3 ms·

> NHS users just need to accept that their data is going be fed into models That's fine so long as it goes nowhere else - it's perfectly reasonable for the NHS

> NHS users just need to accept that their data is going be fed into models That's fine so long as it goes nowhere else - it's perfectly reasonable for the NHS to have AI models to do their thing, just as the Met Office and others do. Remember years ago Google had a Search Appliance? A rack mount server to put in your business. The NHS should be doing the same with IBM, Deepmind and other models - figure a way to licence and use the technology without sharing any data back whatsoever. Data for training, helping IBM et al building better models should be 120 years old or more - guaranteed not to contain anyone alive. The restrictions on medical privacy are there for very good reasons, though I tend to the view they don't go nearly far enough for the modern world.

bpfrh 7y ago
Some things are genetic, so even if it is the data of your parents, it will still influence you. Only way is to completly anonymize data, which is way harder than it sounds.
- OnlineGladiator 7y ago
  > Only way is to completly anonymize data, which is way harder than it sounds. What's complicated about it? So long as it's not attached to a name, social security number, or some other personally identifiable marker - how would anybody know it's you? You're just an anonymous collection of data points. I understand whatever fingerprint they use for your data is almost definitely completely unique, but that doesn't mean it can be associated with the corresponding person unless you allow that to happen. I mean I get that it's obviously not trivial from a security perspective, but what's the main blockade here?
  - NeedMoreTea 7y ago
    For most people in the last 10 or 15 years, search and Wikipedia very often (probably almost always barring casualty treatment) presages what they later go to their doctor about. What's complicated is Google and others are extreme data hoarders. Google can get the anonymous health records and run a fuzzy match of model records against Home, URL and gmail records. Find high confidence correlations against multiple conditions across the years, where the search preceded new medical entries for those conditions within x time. Now they're in this data set for condition y and oh lookie, they searched condition y related topics multiple times last year. Anonymous record i1389541 is Alice Smith of Wimbledon, set her adwords flags to condition y snake oil, sell record to UK life insurance consortium. [repeat]. No personal data was released, but you're fully de-anonymised. With enough data and history it becomes absurdly easy to decloak the majority with high or complete confidence. Welcome to the future. The alternative is find a way to prevent those uniquely identifying correlations at any point in the future, using techniques we haven't yet thought of. Which is probably impossible without diverging the anonymous medical record some considerable distance from reality. Faked enough to remain anonymous might not be helpful for research into a condition or its diagnosis...
    - OnlineGladiator 7y ago
      The obvious solution to this problem, assuming it is as pervasive as you describe (I feel you are slightly exaggerating, but it's really not the important part), is to regulate the data hoarders. That said, that's completely different from what I implied in my original comment, so point taken.
      - NeedMoreTea 7y ago
        Sure regulation is the solution, and I think a very slow journey to regulation has started. Whether it will come soon enough or be adequate are open to question. We've known Google and FB have engaged in systematic overreach every single time there is data for the taking. From streetview harvesting WiFi, or taking photos over privacy fences through systemic use of dark patterns. If I'm exaggerating it's from trying to make up a credible example off the cuff. When the Snowden revelations were coming thick and fast I remember several examples coming up around search stream and meta-data. Mostly terrifying as either could reveal in far more detail than actual content of messages what you appeared to be thinking in the moment. Tie that with medical and health data and any pretence of privacy falls.
      - solstice 7y ago
        Force them to use old-school floppy disks to store and transmit records (you know, for backwards compatibility). That should be a good incentive to minimize data hoarding. /s
  - bostik 7y ago
    There was a good talk[0] on latest London CryptoDays. There were many talks about applications and attacks on differential privacy, but this one was quite remarkable in highlighting just how hard it is to remain anomymous against good traffic analysis. The key insight[ß] was that privacy researchers are essentially rediscovering the information-theoretical deanonymisation attacks that have been known to advanced marketing departments for the past two decades. 0: Evgenios Kornaropoulos, UC Berkeley: "Attacks on Encrypted Databases Beyond the Uniform Query Distribution" ß: anyone present at the last talk should recognise the term used.
avh02 7y ago
being fed anonymized vs with full details is where I'd draw a line

bpfrh 7y ago

Some things are genetic, so even if it is the data of your parents, it will still influence you. Only way is to completly anonymize data, which is way harder than it sounds.

OnlineGladiator 7y ago
> Only way is to completly anonymize data, which is way harder than it sounds. What's complicated about it? So long as it's not attached to a name, social security number, or some other personally identifiable marker - how would anybody know it's you? You're just an anonymous collection of data points. I understand whatever fingerprint they use for your data is almost definitely completely unique, but that doesn't mean it can be associated with the corresponding person unless you allow that to happen. I mean I get that it's obviously not trivial from a security perspective, but what's the main blockade here?
- NeedMoreTea 7y ago
  For most people in the last 10 or 15 years, search and Wikipedia very often (probably almost always barring casualty treatment) presages what they later go to their doctor about. What's complicated is Google and others are extreme data hoarders. Google can get the anonymous health records and run a fuzzy match of model records against Home, URL and gmail records. Find high confidence correlations against multiple conditions across the years, where the search preceded new medical entries for those conditions within x time. Now they're in this data set for condition y and oh lookie, they searched condition y related topics multiple times last year. Anonymous record i1389541 is Alice Smith of Wimbledon, set her adwords flags to condition y snake oil, sell record to UK life insurance consortium. [repeat]. No personal data was released, but you're fully de-anonymised. With enough data and history it becomes absurdly easy to decloak the majority with high or complete confidence. Welcome to the future. The alternative is find a way to prevent those uniquely identifying correlations at any point in the future, using techniques we haven't yet thought of. Which is probably impossible without diverging the anonymous medical record some considerable distance from reality. Faked enough to remain anonymous might not be helpful for research into a condition or its diagnosis...
  - OnlineGladiator 7y ago
    The obvious solution to this problem, assuming it is as pervasive as you describe (I feel you are slightly exaggerating, but it's really not the important part), is to regulate the data hoarders. That said, that's completely different from what I implied in my original comment, so point taken.
    - NeedMoreTea 7y ago
      Sure regulation is the solution, and I think a very slow journey to regulation has started. Whether it will come soon enough or be adequate are open to question. We've known Google and FB have engaged in systematic overreach every single time there is data for the taking. From streetview harvesting WiFi, or taking photos over privacy fences through systemic use of dark patterns. If I'm exaggerating it's from trying to make up a credible example off the cuff. When the Snowden revelations were coming thick and fast I remember several examples coming up around search stream and meta-data. Mostly terrifying as either could reveal in far more detail than actual content of messages what you appeared to be thinking in the moment. Tie that with medical and health data and any pretence of privacy falls.
    - solstice 7y ago
      Force them to use old-school floppy disks to store and transmit records (you know, for backwards compatibility). That should be a good incentive to minimize data hoarding. /s
- bostik 7y ago
  There was a good talk[0] on latest London CryptoDays. There were many talks about applications and attacks on differential privacy, but this one was quite remarkable in highlighting just how hard it is to remain anomymous against good traffic analysis. The key insight[ß] was that privacy researchers are essentially rediscovering the information-theoretical deanonymisation attacks that have been known to advanced marketing departments for the past two decades. 0: Evgenios Kornaropoulos, UC Berkeley: "Attacks on Encrypted Databases Beyond the Uniform Query Distribution" ß: anyone present at the last talk should recognise the term used.

avh02 7y ago

being fed anonymized vs with full details is where I'd draw a line