Google-owned artificial intelligence company DeepMind has access to 1.6 million NHS patient records thanks to a unique agreement with the Royal Free NHS Trust.
The agreement between DeepMind and the NHS trust, first seen by New Scientist, includes Barnet, Chase Farm and the Royal Free hospitals, and means that the company holds NHS data on patients who are HIV positive, for example, or have had abortions or drug overdoes.
DeepMind said in February that it will work with the NHS to build an app called Streams to help hospital staff monitor patients with kidney disease, but the agreement suggests that information other than kidney function will be included.
The document stated that Google cannot use the data in any other part of its business, but privacy campaigners will be wary of the information to which Google will have access, which includes logs of hospital activity and results of pathology and radiology tests.
The data will be stored at an "ISO28001 accredited location" with a third-party contractor and will not be stored or processed at DeepMind's offices, except for ordinary remote development and administration.
The project is scheduled to end on 29 September. At this point the data will have to be transferred back to the hospital, and any residual data destroyed. The agreement stated that data processed for purposes other than for the direct care of the patient must be "pseudonymised".
DeepMind's access to the NHS's centralised record of all hospital treatments in the UK, dubbed the Secondary User Service database, means that it has access to historical data from the past five years.
DeepMind claimed that its intention is to support doctors in making clinical decisions with the help of a broad range of data, as opposed to automating clinical decisions. It will do this using a new analytics-as-a-service platform called Patient Rescue.
It is unknown whether there are opt-out mechanisms available to patients. The government has a chequered past when it comes to opt-outs. Only this month, the Department of Health agreed to direct the Health and Social Care Information Centre (HSCIC) to implement Type-2 opt-outs.
The Information Commissioner has already stated that some of the patients who had opted out may still have had their data shared, showing that the NHS may well do the same in this instance, and could continue to tie up agreements with vendors before patients have the chance to opt out.
The Royal Free Hospital will remain the official data controller in this instance, and DeepMind has stated that staff who will handle the data have undergone information governance training and have signed a confidentiality agreement as part of their employment contract.
Meanwhile, any personally identifiable data related to the project held on electronic media "will be overwritten so that it is not recoverable", and any held on paper or disposal media "will be shredded".
Google claimed that it has no commercial plans for DeepMind's work with the Royal Free NHS Trust.
DeepMind said recently that AI could help solve humanity's biggest issues by taking over from scientists. The Google company's AlphaGo AI engine has already beaten the Go world champion.
Why does Facebook store "my entire call history with my partner's mum", asks developer who requested his Facebook data
Facebook database included text-message metadata - despite not using Facebook Messenger for SMS
Before Ocado could start selling the technology it had developed to other retailers, it had to tear down and rebuild its own monolithic architecture
Successful attack could result in harm to patients and financial loss, warns NHS governing body
Guccifer 2.0 claimed to be a lone Romanian hacker - until a schoolboy error gave him, her or them away