5 ms·

I’m glad to see this getting more attention as it seems scary to me as a private citizen who wants my medical data to stay private. I’m not sure how to defend

I’m glad to see this getting more attention as it seems scary to me as a private citizen who wants my medical data to stay private. I’m not sure how to defend against this as it seems based on HIPAA and what it allows. Since de-identified data can be legally sold, I think it will. The theoretical defense I’ve thought up is a class action lawsuit for synthetic breaches. Since these data are deemed de-identified by expert determination [0] and that’s hazy, if I could reidentify myself after de-id, and I didn’t authorize it, then I could be eligible for breach damages for HIPAA violations up to $50k per person [1]. Since these sets have millions of people, likely everyone in the country. And since expert determination can possibly classify an acceptable re-id risk as less than 1%, this could be a million or two people. So a big enough pool to attract big legal investments. That would increase the cost and risk of doing this to outweigh the benefits. But currently it’s “free money” for any healthcare system that’s kind of impossible for me as a patient to opt out. [0] https://www.hhs.gov/hipaa/for-professionals/privacy/special-topics/de-identification/index.html https://www.hhs.gov/hipaa/for-professionals/privacy/special-... [1] https://www.injuryclaimcoach.com/hipaa-violations.html https://www.injuryclaimcoach.com/hipaa-violations.html

aabaker99 5y ago
I like your idea of a class action lawsuit but wouldn't the $50k per person penalty shift your idea of what an organization would consider an acceptable risk? 1 million * $50,000 is probably not acceptable. I hope for all our sakes you are in the business of buying de-identified medical data :)
- prepend 5y ago
  I think this has the potential for the next asbestos or tobacco or opioid payouts. I definitely wouldn’t want to work in this area (both for ethical and business model at risk for sued out of existence).
notafraudster 5y ago
HIPAA has no private cause of action (you can't sue providers who violate your rights under HIPAA). The government can fine them, so from a provider POV they are liable for the breach you propose, but you are not eligible for recovering the $50k. You may or may not have a private civil tort against the medical provider, separately from HIPAA.
- prepend 5y ago
  Good point, the fines are by HHS and not dollar amounts to victims. I gave the amounts to signify the importance and IANAL would be part of a basis for establishing harm done. I specifically linked to an injury lawyer to show the types of current HIPAA violation civil suits that have succeeded. My reasoning is that it’s lucrative enough for lawyers to solicit business.
- analog31 5y ago
  People talk about the US being lawsuit-happy, but here's an example where the tort system could work to encourage the enforcement of a law if the government doesn't want to enforce it.
  - Teever 5y ago
    As a non-American I am always fascinated by the hacks and kludges that people propose to mitigate the inherent dysfunction that is the US medical system. I consider intentional breaches of medical privacy to be in the same league as physical assault and as such would expect a society to respond to these kinds of crimes with swift and severe punishments including jail time and fines. Why not just arrest these people and take the profits from their crime instead of adding civil lawyers and bureaucracy to the mix?
    - ska 5y ago
      >and as such would expect a society to respond to these kinds of crimes with swift and severe punishments including jail time and fines. Can you point to any country with a law on the books like this?
      - dreamcompiler 5y ago
        The USA. HIPAA states that willful or malicious disclosures of identifiable health information with intent to sell for personal gain have penalties of up to 10 years in prison [0]. But of course that's not what TFA was about. [0] https://inspiredelearning.com/blog/hipaa-101-guide-violations-penalties/ https://inspiredelearning.com/blog/hipaa-101-guide-violation...
throwaway894345 5y ago
As far as data privacy goes, I will say that the sale of health data has some pretty significant upsides--specifically medical research. There's probably a better way to get the best of both worlds, but I would hate for us to just pull the rug out from under medical research without a satisfactory backfill. Disclaimer: I work for a company that uses this data to match terminally ill patients with niche treatments and clinical trials, and the work literally saves and prolongs lives.
- captainoats 5y ago
  The article mentions the dispute over wether or not anonymized medical record data really has enough of a signal for meaningful research use cases. That has to be weighed against the privacy concern.
  - throwaway894345 5y ago
    Agreed. To be even more explicit, I'm not saying "do not weigh the research concern against the privacy concern".
- not_jd_salinger 5y ago
  > I work for a company that uses this data to match terminally ill patients with niche treatments and clinical trials, and the work literally saves and prolongs lives. Talked with a company that made similar claims about what they are doing, but it turns out they were really ensuring that their users where choosing the medication from the highest bidder rather than the one that was really in the the patient's best interests. The mental gymnastics they did to justify they were doing what was in the patient's best interests was fun to observe, but in the end they were just a tool of a large pharmaceutical company, exploiting sick people for profit. Quick cynicism sanity check: who pays your company, your users or the "niche" treatment provider? If it's the former, that sounds like it's good work. If it's the latter I would recommend being a bit more skeptical of the business motives of your employer and their customers.
  - throwaway894345 5y ago
giantg2 5y ago
Ta-da https://www.nytimes.com/2019/07/23/health/data-privacy-protection.html https://www.nytimes.com/2019/07/23/health/data-privacy-prote...
Abishek_Muthian 5y ago
I don't think provisions like HIPAA alone cannot prevent abuse of medical data, Say a free medical-consultation app along with health tracker from a health insurance provider can provide data to the health insurer which can further be used in a flawed algorithm to increase premium or worse cancel the policy when it's most needed. Conflict of interest regulations should be applied for data, If my data can be used to cause harm to me then you shouldn't have it that's all.
hamburglar1 5y ago
"Since these data are deemed de-identified by expert determination [0] and that’s hazy, if I could reidentify myself after de-id, and I didn’t authorize it, then I could be eligible for breach damages for HIPAA violations up to $50k per person" The Expert Determination data would likely be released to you with an agreement that you would not attempt to re-identify the data. So if you then attempted to re-identify the data, even yourself, you would be breaking the terms of the license and I would think liable to civil action from the entity that gave you the data (and their upstreams). I don't think you would win here.

