WHO CONTROLS OUR HEALTH?

Our bodies continuously generate information.

Heart rates. Sleep cycles. Blood glucose. Movement. Medication histories. Medical imaging. Genetic information. Reproductive-health information. Clinical notes.

Some of this information is collected during medical treatment. Some comes from devices worn throughout daily life. Some is entered voluntarily into digital services.

Artificial intelligence introduces another layer: the ability to interpret these observations, identify patterns, construct profiles, and infer conditions or vulnerabilities that may never have been directly disclosed.

These capabilities can improve diagnosis, preventive care, accessibility, and medical research.

But they also raise an essential question.

Digital Sovereignty Coalition introduces the Computational Biological Self as a proposed extension of two established analytical concepts — Computational Identity and The Inferred Self. It names the computational representation of a person assembled from biological and health information. It is a proposed analytical term, not an established medical or legal category.

Google's health ecosystem connects consumer devices, medical records, and AI-mediated guidance within a single account structure. The documented components include:

• Medical-record integration.
• Fitbit and Pixel Watch.
• Connected health devices.
• Health coaching powered by Gemini.
• Longitudinal health patterns and personalized recommendations.
• User-authorized third-party integrations.
• Enterprise health offerings.

The benefits of connection are real. Fragmented health information — split across providers, devices, and paper records — becomes accessible to the individual, and continuous monitoring can surface patterns a single clinical visit would miss.

The investigative questions begin where the benefits end:

• Who controls the resulting inferences?
• How meaningful is consent when data is continuously generated?
• Can individuals obtain, challenge, delete, and transfer the conclusions derived from their information?
• What restrictions govern secondary uses?

Google publishes documented privacy commitments for its health products. Those commitments are separate from the unanswered governance questions above — a company's stated policy describes its intentions, and the durability of those intentions under future product changes, corporate restructuring, or legal process is a structural question no single policy document can close.

Palantir builds data-integration and analytics platforms used across government and industry, including healthcare and public-health operations.

In institutional settings, that analytical capability can help organizations understand their own operations: resource allocation, public-health conditions, reimbursement workflows, and administrative efficiency.

Palantir for Hospitals is a documented commercial offering aimed at exactly these institutional workflows.

A structural distinction matters throughout this investigation: providing analytical software is different from owning or controlling a customer's underlying data. Palantir states that its government and institutional customers retain control over their data and can administer access and security safeguards themselves.

The investigative question is therefore not whether analytics should exist. It is whether patients and the public have adequate visibility into the institutional uses of their information — who sees it, for what purposes, under which contracts, and with what auditability.

NYC Health + Hospitals, the largest public hospital system in the United States, contracted with Palantir to support healthcare reimbursement processes.

The Guardian reported on March 26, 2026, that the system would not renew its Palantir agreement after its scheduled October 2026 expiration. The reporting described:

• Nearly $4 million in payments since November 2023.
• Use of software to support healthcare reimbursement processes.
• Access to patient-related clinical notes for authorized tasks.
• A contractual provision addressing de-identification and certain additional uses, subject to approval.
• Hospital leadership's statement that a firewall prohibited sharing with ICE.
• Plans to transition to internally developed systems.

These are sourced, attributed findings, presented as reported. The reporting does not state that patient data was transferred to immigration authorities, and this investigation does not imply it. The reported October 2026 transition had not been independently verified as complete at the time of writing.

The case raises questions that apply well beyond New York:

• What data did the vendor access?
• What exactly did the contract permit?
• Who administered access privileges?
• What auditing and oversight existed?
• Were derived analytics retained?
• Was vendor access terminated after expiration?
• What governance advantages or disadvantages follow from an internally developed replacement?

In June 2022, Google Cloud and Palantir announced a partnership bringing Palantir Foundry to Google Cloud, giving enterprises the documented ability to integrate previously separated information and perform advanced analytics across it.

That partnership is a business relationship between two infrastructure and analytics companies. It is separate from Google Health's consumer information systems, and this investigation treats the two as distinct.

The central issue is architectural, not accusatory: modern cloud and analytics platforms make certain integrations technically possible — and the question is whether legal, contractual, and technical safeguards govern actual access as tightly as the capability has grown.

Palantir has documented relationships with federal health agencies, including HHS, CMS, and CDC data systems.

Palantir announced its selection for a five-year HHS contract vehicle valued at up to $90 million. That figure is a procurement ceiling — the maximum available under the vehicle — not demonstrated expenditures. The distinction between award ceilings and actual spending matters in every federal contract discussed in this investigation.

Federal health analytics can support public-health planning, emergency response, research, and administrative efficiency. The investigative question is where the boundaries lie among:

• Individual medical records.
• Federal healthcare administration.
• Population-level analytics.
• Research data.
• Public-health surveillance.
• Other government functions.

Aggregated data, de-identified data, and identifiable data are not equivalent categories — and the legal protections that attach to each differ sharply. Analysis that treats them as interchangeable overstates both the risk and the protection.

