London's Royal Free hospital broke data protection laws when a deal was signed with Google's DeepMind to hand over 1.6million patient records, according to the Information Commissioner's Office.
As a result, the partnership created a healthcare app called Streams, which is a detection system for acute kidney injury. Patients were not made aware that their data was being used to test the app as the investigation found "a number of shortcomings" in the deal.
Elizabeth Denham, the information commissioner, said that the Trust "could and should have been far more transparent with patients as to what was happening."
However, the Trust and DeepMind have been allowed to continue in their development of the app and have welcomed a co-operative solution.
In a statement, the hospital commented: "This app is helping us to get the fastest treatment to our most vulnerable patients - potentially saving lives - so we are pleased the information commissioner has allowed us to continue using the app."
"We accept the ICO’s findings and have already made good progress to address the areas where they have concerns.
"We will also be keeping our patients informed about how their data is used and would like to reassure them that their information has been in our control at all times."
DeepMind has escaped criticism from the ICO as the Trust was viewed as the "data controller" whilst Google's AI company was merely seen as a processor. Therefore, the responsibility of data protection fell to the hospital.
The London-based firm did comment on a "thoughtful resolution" in a blog post and admitted that they needed to "reflect on [DeepMind's] own actions, as we underestimated the complexity of the NHS and the rules around patient data."
"We got that wrong. We need to do better."
Streams is an instant messaging app that is used to help detect warning signs of diseases like sepsis when a doctor or nurse can't get to the patient in time.
The app reviews test results before sending any information that may be needed to a clinician so they can make an immediate diagnosis.