4 ms·

I'm not sure how I feel about Senior House overall, but the misuse of the survey data enraged me. We have such a hard time getting people at MIT to seek help fo

I'm not sure how I feel about Senior House overall, but the misuse of the survey data enraged me. We have such a hard time getting people at MIT to seek help for mental health issues and stupid bullshit like this is exactly why. People should not he punished for trying to seek help, health data should never be shared with people who are not health care professionals, and it's astoundingly unethical to use people's health care data or metadata to run studies without their explicit consent.

mhalle 9y ago
Completely agree, and it puts this aspect of the case into an interesting legal realm. There is certainly a question of misuse of protected health information, which can be treated quite harshly by the US government, especially when involving potentially vulnerable populations. I don't know if this question has been investigated.
- jameskegel 9y ago
  > I don't know if this question has been investigated. One should hope that this will be thoroughly investigated, lest we set precedent on an issue that leads to so many worrisome open doors for abuse in the future. These are not medical professionals bound by an oath and consequences; this feels like where I draw the line.
- ballenf 9y ago
  Edited to add: http://fdsal.com/doc/ http://fdsal.com/doc/ From that link, it seems there's evidence MIT did not actually anonymize the data -- i.e., used non-aggregated data and violated explicit guarantees of anonymity, so my analysis below seems irrelevant. --- Data aggregation / anonymization and the ease of de-aggregating reveals a major loophole in current US health privacy regulation (HIPAA). Once aggregated, personal health information (PHI) loses most protection. So, here if the mental health team aggregated the data, that is 'ok'. Then sharing that aggregated data with administrators is also 'ok' because it's no longer PHI. The exception would be if the disclosures of the mental health department to its patients prohibited this use of the data. I don't see a crime here, other than moral. Anecdote: I have sat across the table from a health data purveyor whose entire business model is buying aggregated data from multiple sources, de-anonymizing and monetizing it (for ad-based stuff and risk-scoring for life insurance and key man insurance provider type customers). That was a few years ago and I believe there has been some guidance that would make that business model much more difficult today if it was ever legal. We didn't get past the discussion phase based on that model's risk to our patient-centric model. I'm a lawyer in healthcare turned dev, but readily admit not to be a health law expert. Most of my work was corporate and transactional, so please take my opinion above with a healthy dose of salt. And if I'm wrong or have woefully outdated info, please correct!

mhalle 9y ago

Completely agree, and it puts this aspect of the case into an interesting legal realm. There is certainly a question of misuse of protected health information, which can be treated quite harshly by the US government, especially when involving potentially vulnerable populations. I don't know if this question has been investigated.

jameskegel 9y ago
> I don't know if this question has been investigated. One should hope that this will be thoroughly investigated, lest we set precedent on an issue that leads to so many worrisome open doors for abuse in the future. These are not medical professionals bound by an oath and consequences; this feels like where I draw the line.
ballenf 9y ago
Edited to add: http://fdsal.com/doc/ http://fdsal.com/doc/ From that link, it seems there's evidence MIT did not actually anonymize the data -- i.e., used non-aggregated data and violated explicit guarantees of anonymity, so my analysis below seems irrelevant. --- Data aggregation / anonymization and the ease of de-aggregating reveals a major loophole in current US health privacy regulation (HIPAA). Once aggregated, personal health information (PHI) loses most protection. So, here if the mental health team aggregated the data, that is 'ok'. Then sharing that aggregated data with administrators is also 'ok' because it's no longer PHI. The exception would be if the disclosures of the mental health department to its patients prohibited this use of the data. I don't see a crime here, other than moral. Anecdote: I have sat across the table from a health data purveyor whose entire business model is buying aggregated data from multiple sources, de-anonymizing and monetizing it (for ad-based stuff and risk-scoring for life insurance and key man insurance provider type customers). That was a few years ago and I believe there has been some guidance that would make that business model much more difficult today if it was ever legal. We didn't get past the discussion phase based on that model's risk to our patient-centric model. I'm a lawyer in healthcare turned dev, but readily admit not to be a health law expert. Most of my work was corporate and transactional, so please take my opinion above with a healthy dose of salt. And if I'm wrong or have woefully outdated info, please correct!