4 ms·
> We have to be very, very positive that our deidentification process is thorough and accurate to prevent a HIPAA violation from occurring If your model is any
by missosoup 7y ago
> We have to be very, very positive that our deidentification process is thorough and accurate to prevent a HIPAA violation from occurring
If your model is any more useful than something trained on coarse aggregates, then it can be used to reidentify individuals. This is a pretty hard dilemma in the entire industry, not just health.
I hope my observations are skewed, but instead of trying to seriously address this issue I've seen an entire legal-loophole style data laundering industry emerge where highly identifiable information changes hands without it 'technically' changing hands in the legal sense. I'm talking about entities like datarepublic.
- tedivm 7y agoIt really is a complicated topic, and one we spend a lot of time thinking about. We're using a peer reviewed method for removing PHI identifiers, and are combining that with an approach that involves using the least amount of data possible to get results. Our models will also never be released to the public, but instead will have an API where we can see abnormal behavior (such as sending lots of requests to try and tease out other information) and intervene.
- angry_octet 7y agoOther than easily controlled walled garden type accesses it is hard to limit with throttling. Is there a way to determine how much information about a particular individual has been leaked out?