A leaked document has revealed that Google has been given access to 1.6 million patients' records by the UK's National Health Service (NHS) - including full names and patient histories.
The records were handed over as part of a collaboration that will allow Google's artificial intelligence company DeepMind to create an early warning app for kidney injuries. But New Scientist has now uncovered a document outlining the agreement, which reveals that the tech giant has access to far more sensitive data than was initially disclosed.
To give you the backstory, the agreement between DeepMind and the NHS was first announced in February this year.
As far as the public knew, the goal was to apply DeepMind's AI to a wealth of medical data so that the tech company could develop an early warning app called Streams for patients at risk of developing acute kidney injuries.
That's all good. But far from just having access to the NHS's data on kidney disease, the leaked agreement document has revealed that DeepMind has access to healthcare data on every patient that passes through one of London's three hospitals run by the Royal Free NHS Trust: Barnet, Chase Farm, and the Royal Free.
In total, that's data from 1.6 million patients each year.
"This will include information about people who are HIV-positive, for instance, as well as details of drug overdoses and abortions," Hal Hodson reports for New Scientist. "The agreement also includes access to patient data from the last five years."
The reveal has left many people rightfully questioning why the hell a corporation requires such extensive details about our medical records in order to create an app about kidney health.
Google told New Scientist that there's no separate dataset for people with kidney conditions, so it needs access to all the medical records in order to develop the early-warning system.
And in their defence, there are also strict conditions in place to make sure the data stays private - the agreement states that Google can't use the data elsewhere in their business, and it has to be stored in the UK by a third party, not in the DeepMind offices. The data also has to be deleted when the agreement expires at the end of 2017.
But there are also indications that Google's ambitions go a lot further than kidneys, which wasn't announced at the time the agreement went public.
"This is not just about kidney function. They're getting the full data," Sam Smith, who runs health data privacy group MedConfidential told Hodson. "What DeepMind is trying to do is build a generic algorithm that can do this for anything - anything you can do a test for."
The algorithm he's referring to is a platform called 'Patient Rescue', which is outlined in the document as a "Proof-of-concept technology platform that enables analytics as a service for NHS Hospital Trusts".
In plain English, that basically means DeepMind wants to mine the wealth of medical data out there to help doctors make better decisions. And that's definitely not a bad thing.
For example, Hodson writes, it could compare a new patient's information with other cases out there and predict a diagnosis, which could then help doctors decide on which diagnostic tests to run. (Side note: DeepMind told New Scientist the name Patient Rescue is no longer in use.)
Google has declined to comment on other kinds of tools or apps it could build based on this data.
So should we be worried? In a statement, the NHS says the agreement is standard, and concerned patients can choose to opt out.
"Our arrangement with DeepMind is the standard NHS information-sharing agreement set out by NHS England's corporate information governance department, and is the same as the other 1,500 agreements with third-party organisations that process NHS patient data," they said.
"As with all information sharing agreements with non-NHS organisations, patients can opt out of any data-sharing system by contacting the trust's data protection officer."
On the plus side, DeepMind could actually do a lot of good with access to such a huge amount of data - algorithms are already being used to predict our chance of disease and potentially figure out how to regenerate body parts.
"The hope is that these tools can help shift more resources away from reaction and towards better prevention," DeepMind write on their website about the collaboration. "Ultimately the aim is to give nurses and doctors more time to focus on what's most important."
Don't get us wrong, we're always excited to see technology used to advance medicine and save lives. But it's even better when patients are aware from the outset what data will be used, and what it'll be used for, which hasn't happened in this instance.
When it comes to forward-thinking projects like this, transparency is everything.