Alphabet-owned Verily accused by whistleblower of misusing data from 25K patients
An executive at Alphabet-owned Verily has filed a lawsuit, alleging the company covered up data breaches that impacted more than 25,000 patients. These incidents would have been subject to reporting under the Health Insurance Portability and Accountability Act (HIPAA).
Verily is a healthcare research entity that formerly operated as Google Life Sciences.
The whistleblower in this case is Ryan Sloan, the former chief commercial officer of the diabetes and hypertension business of Verily, who said he was fired after he discovered the data breaches and reported them to senior management.
According to Sloan, Verily was using patient data without the consent of the individuals, which would violate federal law, including for both research and marketing purposes. The data consisted of sensitive patient information, which could include names, contact information, diagnoses, administered treatments and more.
Sloan filed his lawsuit in San Francisco last year. However, it had slipped under the radar until CNBC covered the story this week. On Monday, a judge had thrown out Verily’s attempt to have the lawsuit dismissed. The judge also ruled that the civil dispute will not be moved to arbitration.
Misused data allegedly came from covered entities
According to the timeline in the lawsuit, as reported by CNBC, Ryan Sloan discovered the misuse of patient data in January 2022, after working at Verily for nearly two years. An internal investigation confirmed numerous incidents of data sharing that violated HIPAA. The affected patients were associated with Verily Onduo’s partner companies—Delta Airlines, Walgreens, Quest Diagnostics, among others—14 organizations in total, all of whom are covered entities under HIPAA.
The breaches involved both the unauthorized use of patient data for research and marketing and Verily’s failure to notify the affected parties in a timely manner. Verily allegedly delayed disclosure during negotiations for contract renewals with the covered entities.
Sloan claims he was terminated in January 2023 after raising repeated concerns about the breaches and the cover-up. He declined to comment to CNBC, while Verily denied the allegations and stated it will defend itself in court.
A date for a trial has not been set and the case may be settled out of court.
For more, read CNBC’s coverage at the link below.
Chad is an award-winning writer and editor with over 15 years of experience working in media. He has a decade-long professional background in healthcare, working as a writer and in public relations.