A Chicago medical school allegedly violated federal and state health laws by selling patient data to Alphabet Inc.'s Google to develop artificial intelligence products, according to an amended lawsuit in Illinois federal court.
The University of Chicago Medical Center sold patient records to Google so it could develop new products instead of using them for research, plaintiff Matt Dinerstein alleged Oct. 3. Dinerstein, seeking to represent a proposed class, claims the alleged actions violate the Health Insurance Portability and Accountability Act, as well as Illinois medical privacy, health record, and consumer protection laws, because patients didn’t consent to share their records for financial gain.
Dinerstein is seeking an injunction that would limit the University of Chicago from “disclosing identifiable patient medical records to third parties without first obtaining consent,” according to the amended complaint. The plaintiff also wants to stop Google from “using patient records obtained from” the university, the filing said.
Google and the University of Chicago didn’t immediately respond to requests for comment on the amended complaint.
Tech giants are facing a slew of consumer lawsuits for alleged privacy violations. Plaintiffs’ attorneys and tech platform users are likely to keep pressuring the companies, increasing both court costs and possible large settlements if they can beat early challenges to class claims.
“Google and the Medical Center have long argued that they traded patient data for altruistic reasons,” Jay Edelson, attorney for the plaintiff and founder and CEO of Edelson PC, said in an email. The new filing “demonstrates that their narrative is false.”
Dinerstein filed the amended complaint to specify how the proposed class was damaged by actions Google and the university allegedly took. The plaintiff can show through the new filing that “he is entitled to damages in the form of a reasonable royalty that he would have been paid for his valuable information had the University and Google been acting in good faith,” according to a separate motion filed with the amended complaint.
The new document, filed in the U.S. District Court for the Northern District of Illinois, follows a bid by Google and the university to kill Dinerstein’s lawsuit. The proposed class wants to hold Google and the university “liable for ground-breaking medical research that fully complied with federal law,” Google said in an Aug. 27 court filing.
The plaintiff brought Illinois consumer protection law, breach of contract, and privacy tort claims, including alleged violations of HIPAA and Illinois medical privacy laws, against the university, according to the amended complaint. Dinerstein brought contract and unjust enrichment claims against Google for allegedly not keeping the health data confidential and private. the new filing shows.
The university violated state law by not getting informed consent before subjecting patients to Google’s research projects, Dinerstein alleged.
The new filing also details an alleged data use agreement between Google and the university to sell patient medical records so Google could use the data to create new artificial intelligence models that can predict health outcomes for a profit.
The deal allegedly allowed Google to start “developing software that it can market to hospitals looking improve their bottom lines,” according to the amended complaint. Google’s software using the medical patients’ "private medical information is worth more than $10,000,000,” Dinerstein alleged.
Cooley LLP and Neal & McDevitt represented Google. Kirkland & Ellis LLP represented the University of Chicago.
The case is Dinerstein v. Google, LLC, N.D. Ill., No. 19-cv-04311, amended complaint 10/3/19.