3 ms·

> This kind of data is likely more complicated because it's really hard if not impossible to anonymize the actual patient-level data. It still should be as acce

> This kind of data is likely more complicated because it's really hard if not impossible to anonymize the actual patient-level data. It still should be as accessible to other scientists as possible. I disagree with both parts of this. Why not associate each patient with a number then log all data against that? Patient names and other identifying information should simply never be attached to trial-related data (except for in a well-protected lookup file with highly restricted access). Making scientific data accessible only to other scientists is highly anti-scientific. Feynman, one of the greatest scientists of all time has many quotes around exactly this mindset: "Have no respect whatsoever for authority; forget who said it and instead look at what he starts with, where he ends up, and ask yourself, 'Is it reasonable?' ... we will doom humanity for a long time to the chains of authority, confined to the limits of our present imagination. It has been done so many times before." "Science is the belief in the ignorance of experts" "Our freedom to doubt was born out of a struggle against authority in the early days of science. It was a very deep and strong struggle: permit us to question - to doubt - to not be sure. I think that it is important that we do not forget this struggle and thus perhaps lose what we have gained."

fabian2k 5y ago
I'm not fully up to speed with all the research here, but as far as I understand it's quite easy to de-anonymize many datasets of exactly the kind you describe. If you're not really, really careful there will be lots of information in simple demographic data that could easily be matched to other data sources.
gpm 5y ago
> Why not associate each patient with a number then log all data against that? Patient names and other identifying information should simply never be attached to trial-related data Because "patient name" isn't the only way a patient can be identified. "Male, 27, admitted to Sunnybrook hospital for stitches to his forehead due to knife wound on January 20th 2022" is almost certainly uniquely identifying (actually it's made up so it probably identifies no one), is in the person's medical data for the trial, and clearly needs to either be redacted or in some other way separated from the other line that says "contracted HIV on January 19th 2022". Yet both are relevant when investigating causes of side effects.
- cogman10 5y ago
  I think HIPAA is something we should be re-evaluating as a nation. Back in '96 it was certainly a good idea given how devastating things like an HIV diagnosis could be for a family member in a fundamentalist family. Or the impact of said diagnosis on insurance coverage. With the ACA, the insurance coverage problem is gone. Pre-existing conditions can't be used as a reason to deny or change insurance rates. The Fundamentalist problem exists, but seems like much less of an issue with LGBT acceptance being so much better now than it was in the 90s. I just don't think that health information is so valuable that guarding it like a state secret is warranted. I'm ok with the notion of putting in basic safeguards like not attaching a patient name with the information but I don't see it has horrible if some system can infer absolute identity from that stuff. After all, seems far more scary that my web browsing generates a far clearer picture of who I am than what you could glean from my medical records. Having health information public and easy to gather would (potentially) be a significant boon to the study of health information. It would also make it a lot easier for us to make health information sharing systems so you don't have to fill out the same 500 forms every time you go to a different hospital or doctor.
  - YarickR2 5y ago
    six week old pregnancy terminated while her official partner is on tree month long business trip. instant divorce.
    - cogman10 5y ago
      Assuming name isn't attached to the data, that'd require the spouse (or someone else) to do the legwork to link up the medical history. When I say re-evaluate HIPAA, I don't mean "Hey, let's put everyone's name right next to every checkup and list it in a wikipedia like DB and email relatives about the results of every checkup". I mean "Hey, let's consider limiting the scope of the law and the penalties associated with it". It doesn't have to be a black and white thing. That all seems like a worthy risk if it enables researchers to find that "Hey, looks like people prescribed medication X with medication Y tend to develop cancer Z way more frequently than the general public" or "Hey, looks like people with gene X respond way better to cancer treatment Y than the general public".
throwawaygh 5y ago
Anonymization is difficult and sometimes impossible because reidentification attacks are extremely difficult to prevent. Anonymization is much more complex than people typically assume; see [1,2] for surveys. The more data you release, the more difficult it is to ensure that subjects cannot be reidentified by combining the "anonymized" dataset with other publicly available data. Important note: It's not just a case of putting in the work and being willing to share. There are impossibility results in this space. That is, there are reasonable formal threat models for which it is mathematically impossible to release any version of the dataset that is (a) useful (ie contains enough data to replicate findings) and (b) not subject to unacceptable levels of reidentification. I am generally in favor of releasing data and code/spreadsheets, but anything involving patients becomes difficult quickly. There are also reasonable middle grounds between "no access for anyone" and "throw it in a public s3 bucket". E.g., making data more available to researchers and medical practitioners -- or even sufficiently interested & motivated members of the public -- but under strict data handling rules, enforceable audit trails, and legal consequences for being reckless with sensitive patient data. Hell, odds are better than even that your employer made you sign a document that would allow them to sue you into oblivion for forwarding some sure-to-be-doomed product launch draft to the wrong person. Being at least that careful with fine-grained medical data on hundreds/thousands of patients isn't exactly unreasonable... Drawing a hard line on 100% complete, anonymous, and consequence-free access to troves of patient data isn't a reasonable position. [1] https://journals.plos.org/plosone/article/file?id=10.1371/journal.pone.0028071&type=printable https://journals.plos.org/plosone/article/file?id=10.1371/jo... [2] https://www.ccs.neu.edu/home/jullman/cs7880s17/DSSV.pdf https://www.ccs.neu.edu/home/jullman/cs7880s17/DSSV.pdf
msbarnett 5y ago
Simply removing the name isn't enough to anonymize the data, because as another commenter noted, the data submitted includes detailed patient histories and information about all of their other conditions, which is more than enough to uniquely identify someone. And you can't simply strip out that data, because a lot of the subsequent analysis of effectiveness is dependent on it.

