The New Scientist has obtained a document revealing that an advertising company has been given access to some 1.6 million UK National Health Service patient records.
The name of the advertising company? You may have heard of it. It's Google.
Well, strictly speaking it's a Google-owned AI firm called DeepMind, and the agreement apparently states that the Google cannot use any of the data in other parts of its business.
But as the New Scientist explains the medical data collected will extend far beyond those with kidney conditions:
The document – a data-sharing agreement between Google-owned artificial intelligence company DeepMind and the Royal Free NHS Trust – gives the clearest picture yet of what the company is doing and what sensitive data it now has access to.
The agreement gives DeepMind access to a wide range of healthcare data on the 1.6 million patients who pass through three London hospitals run by the Royal Free NHS Trust – Barnet, Chase Farm and the Royal Free – each year. This will include information about people who are HIV-positive, for instance, as well as details of drug overdoses and abortions. The agreement also includes access to patient data from the last five years.
One hopes that Google will respect patients' privacy, and not attempt to misuse the information. You may also want to cross your fingers that the systems are properly secured - as even leading technology companies like Google have been compromised by state-sponsored hackers with the intent of spying.
It seems that the data itself will not be stored in DeepMind's offices but with a separate UK company contracted by Google. DeepMind is apparently obliged to delete its copy of the data when its agreement with the NHS Trust expires at the end of September 2017.
There's no doubt in my mind that Google is one of the better data-crunchers out there, and they probably could do some extraordinary work in analysing vast amounts of medical records in an attempt to provide better treatment for those who need it.
But I'm also all too aware that they are primarily an advertising company - eager to gather as much personal information about people's lives, habits, relationships and health because of the huge opportunities for monetisation.
There is a real need to tread carefully here.
If you don't like the idea of Google and other non-NHS organisations rifling through your medical records, the answer is to opt-out according to BBC News.
Opting out. That's always the route offered by cowardly internet companies who want to grab your data, and are worried that Joe Public won't see the benefit of opting in.
Wouldn't it be a breath of fresh air to see an internet company ask people to actually opt-in to have their data shared more broadly, just once?