Amazon Web Services provides cloud infrastructure for federal healthcare administration, including CMS applications. A 2016 HHS privacy impact assessment documented that role — and it is used here as historical evidence only.

The assessment explicitly distinguished AWS infrastructure support from the collection and disclosure activities of the applications hosted on that infrastructure. That distinction — infrastructure provider versus application operator — remains the right analytical frame for every cloud relationship in this investigation.

In November 2026, Amazon announced a $100 million, five-year Health Impact Initiative supporting healthcare and research organizations with cloud and AI technology. Such commitments can accelerate research, improve operational resilience, and expand access to computational tools for under-resourced institutions.

They also raise structural questions for any institution that depends on them:

• Vendor dependency: what happens to critical health systems if the provider changes terms, prices, or availability?
• Service continuity: what contractual continuity guarantees exist for clinical and administrative workloads?
• Access control: who at the provider can technically reach hosted health data, and under what process?
• Auditability: what records exist of provider-side access?
• Institutional exit strategies: can an agency or hospital realistically migrate if governance fails?

At Oracle AI World 2026, Larry Ellison described Oracle Health's intended capabilities. The founder-supplied presentation transcript is used here as a primary company-statement source. The described capabilities include:

• Cross-hospital electronic health records.
• AI-mediated clinical interfaces.
• Home and wearable monitoring.
• Connected ambulances and emergency departments.
• Hospital operations and digital twins.
• AI-assisted diagnostics.
• Prior authorization.
• Clinical-trial coordination.
• Biometric authentication.
• Aggregated public-health intelligence.
• Integration with existing EHR systems using healthcare interoperability standards.

If delivered as described, these capabilities carry potentially substantial benefits for patient care and medical research: fewer repeated tests, faster diagnosis, continuity of care across institutions, and research datasets that respect interoperability standards rather than proprietary walls.

In the supplied source, they remain product ambitions and demonstrations. This investigation distinguishes stated ambitions from verified operational deployments, and does not assert that Oracle already possesses the medical records of every American.

In June 2026, the U.S. Office of Personnel Management announced a contract with Oracle for federal workforce modernization, reported at $395.8 million, to replace more than 100 separate personnel systems.

The anticipated platform's role spans federal HR administration, personnel records, workforce analytics, payroll interfaces, and retirement and benefits systems.

This investigation does not claim that Oracle Health and Oracle's federal workforce platform share individual records. They are separate systems in separate domains.

Their relevance here is institutional, not technical: the same company now operates major infrastructure in two sensitive domains at once — American healthcare records and federal workforce data. Institutional convergence of that kind changes the scale of any future governance question, even where no data flows between the systems today.

Federal executive orders established DOGE-associated modernization and directed agencies to reduce information silos across government.

Investigative reporting has described DOGE-associated work involving Palantir and the integration of IRS data. Those accounts are attributed journalism, presented as reporting rather than established fact.

Five categories are often conflated in public discussion. They are not interchangeable:

1. Authorized modernization.
2. Technical interoperability.
3. Cross-agency access.
4. Lawful secondary use.
5. Unlawful disclosure or surveillance.

No claim in this investigation suggests that DOGE accessed Google Health users' medical records; no supplied evidence establishes any such access.

Concentration of access privileges matters even where databases remain physically separate. If a small number of operators hold standing authority to query many systems, the practical structure of access resembles integration even when the storage architecture does not. Governance must track who can ask questions across systems — not merely where the rows sit.

The Department of Homeland Security's Cumulus procurement initiative seeks consolidated cloud capacity for departmental workloads.

In June 2026, AWS received an award under Cumulus with an approximately $2.6 billion ceiling. FedScoop reported that the initiative anticipated additional providers, including Google Cloud, Oracle, and Microsoft.

As elsewhere in this investigation, contract awards, possible future spending, actual deployments, and specific information-access permissions are separate facts. An award ceiling describes budget authority; it does not describe what was built, what was migrated, or who can see what.

Using the same commercial vendor across agencies does not, by itself, allow healthcare and homeland-security agencies to access each other's data — and nothing in the supplied evidence suggests otherwise. The structural question is whether access governance keeps pace as workloads concentrate.

The systems examined in this investigation are legally and technically distinct. But connection no longer requires consolidation. Five layers describe how information becomes computationally connected without ever sitting in a single database:

1. Layer 1 — Individual information: medical records, wearables, biometrics, behavior, administrative identity.
2. Layer 2 — Data infrastructure: cloud hosting, databases, application systems, APIs.
3. Layer 3 — Computational intelligence: analytics, inference, predictive models, AI agents.
4. Layer 4 — Institutional operations: hospitals, insurers, employers, research bodies, government agencies.
5. Layer 5 — Authority and accountability: consent, contracts, laws, judicial oversight, audit rights, public governance.

Any honest diagram must visually distinguish documented vendor partnerships, separately documented deployments, technical possibilities, and unverified transfers. A single uninterrupted pipeline drawn from Google Health through Palantir to federal systems would assert a connection the evidence does not establish — so none is drawn here.

