The Wall Street Journal is reporting that a secret Google program is collecting health data on millions of Americans—without patients or doctors knowing about it.

The program, dubbed “Project Nightingale,” began last year with “St. Louis-based Ascension, a Catholic chain of 2,600 hospitals, doctors’ offices and other facilities.” The partnership provides Google with information for patients in 21 different states.

The collected data includes “lab results, doctor diagnoses and hospitalization records, among other categories, and amounts to a complete health history, including patient names and dates of birth.”

Google is evidently using the data to design machine learning and AI-based software to help tailor patients’ treatment, recommending specific changes based on their history. Underscoring the focus the company is placing on this, some Google Brain employees are among those who have access. Google Brain is a research science division that has been responsible from some of the company’s most important breakthroughs.

Surprisingly, despite the volume and depth of data being collected, privacy experts say it’s likely legal. The Health Insurance Portability and Accountability Act of 1996 gives hospitals the right to share data with their business partners, so long as the data is “only to help the covered entity carry out its health care functions.” The law also allows hospitals to share the data without telling patients.

Following the WSJ’s report on the program, Google and Ascension issued press releases stating that the program falls within federal guidelines and includes robust data protections. The fact that both companies issued press releases, however, may indicate they fear potential backlash in a climate where consumers are more concerned than ever with their privacy.