Whistleblower Alleges Verily Misused Patient Data and Concealed HIPAA Breaches
Alphabet’s health technology subsidiary Verily stands accused in a federal lawsuit of improperly using protected health information (PHI) from more than 25,000 patients without authorization and actively covering up these violations. Ryan Sloan, a former chief commercial officer at Verily’s diabetes and hypertension unit Onduo, filed the suit in San Francisco, asserting that he was terminated after raising alarms about the breaches to senior management.
Details of the Alleged Violations
The lawsuit, filed late last year but previously unreported, claims Sloan and Onduo’s general counsel, Julia Feldman, uncovered extensive HIPAA violations in early 2022. These breaches involved unauthorized use of patient data in research, marketing, press releases, and conferences. An internal investigation reportedly confirmed multiple violations of 14 separate HIPAA Business Associate Agreements with major covered entities between 2017 and 2021.
Clients impacted by the alleged breaches include Walgreens Boots Alliance, Highmark Health, Quest Diagnostics, and Delta Air Lines. These organizations provide access to Verily Onduo’s services for their patients or employees.
Allegations of Concealment and Retaliation
The suit further alleges that Verily delayed notifying affected parties beyond the 60-day period mandated under HIPAA. During contract negotiations, Verily purportedly represented full compliance with HIPAA while withholding information about the breaches. Notably, Feldman and another employee aware of the violations were terminated in August 2022.
When Sloan reiterated concerns to then-Chief Revenue Officer Lisa Greenbaum in October 2022, she allegedly defended the decision to withhold disclosure, citing potential negative publicity. Sloan himself was terminated in January 2023 while on protected leave caring for his critically ill mother.
Verily’s Response and Broader Context
Verily has denied all allegations, stating the claims are “completely without merit” and affirming its commitment to legal compliance. The company declined further comment due to the ongoing litigation.
Founded in 2015 within Alphabet’s innovation lab, Verily has pivoted its focus multiple times, from hardware like glucose monitors to pandemic response and most recently to AI-driven chronic care solutions. Despite raising over $1 billion in funding, the company has faced challenges in establishing a commercially successful product line.
The lawsuit adds to recent scrutiny of Verily’s operations as it transitions from an LLC to a C-Corp to attract new investment. Industry observers will be watching closely how the legal proceedings and regulatory reviews unfold.
Reactions from Partner Organizations
Among the implicated clients, Delta Air Lines acknowledged the situation and committed to addressing any impact on employees, while Quest Diagnostics stated unfamiliarity with the allegations and declined further comment. Highmark Health and Walgreens did not provide statements.
The case underscores the critical importance of HIPAA compliance and transparent breach notification in healthcare technology partnerships.
FinOracleAI — Market View
The whistleblower allegations against Verily could cast a shadow over the company’s reputation and delay its efforts to secure new funding amid a critical strategic transition. Regulatory scrutiny and potential legal costs represent significant risks, especially given the sensitive nature of health data involved. Market participants should watch for developments in the lawsuit and any regulatory enforcement actions, which could impact Verily’s valuation and investor confidence.
Impact: negative
