Even though the phrase “do no harm” doesn’t  actually appear in the Hippocratic Oath, there’s something Hippocratic about Google’s “unofficial motto” and corporate conduct code, “don’t be evil.” Or, at least, until Google jettisoned the phrase from its code in 2018, prompting one commentator  to suggest that ”evil is fine now.”
In recent days, we’ve learned  that Google  is violating both its old standard and the Hippocratic Oath, having entered into an agreement with one of the country’s largest health-care systems, Ascension, to collect and access the private health information of up to 50 million  Americans, without their consent, or even without informing them. Without notifying anyone, Ascension has shared  “personally identifiable information on millions of patients,” including their names and birthdates, as well as results of lab tests, prescriptions, diagnoses, hospitalization records and more. The project, code-named “Project Nightingale” will not be used to sell advertisements, Google assures, and yet the data appears to be available for use in research outside of direct patient care.
To many, the legal and ethical implications of sharing personal health records without consent are rather obvious; after all, it seems that every visit to the doctor or pharmacy includes signing multiple privacy statements, none of which hint at the possibility that one’s insurance provider would share information with Google. Let alone share that information for possible non-medical reasons.
However, if we conceive of this simply as a failure to obtain consent, or as a breach of privacy, we’ll fail to understand the gravity of the situation and what’s really at stake when it comes to medicine and ethics.
It’s all in the distinction between the words “about” and “of.”
If I have knowledge about Project Nightingale I can repeat some true statements related to this news story. If, however, I have knowledge of Project Nightingale, it’s because I am intimately involved in it, part of it—perhaps an executive with Ascension. To take another example, if I have knowledge about God it implies that I have read a theology textbook, whereas if I have knowledge of God it means that I have some sort of personal encounter and personal rapport with the Divine.
Health records are not just information about patients; these records, in a way, contain something of the patient. As we’ve previously explained  at the Culture of Life, medical data is a “unique category of data.” While it certainly “belongs” to a patient it doesn’t belong to them in quite the same way that a sweater belongs to its owner, since the sweater is not an aspect of a person, does not constitute some aspect of their self. Medical data belongs to us in a more important manner than the sweater because the data is “more closely connected to—more intimately of—its owner.”
If I have lung cancer, it certainly can be said about me that “RJ Snell has lung cancer.” It’s a true statement. At the same time, however, I have lung cancer, and it is I who has it. It is more than simply a state of affairs in the world, like today’s weather, for it is I, this person who I am, who has cancer, and “my” cancer is a characteristic inseparable from me, or at least as long as I have cancer.
When some people speak of themselves as “cancer survivors” they articulate the same point, namely, that cancer was a characteristic of them, and while it is no longer a characteristic it was so closely related to their personhood as to be a part of their self-understanding.
Now, because the body is part of our identity, whatever happens in and to our body is part of our identity, even if the condition is less severe than a life-threatening cancer. Heart conditions, baldness, infertility, gum disease, acne—whatever—are all characteristics of the person who has them, partially constitutive of their bodily, and thus personal, identity. (For a simple example, try telling a self-conscious adolescent that their acne is just something true about them but doesn’t actually affect their self-understanding and identity. Good luck.)
Consequently, handling a patient’s medical record is analogous to handling the patient herself. We treat the patient with dignity—they’re a person, after all—and so ought we treat the records with dignity, for they are not merely records about the person, they are records of the person, and treating the records carelessly is to treat the patient carelessly.
Ascension and Google haven’t simply violated patients’ privacy, they have violated persons. And it is a grave and serious matter to violate the dignity and integrity of persons.