, led by David Clifton at the University of Oxford, has deployed healthcare algorithms 鈥� with full ethical approval 鈥� in hospitals run by the Oxford University Hospitals NHS Foundation Trust. Clifton says ethical approval is a key step when sensitive medical data is to be accessed. 鈥淲e typically budget up to one year for the process of ethics applications, responding to comments from the ethics-review panels,鈥� Clifton says. 鈥淲hile time-consuming, we recognise that the process is there for an important reason, and that the process builds confidence in the technologies that derive from our research.鈥�

鈥淚f duty of confidentiality is going to be set aside for the hospital, there should have been a process followed,鈥� says Smith.

Hospital trusts are required to appoint a 鈥淐aldicott Guardian鈥� to ensure the guidelines are followed. The NHS defines the position as a 鈥渟enior person responsible for protecting the confidentiality of patient and service-user information and enabling appropriate information-sharing鈥�. Royal Free鈥檚 Caldicott Guardian Kilian Hynes has not responded to questions from 快猫短视频 about whether he reviewed the data-sharing agreement before it was signed and the data transferred to DeepMind.

On its website, the HSCIC describes the role of a Caldicott Guardian as follows: 鈥淎cting as the 鈥榗onscience鈥� of an organisation, the Guardian actively supports work to enable information sharing where it is appropriate to share, and advises on options for lawful and ethical processing of information.鈥�

In a statement, the Royal Free said: 鈥淭he data sharing agreement was reviewed by the data protection officer prior to signing, in line with trust policy. It has been reviewed by the trust鈥檚 Caldicott Guardian.鈥� Royal Free declined to say whether Dr Hynes reviewed the agreement before it was signed.