7 ms·

The judge here is being incredibly silly. They are ordering the FDA to perform medical grade redaction on 55,000 pages a month. These clinical trial documents

The judge here is being incredibly silly. They are ordering the FDA to perform medical grade redaction on 55,000 pages a month. These clinical trial documents are chock full of patient data and clinical notes.

bingohbangoh 5y ago
The pharmaceutical companies have had a gangbusters year and we're implementing vaccine passports in places like NYC on the basis of this data. I think they can hurry.
- Imnimo 5y ago
  These are FDA's documents, not Pfizer's. The pharma companies aren't the ones doing the redaction.
  - bingohbangoh 5y ago
    Ahhhh ok, was not aware, thanks! But my point on this being the subject of a vaccine mandate still holds.
prepend 5y ago
They should have been designed and planned with deidentification with the expectation that data would be released. If they are literally manually redacting patient data from pages and notes then that is a flaw in the study, I think. I would expect patient data to be pretty limited in the trial data since they are purposefully double blind. Notes are a different story, but I’m sure there are techniques that can be purchased for entity resolution that can automate the scrubbing for PHI and PII. Seems more like the FDA and Pfizer being silly than the judge.
- lalaland1125 5y ago
  > Notes are a different story, but I’m sure there are techniques that can be purchased for entity resolution that can automate the scrubbing for PHI and PII. You can't fully automate this because we require almost 100% accuracy. You need a manual review to ensure no data is leaked.
  - prepend 5y ago
    I’m not sure why you think we require 100% accuracy. The actual level depends on many factors. For example, the expert determination method of deidentification in hipaa safe harbor [0] can allow up to 1% reidentification and still be considered anonymized. This is how medical providers share notes without manually reviewing them all. [0] https://www.hhs.gov/hipaa/for-professionals/privacy/special-topics/de-identification/index.html https://www.hhs.gov/hipaa/for-professionals/privacy/special-...
- lesuorac 5y ago
  Would you not use trial data to determine if Pfizer's vaccine should be approved? The FOIA request was for all of the documentation used to approve the vaccine. > I’m sure there are techniques that can be purchased for entity resolution that can automate the scrubbing for PHI and PII. Sounds like a good way to have "anonymized" data that isn't actually anonymized like most datasets ...
  - prepend 5y ago
    That’s part of the downside of “anonymized” data as there’s not any clear legal definitions so it’s quite possible to identify some persons within anonymized data. I think this is a big problem when it comes to stuff like data brokering and selling. Less so with issues like this because vaccine data researchers are less likely to cause harm to someone than others who buy anonymized data.
- robbedpeter 5y ago
  >>If they are literally manually redacting... That's a feature, not a bug. Bureacracy is a game, and they are grandmasters.
- anigbrowl 5y ago
  To be fair they were in a bit of a rush, and opted to dump the problem on the bureaucrats rather than spend more time designing protocols. This isn't an example of wicked plotting, it's just an argument about who picks up the tab for a large redaction job.
  - prepend 5y ago
    I think it’s also a situation of someone not wanting to release so coming up with a bone headed way of reviewing for privacy.
tut-le-tut 5y ago
"At that rate, the 10 employees would have to work non-stop 24 hours a day, seven days a week to produce the 55,000 pages a month (and would still fall a bit short)." So 50 people on a normal (40 hour work week) could do this in a month. The FDA has 18 000 employees. I think the answer is clear.
sebow 5y ago
Standard procedure is being silly?
kansface 5y ago
There is currently a government mandate requiring most adults be vaccinated while at the same time, the government (another agency) is unwilling to publish the evidence it considered in favor of the emergency authorization and the concomitant decision making process until after everyone mandated to take it has died... because that's the way they have always done things?
- lalaland1125 5y ago
  The FDA already released the evidence it considered for the approval. It's available right on the FDA website: https://www.fda.gov/media/151733/download https://www.fda.gov/media/151733/download The plaintiffs in this case are asking for the clinical medical history of everyone in the clinical trials, which is a bit trickier to provide.
  - encryptluks2 5y ago
    If the evidence references other evidence and you don't have access to that other evidence then you do not have evidence at all.
    - lalaland1125 5y ago
      That's going to be the case for any paper evidence like this, included the 450,000 pages of personal medical information that the plaintiffs want. Unless you inspect the patient yourself, you are always going to be relying on someone else's word.
      - rajin444 5y ago
        Do you ever check the underlying data when you write a database query? Same logic applies here. There’s limits to what you can do but don’t let perfect be the enemy of good.
    - mike00632 5y ago
      So say you get doctor's notes saying that vaccinated patient didn't get COVID-19. What then? Do you need to interview the doctors? Where does the conspiracy theory end for you?
bluGill 5y ago
This is something the FDA should have done automatically at the time the issued the EUA or full authorization. That is preparing and releasing all the data for independent review should be part of their review. there is no reason the FDA should try to keep this secret in the first place, and a number of reasons they should make it available. That doing their job is hard isn't an excuse to not do it.
- lalaland1125 5y ago
  > no reason the FDA should try to keep this secret in the first place Personal medical information, especially as part of clinical trials, is some of the most legally protected data in the world. You can't just hand it out to people. And even with medical grade redaction (which is very expensive) there is always a risk of leaked information getting past the filters. I just find it funny that HN, usually a place very concerned with privacy, is now suddenly demanding the release of some of the most private and personal information of tens if not hundreds of thousands of individuals.
  - core-utility 5y ago
    I don't believe he's arguing for the release of personal medical information, he's arguing for the automatic release of the documents redacted of personal medical information. In other words, the FDA should have been prepared for this all along. Additionally, if Pfizer were to have been told to be prepared to redact PII, I'm sure authors could have easily marked PII during authoring for quick identification and removal. Someone had to write this stuff, it didn't just appear in the ether.
    - kube-system 5y ago
      It's not that easy. The amount of information that the someone at the FDA might need to do their job is definitely not bounded by the limitations in FOIA, they need the details. The FOIA process has to happen afterwards by the FDA anyway by law, regardless of what Pfizer provided. Additionally, the healthcare professionals who collected the data are also not qualified to do FOIA compliance, nor is it always possible to tell if a single data element will be PII after it is compiled with other information at a later date, because PII can be indirectly inferred from other elements of information.
tehwebguy 5y ago
The FDA offered a timeline of 500 pages / month (75 years) which far sillier.
- kbelder 5y ago
  My quick calc showed that's roughly one guy redacting 2.8 pages per hour. I know people who'd LOVE that job.
tagoregrtst 5y ago
The FDA played a stupid game by offering 500 pages a month. Thats a ream of paper. A person could redact that in a couple days. The Judge told the FDA to take the FOIA law seriously and, so they remember to next time, ordered them to do so quickly.