aabaker99 5y ago

I like your idea of a class action lawsuit but wouldn't the $50k per person penalty shift your idea of what an organization would consider an acceptable risk? 1 million * $50,000 is probably not acceptable. I hope for all our sakes you are in the business of buying de-identified medical data :)

prepend 5y ago
I think this has the potential for the next asbestos or tobacco or opioid payouts. I definitely wouldn’t want to work in this area (both for ethical and business model at risk for sued out of existence).

notafraudster 5y ago

HIPAA has no private cause of action (you can't sue providers who violate your rights under HIPAA). The government can fine them, so from a provider POV they are liable for the breach you propose, but you are not eligible for recovering the $50k. You may or may not have a private civil tort against the medical provider, separately from HIPAA.

prepend 5y ago
Good point, the fines are by HHS and not dollar amounts to victims. I gave the amounts to signify the importance and IANAL would be part of a basis for establishing harm done. I specifically linked to an injury lawyer to show the types of current HIPAA violation civil suits that have succeeded. My reasoning is that it’s lucrative enough for lawyers to solicit business.
analog31 5y ago
People talk about the US being lawsuit-happy, but here's an example where the tort system could work to encourage the enforcement of a law if the government doesn't want to enforce it.
- Teever 5y ago
  As a non-American I am always fascinated by the hacks and kludges that people propose to mitigate the inherent dysfunction that is the US medical system. I consider intentional breaches of medical privacy to be in the same league as physical assault and as such would expect a society to respond to these kinds of crimes with swift and severe punishments including jail time and fines. Why not just arrest these people and take the profits from their crime instead of adding civil lawyers and bureaucracy to the mix?
  - ska 5y ago
    >and as such would expect a society to respond to these kinds of crimes with swift and severe punishments including jail time and fines. Can you point to any country with a law on the books like this?
    - dreamcompiler 5y ago
      The USA. HIPAA states that willful or malicious disclosures of identifiable health information with intent to sell for personal gain have penalties of up to 10 years in prison [0]. But of course that's not what TFA was about. [0] https://inspiredelearning.com/blog/hipaa-101-guide-violations-penalties/ https://inspiredelearning.com/blog/hipaa-101-guide-violation...

throwaway894345 5y ago

As far as data privacy goes, I will say that the sale of health data has some pretty significant upsides--specifically medical research. There's probably a better way to get the best of both worlds, but I would hate for us to just pull the rug out from under medical research without a satisfactory backfill. Disclaimer: I work for a company that uses this data to match terminally ill patients with niche treatments and clinical trials, and the work literally saves and prolongs lives.

captainoats 5y ago
The article mentions the dispute over wether or not anonymized medical record data really has enough of a signal for meaningful research use cases. That has to be weighed against the privacy concern.
- throwaway894345 5y ago
  Agreed. To be even more explicit, I'm not saying "do not weigh the research concern against the privacy concern".
not_jd_salinger 5y ago
> I work for a company that uses this data to match terminally ill patients with niche treatments and clinical trials, and the work literally saves and prolongs lives. Talked with a company that made similar claims about what they are doing, but it turns out they were really ensuring that their users where choosing the medication from the highest bidder rather than the one that was really in the the patient's best interests. The mental gymnastics they did to justify they were doing what was in the patient's best interests was fun to observe, but in the end they were just a tool of a large pharmaceutical company, exploiting sick people for profit. Quick cynicism sanity check: who pays your company, your users or the "niche" treatment provider? If it's the former, that sounds like it's good work. If it's the latter I would recommend being a bit more skeptical of the business motives of your employer and their customers.
- throwaway894345 5y ago

giantg2 5y ago

Ta-da https://www.nytimes.com/2019/07/23/health/data-privacy-protection.html https://www.nytimes.com/2019/07/23/health/data-privacy-prote...

Abishek_Muthian 5y ago

I don't think provisions like HIPAA alone cannot prevent abuse of medical data, Say a free medical-consultation app along with health tracker from a health insurance provider can provide data to the health insurer which can further be used in a flawed algorithm to increase premium or worse cancel the policy when it's most needed. Conflict of interest regulations should be applied for data, If my data can be used to cause harm to me then you shouldn't have it that's all.

hamburglar1 5y ago

"Since these data are deemed de-identified by expert determination [0] and that’s hazy, if I could reidentify myself after de-id, and I didn’t authorize it, then I could be eligible for breach damages for HIPAA violations up to $50k per person" The Expert Determination data would likely be released to you with an agreement that you would not attempt to re-identify the data. So if you then attempted to re-identify the data, even yourself, you would be breaking the terms of the license and I would think liable to civil action from the entity that gave you the data (and their upstreams). I don't think you would win here.