On the heels of news that Google has partnered with Ascension to collect data on millions of American patients, CBS News is reporting that government officials are opening an inquiry into the deal.

Ascension is the second largest chain of hospitals and healthcare facilities in the U.S. The program, “Project Nightingale,” which began last year, provides Google with detailed information on patients in 21 states, including names, dates of birth, lab results, diagnoses, hospitalization records and more. Together, the information gives Google a patient’s complete health record. Google is using the information to design AI-based tools to assist in patient diagnostics.

Despite the fact the agreement is likely legal under the Health Insurance Portability and Accountability Act of 1996, Google is facing backlash in the wake of reports on the project. Even Jim Cramer, co-founder of TheStreet.com, questioned the wisdom of Google’s actions, saying the company “did things we regard as being unauthorized by some, so therefore a U.S. Attorney or someone is going to look into it….The country is hyper-sensitive to what Google does and Facebook does. So why aren’t they a little more thoughtful?”

Google’s own reaction to the backlash has done little to improve the situation, with a cloud executive penning the initial blog responding to the story, rather than any of the health-care professionals on the company’s payroll. In addition, as CNBC reports, Google’s secrecy and use of cryptic code-names only adds fuel to the flames of suspicion that the company is up to something underhanded. As a result, the Department of Health and Human Services is launching an inquiry into Project Nightingale.

Whatever the outcome, there can be no denying that Project Nightingale represents another privacy misstep for Google, right as the company is trying to expand into other privacy-sensitive industries and markets.