Google and Ascension, the second-largest health system in the U.S., have been collecting the personal health data of tens of millions of people in 21 states. Project Nightingale, the tech giant’s effort to enter healthcare, has culled lab results, diagnoses and hospitalization records, which include patient names and dates of birth. No doctor or patient has been notified, which has sparked a federal inquiry, but some experts say the initiative is permissible since Google is developing software to improve the healthcare system. Google explained that its partnership with Ascension is not a secret and was first announced in July during a Q2 earnings call.

The Wall Street Journal reports that Project Nightingale has been in place for a year, with “data sharing accelerating since summer.” Amazon, Apple and Microsoft are also targeting healthcare, but none have made the progress that Google has with Project Nightingale.

Although some Ascension employees have raised ethical questions, “privacy experts said it appeared to be permissible” under the Health Insurance Portability and Accountability Act of 1996, which lets hospitals share data without telling patients with business partners as long as it is used “only to help the covered entity carry out its health care functions.”

Ascension is a Catholic chain of 2,600 hospitals, doctor’s offices and other facilities.

Google is using the data to design new AI-enabled software that would make personalized suggestions for individual patients. About 150 Google staffers currently have access to the data, “including some employees of Google Brain, a research science division credited with some of the company’s biggest breakthroughs.”

Google “hopes to use the [Project Nightingale] framework to sell similar products to other health systems … [with an] end goal … to create an omnibus search tool to aggregate disparate patient data and host it all in one place.”

Google chief executive Sundar Pichai has repeatedly said that “finding new areas of growth for cloud is a priority,” and Project Nightingale “is being developed under Google’s cloud division.” Ascension’s goal is “a faster system than its existing decentralized electronic record-keeping network.”

In September, Google inked a 10-year deal with the Mayo Clinic “to store the hospital system’s genetic, medical and financial records.” In that case, however, “Mayo officials said … that any data used to develop new software would be stripped of any information that could identify individual patients before it is shared with the tech giant.”

Google’s earliest effort to digitize medical records, Google Health, “was shut down in 2011 after three years of limited adoption.” Since then, parent company Alphabet has “poured millions of dollars into its under-the-radar Calico and Verily divisions, which aim to combat aging and manage disease, respectively.”

After news of Project Nightingale broke this week, federal regulators announced they would be looking into the Google-Ascension partnership. The Department of Health and Human Services “will seek to learn more information about this mass collection of individuals’ medical records to ensure that HIPAA protections were fully implemented,” reports WSJ.

For a complete breakdown of Project Nightingale, including an updated Q&A section following the WSJ report, visit the Google Blog.