London hospital acted 'inappropriately' for sharing 1.6m records with Google's AI firm

A London hospital has acted outside the legal guidelines after it shared 1.6 million patient records with Google's artificial intelligence company DeepMind Health, the UK's National Data Guardian (NDG) has said.

The Royal Free Hospital in Hampstead started sharing the data with the private company in 2015 to develop an app called Streams that could diagnose acute kidney injuries.

It argued that it did not need patients' consent to share the data – as under common law, consent is "implied" when "direct care" is provided. However, the NDG has disagreed with that basis.

In a letter to Stephen Powis, the Royal Free Hospital's medical director, which was leaked to Sky News, the NDG's Dame Fiona Caldicott said: "It is my view that the purpose for the transfer of 1.6m identifiable patient records to Google DeepMind was for the testing of the Streams application, and not for the provision of direct care to patients.

"Given that Streams was going through testing and therefore could not be relied up for patient care, any role the application might have played in supporting the provision of direct care would have been limited and secondary to the purpose of the data transfer.

"My considered opinion therefore remains that it would not have been within the reasonable expectation of patients that their records would have been shared for this purpose."

Google and the Royal Free Hospital defended the deal, stating that it has had a tangible impact on patient care and that the data was not used for commercial gain.

A spokesman for Deep Mind said: "Nurses and doctors have told us that Streams is already speeding up urgent care at the Royal Free and saving hours every day. The data used to provide the app has always been strictly controlled by the Royal Free and has never been used for commercial purposes."

A spokesman for Royal Free London said: "The app was built in close collaboration with clinicians to help prevent unnecessary deaths by alerting them to patients in need in a matter of seconds."

The NDG acknowledged the health benefits, but still concluded that the deal lacked the "appropriate legal basis".