Google secretly gathered millions of patient records across 21 states on behalf of a health care provider, in an effort dubbed “Project Nightingale,” reports The Wall Street Journal. Neither the provider’s doctors nor patients were made aware of the effort, according to the report.

The Wall Street Journal’s Rob Copeland wrote that the data amassed in the program includes “lab results, doctor diagnoses and hospitalization records, among other categories, and amounts to a complete health history, complete with patient names and dates of birth,” and that as many as 150 Google employees may have had access to the data.

The New York Times corroborated much of the report later in the day, writing that “dozens of Google employees” may have access to sensitive patient data, and that there are concerns that some Google employees may have downloaded some of that data.

But Google tells The Verge that despite the surprise, it’s standard industry practice for a health care provider to share highly sensitive health records with tech workers under an agreement like the kind it signed — one that narrowly allows Google to build tools for that health care provider by using the private medical data of its patients, and one that doesn’t require patients to be notified, the company claims.

A spokesperson challenged the idea that Google has been secretly gathering the health records of millions of Americans, saying the only purpose of such an agreement is to provide services back to the health care provider, and that it didn’t announce it was doing so earlier because work was in the very early stages.

Google has confirmed that it partnered with health heavyweight Ascension, a Catholic health care system based in St. Louis that operates across 21 states and the District of Columbia. The company calls itself “a faith-based healthcare organization dedicated to transformation through innovation across the continuum of care.” According to the WSJ, Google is using data from the system to design software that tailors individual patient care using “advanced artificial intelligence and machine learning.”

the data amassed in the program includes “lab results, doctor diagnoses and hospitalization records” according to the WSJ

Forbes reports that as a part of Project Nightingale, Ascension uploaded patient data to Google’s Cloud servers. The idea was that by using the system, Ascension health providers could use a tool called Patient Search to pull up individual patient pages. According to Forbes, which says it viewed a presentation on the topic, “The page includes complete patient information as well as notes about patient medical issues, test results and medications, including information from scanned documents.”

Google has been focused on health care for a while now, and their focus on the industry has only increased in recent years. Lately, it’s been competing with similar efforts at Amazon and Apple, which are also trying to move into the lucrative health care space. Last year, Google hired a health care executive to oversee its many health initiatives. Around the same time, they announced plans to absorb AI lab DeepMind’s health care division, with the goal of creating an “AI assistant for nurses and doctors.”

The tech company has also been accused of inappropriate access to hundreds of thousands of health care records through the University of Chicago Medical Center. Google had partnered with the University of Chicago Medical Center in 2017 to develop machine learning tools capable of “accurately predicting medical events — such as whether patients will be hospitalized, how long they will stay, and whether their health is deteriorating despite treatment for conditions such as urinary tract infections, pneumonia, or heart failure,” the company said in a blog post. The post also mentions that one of the company’s machine learning ambitions is to “anticipate the needs of the patients before they arise.”

A press release issued by Ascension today, after the WSJ article was published, announced their partnership with Google and said that the goal of the partnership was to “optimize the health and wellness of individuals and communities, and deliver a comprehensive portfolio of digital capabilities.” It also said that “All work related to Ascension’s engagement with Google is HIPAA compliant and underpinned by a robust data security and protection effort and adherence to Ascension’s strict requirements for data handling.”

Google also published a blog post later in the day confirming that “Nightingale” is the name of its health project. “To be clear: under this arrangement, Ascension’s data cannot be used for any other purpose than for providing these services we’re offering under the agreement, and patient data cannot and will not be combined with any Google consumer data,” writes Google Cloud president Tariq Shaukat.

Update November 11th, 11:40PM ET: This post has been updated with additional details from Ascension’s press release, as well as from a Forbes article, a New York Times report, Google’s blog post, and finally clarifications from Google itself.