bingohbangoh 5y ago

The pharmaceutical companies have had a gangbusters year and we're implementing vaccine passports in places like NYC on the basis of this data. I think they can hurry.

Imnimo 5y ago
These are FDA's documents, not Pfizer's. The pharma companies aren't the ones doing the redaction.
- bingohbangoh 5y ago
  Ahhhh ok, was not aware, thanks! But my point on this being the subject of a vaccine mandate still holds.

prepend 5y ago

They should have been designed and planned with deidentification with the expectation that data would be released. If they are literally manually redacting patient data from pages and notes then that is a flaw in the study, I think. I would expect patient data to be pretty limited in the trial data since they are purposefully double blind. Notes are a different story, but I’m sure there are techniques that can be purchased for entity resolution that can automate the scrubbing for PHI and PII. Seems more like the FDA and Pfizer being silly than the judge.

lalaland1125 5y ago
> Notes are a different story, but I’m sure there are techniques that can be purchased for entity resolution that can automate the scrubbing for PHI and PII. You can't fully automate this because we require almost 100% accuracy. You need a manual review to ensure no data is leaked.
- prepend 5y ago
  I’m not sure why you think we require 100% accuracy. The actual level depends on many factors. For example, the expert determination method of deidentification in hipaa safe harbor [0] can allow up to 1% reidentification and still be considered anonymized. This is how medical providers share notes without manually reviewing them all. [0] https://www.hhs.gov/hipaa/for-professionals/privacy/special-topics/de-identification/index.html https://www.hhs.gov/hipaa/for-professionals/privacy/special-...
lesuorac 5y ago
Would you not use trial data to determine if Pfizer's vaccine should be approved? The FOIA request was for all of the documentation used to approve the vaccine. > I’m sure there are techniques that can be purchased for entity resolution that can automate the scrubbing for PHI and PII. Sounds like a good way to have "anonymized" data that isn't actually anonymized like most datasets ...
- prepend 5y ago
  That’s part of the downside of “anonymized” data as there’s not any clear legal definitions so it’s quite possible to identify some persons within anonymized data. I think this is a big problem when it comes to stuff like data brokering and selling. Less so with issues like this because vaccine data researchers are less likely to cause harm to someone than others who buy anonymized data.
robbedpeter 5y ago
>>If they are literally manually redacting... That's a feature, not a bug. Bureacracy is a game, and they are grandmasters.
anigbrowl 5y ago
To be fair they were in a bit of a rush, and opted to dump the problem on the bureaucrats rather than spend more time designing protocols. This isn't an example of wicked plotting, it's just an argument about who picks up the tab for a large redaction job.
- prepend 5y ago
  I think it’s also a situation of someone not wanting to release so coming up with a bone headed way of reviewing for privacy.