The Computational Biological Self is a proposed DSC analytical concept: the computational representation of a person derived from biological, medical, physiological, and health-behavior data — including inferred characteristics and predictive assessments the person never stated and may not know.

It extends concepts established across this series:

• Computational Identity — the data construct that stands in for a person in automated systems.
• The Inferred Self — the profile built from behavior rather than disclosure.
• Inference Sovereignty — who may draw conclusions about a person, and on what basis.
• Computational Self-Determination — the individual's authority over the computational version of themselves.
• Singularity of Control — the concentration of interpretive power in few hands.
• The Convergence Threshold — the point at which interconnected systems become institutionally consequential.

Derived health intelligence can carry consequences far beyond the original medical or wellness purpose: employment screening, insurance pricing, credit, immigration proceedings, and public-facing identity judgments.

The vulnerability is not evenly distributed. Children cannot meaningfully consent to lifetime inference. Elderly people may depend on exactly the monitoring systems that generate the data. Disabled people and underserved communities already face documented disparities in clinical interpretation — and computational inference can inherit and industrialize those disparities.

Discriminatory outcomes, medical profiling, and exclusion are risks that require safeguards. They are not presumed outcomes of every AI health system — and the distinction between risk and established conduct is maintained throughout this investigation.

Health intelligence sits inside a layered legal framework, each layer with different reach:

• HIPAA protections and their limits — HIPAA governs covered entities and their business associates, not every health-related data stream.
• The Privacy Act and applicable federal data governance.
• State medical privacy requirements, which vary by jurisdiction.
• The Fourth Amendment, where government searches or acquisitions implicate constitutional protections.
• Purpose limitation — whether data collected for treatment may serve unrelated institutional aims.
• Consent and secondary use.
• Re-identification risks in aggregated or de-identified datasets.
• Algorithmic accountability for consequential automated conclusions.
• Due process and contestability when inferences affect rights or benefits.
• Employment and insurance discrimination.
• Vendor oversight across the contractual chain.

Two cautions bound this section. HIPAA does not govern every health-related data stream — consumer wellness data, for example, often falls outside it. And a private-sector data use does not independently constitute a Fourth Amendment violation; constitutional constraints attach to government action and its agents.

The legal requirements described above are existing law. DSC's proposed reforms are presented separately, as proposals, in the next section.

Digital Sovereignty Coalition proposes the following safeguards, as principles for legislation, procurement, and institutional policy:

1. Meaningful, revocable consent, subject to legitimate legal retention obligations.
2. Prohibitions on unauthorized secondary uses.
3. Access to personal information and to the consequential inferences derived from it.
4. Rights to correct inaccurate information and to challenge significant automated conclusions.
5. Independent algorithmic and cybersecurity audits.
6. Enforceable institutional separation between health data and unrelated government or commercial functions.
7. Transparent government procurement and vendor contracts.
8. Data portability and practical vendor exit options.
9. Appropriate restrictions on biometric collection and retention.
10. Public-interest alternatives and independent oversight.

These principles connect to the Right to Civic AI and DSC's broader proposal for public-interest computational infrastructure: the individual's rights must not depend entirely on the goodwill of whichever corporation currently operates the infrastructure.

Civic Machina is a proposed civic technology response — a design direction, not an operational medical-record platform. Nothing in this investigation represents an existing DSC product or partnership.

Our medical information can help save lives. Artificial intelligence can advance diagnosis, treatment, research, and public-health coordination.

But the ability to generate, combine, and interpret biological information must not become an unchecked claim of authority over the people represented by that information.

The question is not whether healthcare should benefit from advanced technology. It is whether the rights of individuals will remain enforceable as the systems surrounding their bodies become more powerful, interconnected, and institutionally consequential.

The ability to connect data does not confer the right to connect it.

Every consequential claim in this investigation carries one of five labels. The labels distinguish what a document establishes, what reporting attributes, what a company asserts, and what remains unresolved:

• DOCUMENTED — Supported by an accessible primary document or reliable corroborated reporting.
• REPORTED — Attributed to journalism, with sources and dates.
• COMPANY STATEMENT — A product claim, announcement, or institutional response.
• INVESTIGATIVE QUESTION — A matter requiring additional evidence.
• HYPOTHETICAL RISK — A potential consequence, not an allegation of established conduct.

Award ceilings are distinguished from expenditures throughout. Vendor capabilities are identified as vendor claims. Independent reporting is attributed to its outlet and date. Institutional responses and denials are included where they exist.

This investigation deliberately contains no allegation registry, accusations dashboard, or interface suggesting that individuals or companies have committed violations without documented evidence. Unresolved matters remain marked as requiring further verification. Claims concerning data misuse, unlawful access, immigration enforcement, or constitutional violations are flagged for founder and legal review before any publication decision.

CONSTITUTION BEFORE CAPABILITY.