The anonymous whistleblower has posted a video on the social media platform Daily Motion that contains a document dump of hundreds of images of confidential files relating to Project Nightingale. The secret scheme, first reported by the Wall Street Journal, involves the transfer to Google of healthcare data held by Ascension, the second-largest healthcare provider in the US. The data is being transferred with full personal details including name and medical history and can be accessed by Google staff. Unlike other similar efforts it has not been made anonymous though a process of removing personal information known as de-identification.

The whistleblower introduces the video with the words: “I must speak out about the things that are going on behind the scenes.”

The disclosed documents include highly confidential outlines of Project Nightingale, laying out the four stages or “pillars” of the secret project. By the time the transfer is completed next March, it will have passed the personal data of 50 million or more patients in 21 states to Google, with 10 million or so files already having moved across – with no warning having been given to patients or doctors.

Among the documents are the notes of a private meeting held by Ascension operatives involved in Project Nightingale. In it, they raise serious concerns about the way patients’ personal health information will be used by Google to build new artificial intelligence and other tools.

The notes say that one employee “expressed concerns of individuals downloading patient data – need to make sure everyone is trained to not be able to do that”.

According to the whistleblower, the security fears raised at that meeting, including concerns that the transfer may be in breach of federal HIPAA rules on data privacy, have so far gone unanswered by Google.

Project Nightingale is understood to be by far the largest data transfer of its kind so far in the healthcare field. It will cover the entire spread of Ascension, a Catholic network of 2,600 hospitals, clinics and other medical outlets.

Google has entered into similar partnerships on a much smaller scale with clients such as the Colorado Center for Personalized Medicine. But in that case all the data handed over to the search giant was encrypted, with keys being held only on the medical side.

The deal between Google and Ascension to go ahead with the data transfer was formally signed on Monday, hours after the Wall Street Journal broke the story.

The Guardian does not know the identity of the whistleblower. They are one of about 300 employees working on Project Nightingale, approximately half on the Google side and half with Ascension.

In an interview with the Guardian, they explained the decision to go public. They cited widespread anxiety among Project Nightingale employees about the secrecy of the transfer, and about how Google was being given access to personal information of millions of patients.

They had family members, they said, who have been through the health system and who were worried about even their body weight being shared with doctors. They would be alarmed to learn that their names, addresses, date of birth, medical conditions, lab records, hospitalization history and more might be included in the Project Nightingale data given to Google.

“Most Americans would feel uncomfortable if they knew their data was being haphazardly transferred to Google without proper safeguards and security in place. This is a totally new way of doing things. Do you want your most personal information transferred to Google? I think a lot of people would say no.”

The whistleblower also expressed concern that so much sensitive and potentially valuable data was being amassed by one big tech company. Google could go on to use its AI analytics to predict outcomes for individual patients, they posited.

“In the future, such risks are only likely to grow. This is the last frontier of extremely sensitive data that needs to be protected,” they said.

This is not the first time Google has ended up in hot water over its efforts to become the dominant player in healthcare data and analytics. In 2017, the transfer of 1.6m patient records at the Royal Free hospital in London to the company’s artificial intelligence arm DeepMind Health was found to have an “inappropriate legal basis” by the UK’s watchdog on data.

The ambition of Google’s parent company Alphabet is to develop new AI tools that can help predict health patterns and improve treatment. Google recently announced plans to buy Fitbit for $2.1bn, aiming to enter the wearables market and invest in digital health.

Google and Ascension have released statements in the wake of the disclosure of Project Nightingale, insisting it conforms with HIPAA and all federal health laws. They said that patient data was protected.

Google Cloud told the Wall Street Journal that the aim was “ultimately improving outcomes, reducing costs, and saving lives”.

In a statement, Ascension said: “All work related to Ascension’s engagement with Google is HIPAA compliant and underpinned by a robust data security and protection effort and adherence to Ascension’s strict requirements for data handling.”

In the video, the whistleblower begs to disagree. In annotations that run over the leaked documents, they suggest that in future Google might be able to sell or share the data with third parties, or create patient profiles against which they can advertise healthcare products.

“Patients haven’t been told how Ascension is using their data and have not consented to their data being transferred to the cloud or being used by Google. At the very least patients should be told and be able to opt in or opt out,” the whistleblower writes.