tut-le-tut 5y ago

"At that rate, the 10 employees would have to work non-stop 24 hours a day, seven days a week to produce the 55,000 pages a month (and would still fall a bit short)." So 50 people on a normal (40 hour work week) could do this in a month. The FDA has 18 000 employees. I think the answer is clear.

sebow 5y ago

Standard procedure is being silly?

kansface 5y ago

There is currently a government mandate requiring most adults be vaccinated while at the same time, the government (another agency) is unwilling to publish the evidence it considered in favor of the emergency authorization and the concomitant decision making process until after everyone mandated to take it has died... because that's the way they have always done things?

lalaland1125 5y ago
The FDA already released the evidence it considered for the approval. It's available right on the FDA website: https://www.fda.gov/media/151733/download https://www.fda.gov/media/151733/download The plaintiffs in this case are asking for the clinical medical history of everyone in the clinical trials, which is a bit trickier to provide.
- encryptluks2 5y ago
  If the evidence references other evidence and you don't have access to that other evidence then you do not have evidence at all.
  - lalaland1125 5y ago
    That's going to be the case for any paper evidence like this, included the 450,000 pages of personal medical information that the plaintiffs want. Unless you inspect the patient yourself, you are always going to be relying on someone else's word.
    - rajin444 5y ago
      Do you ever check the underlying data when you write a database query? Same logic applies here. There’s limits to what you can do but don’t let perfect be the enemy of good.
  - mike00632 5y ago
    So say you get doctor's notes saying that vaccinated patient didn't get COVID-19. What then? Do you need to interview the doctors? Where does the conspiracy theory end for you?

bluGill 5y ago

This is something the FDA should have done automatically at the time the issued the EUA or full authorization. That is preparing and releasing all the data for independent review should be part of their review. there is no reason the FDA should try to keep this secret in the first place, and a number of reasons they should make it available. That doing their job is hard isn't an excuse to not do it.

lalaland1125 5y ago
> no reason the FDA should try to keep this secret in the first place Personal medical information, especially as part of clinical trials, is some of the most legally protected data in the world. You can't just hand it out to people. And even with medical grade redaction (which is very expensive) there is always a risk of leaked information getting past the filters. I just find it funny that HN, usually a place very concerned with privacy, is now suddenly demanding the release of some of the most private and personal information of tens if not hundreds of thousands of individuals.
- core-utility 5y ago
  I don't believe he's arguing for the release of personal medical information, he's arguing for the automatic release of the documents redacted of personal medical information. In other words, the FDA should have been prepared for this all along. Additionally, if Pfizer were to have been told to be prepared to redact PII, I'm sure authors could have easily marked PII during authoring for quick identification and removal. Someone had to write this stuff, it didn't just appear in the ether.
  - kube-system 5y ago
    It's not that easy. The amount of information that the someone at the FDA might need to do their job is definitely not bounded by the limitations in FOIA, they need the details. The FOIA process has to happen afterwards by the FDA anyway by law, regardless of what Pfizer provided. Additionally, the healthcare professionals who collected the data are also not qualified to do FOIA compliance, nor is it always possible to tell if a single data element will be PII after it is compiled with other information at a later date, because PII can be indirectly inferred from other elements of information.

tehwebguy 5y ago

The FDA offered a timeline of 500 pages / month (75 years) which far sillier.

kbelder 5y ago
My quick calc showed that's roughly one guy redacting 2.8 pages per hour. I know people who'd LOVE that job.

tagoregrtst 5y ago

The FDA played a stupid game by offering 500 pages a month. Thats a ream of paper. A person could redact that in a couple days. The Judge told the FDA to take the FOIA law seriously and, so they remember to next time, ordered them to do so quickly.