fabian2k 5y ago

I'm not fully up to speed with all the research here, but as far as I understand it's quite easy to de-anonymize many datasets of exactly the kind you describe. If you're not really, really careful there will be lots of information in simple demographic data that could easily be matched to other data sources.

gpm 5y ago

> Why not associate each patient with a number then log all data against that? Patient names and other identifying information should simply never be attached to trial-related data Because "patient name" isn't the only way a patient can be identified. "Male, 27, admitted to Sunnybrook hospital for stitches to his forehead due to knife wound on January 20th 2022" is almost certainly uniquely identifying (actually it's made up so it probably identifies no one), is in the person's medical data for the trial, and clearly needs to either be redacted or in some other way separated from the other line that says "contracted HIV on January 19th 2022". Yet both are relevant when investigating causes of side effects.

cogman10 5y ago
I think HIPAA is something we should be re-evaluating as a nation. Back in '96 it was certainly a good idea given how devastating things like an HIV diagnosis could be for a family member in a fundamentalist family. Or the impact of said diagnosis on insurance coverage. With the ACA, the insurance coverage problem is gone. Pre-existing conditions can't be used as a reason to deny or change insurance rates. The Fundamentalist problem exists, but seems like much less of an issue with LGBT acceptance being so much better now than it was in the 90s. I just don't think that health information is so valuable that guarding it like a state secret is warranted. I'm ok with the notion of putting in basic safeguards like not attaching a patient name with the information but I don't see it has horrible if some system can infer absolute identity from that stuff. After all, seems far more scary that my web browsing generates a far clearer picture of who I am than what you could glean from my medical records. Having health information public and easy to gather would (potentially) be a significant boon to the study of health information. It would also make it a lot easier for us to make health information sharing systems so you don't have to fill out the same 500 forms every time you go to a different hospital or doctor.
- YarickR2 5y ago
  six week old pregnancy terminated while her official partner is on tree month long business trip. instant divorce.
  - cogman10 5y ago
    Assuming name isn't attached to the data, that'd require the spouse (or someone else) to do the legwork to link up the medical history. When I say re-evaluate HIPAA, I don't mean "Hey, let's put everyone's name right next to every checkup and list it in a wikipedia like DB and email relatives about the results of every checkup". I mean "Hey, let's consider limiting the scope of the law and the penalties associated with it". It doesn't have to be a black and white thing. That all seems like a worthy risk if it enables researchers to find that "Hey, looks like people prescribed medication X with medication Y tend to develop cancer Z way more frequently than the general public" or "Hey, looks like people with gene X respond way better to cancer treatment Y than the general public".

throwawaygh 5y ago

Anonymization is difficult and sometimes impossible because reidentification attacks are extremely difficult to prevent. Anonymization is much more complex than people typically assume; see [1,2] for surveys. The more data you release, the more difficult it is to ensure that subjects cannot be reidentified by combining the "anonymized" dataset with other publicly available data. Important note: It's not just a case of putting in the work and being willing to share. There are impossibility results in this space. That is, there are reasonable formal threat models for which it is mathematically impossible to release any version of the dataset that is (a) useful (ie contains enough data to replicate findings) and (b) not subject to unacceptable levels of reidentification. I am generally in favor of releasing data and code/spreadsheets, but anything involving patients becomes difficult quickly. There are also reasonable middle grounds between "no access for anyone" and "throw it in a public s3 bucket". E.g., making data more available to researchers and medical practitioners -- or even sufficiently interested & motivated members of the public -- but under strict data handling rules, enforceable audit trails, and legal consequences for being reckless with sensitive patient data. Hell, odds are better than even that your employer made you sign a document that would allow them to sue you into oblivion for forwarding some sure-to-be-doomed product launch draft to the wrong person. Being at least that careful with fine-grained medical data on hundreds/thousands of patients isn't exactly unreasonable... Drawing a hard line on 100% complete, anonymous, and consequence-free access to troves of patient data isn't a reasonable position. [1] https://journals.plos.org/plosone/article/file?id=10.1371/journal.pone.0028071&type=printable https://journals.plos.org/plosone/article/file?id=10.1371/jo... [2] https://www.ccs.neu.edu/home/jullman/cs7880s17/DSSV.pdf https://www.ccs.neu.edu/home/jullman/cs7880s17/DSSV.pdf

msbarnett 5y ago

Simply removing the name isn't enough to anonymize the data, because as another commenter noted, the data submitted includes detailed patient histories and information about all of their other conditions, which is more than enough to uniquely identify someone. And you can't simply strip out that data, because a lot of the subsequent analysis of effectiveness is dependent on it.