Google's DeepMind AI unit has access to 1.6 million NHS patient records

No opt-out for patients from data-gathering company's deal with the Royal Free NHS Trust

Google-owned artificial intelligence company DeepMind has access to 1.6 million NHS patients' records, thanks to a controversial agreement it has with the Royal Free NHS Trust.

An agreement, first seen by the New Scientist, between the AI specialist and the NHS Trust, which includes Barnet, Chase Farm and the Royal Free hospitals, means that the company holds NHS data on patients who are HIV-positive, for example, as well as those who have had abortions, and drug overdoses.

Back in February, DeepMind said it would be working with the NHS to build an app called Streams. The purpose of the app is to help hospital staff monitor patients with kidney disease, but the agreement suggests that information other than kidney function will also be used by DeepMind.

Despite the document stating that Google cannot use the data in any other part of its business, privacy campaigners will be wary of the access that online information giant Google potentially has to the data, which includes logs of hospital activity and results of various pathology and radiology tests.

The data will be stored at an "ISO28001 accredited location", the agreement states, with a third-party contractor, and it will not be stored or processed at DeepMind offices, except for ordinary remote development and administration. After the project ends on 29 September 2016, data held will have to be transferred back to the hospital, with any residual data destroyed. The agreement states that data processed for purposes other than for the direct care of the patient "must be pseudonymised".

DeepMind's access to the NHS's centralised record of all hospital treatments in the UK, dubbed the Secondary User Service (SUS) database, means that it has access to historical data from the past five years. DeepMind says that its intention is to give doctors support in making clinical decisions with the help of a broad range of data, as opposed to automating clinical decisions. It will do this using a new analytics-as-a-service platform that it's developing, called Patient Rescue.

It is unknown what opt-out mechanisms are available to patients. The government has a chequered history when it comes to opt-outs. Only this month, the Department of Health agreed to direct the Health and Social Care Information Centre (HSCIC) to implement Type-2 opt-outs, months after it emerged that data belonging to patients who thought they had opted to not share their data was still being shared.

The Royal Free Hospital will remain the official data controller in this instance, and DeepMind has stated that staff who handle the data have undergone information governance training, and have signed a confidentiality agreement as part of their employment contract.

Meanwhile, any personal identifiable data related to the project that is held on electronic media "will be overwritten so that it is not recoverable". And any personal identifiable data related to the project held on paper or disposal media "will be shredded".

Google claims that it has no commercial plans for DeepMind's work with the Royal Free NHS Trust.