3 ms·

The thing is; in practice, how can you re-id someone that has a very rare medical condition if you don't already know that the person has this very rare medical

by rvnx 5y ago

The thing is; in practice, how can you re-id someone that has a very rare medical condition if you don't already know that the person has this very rare medical condition ?

throwawaygh 5y ago
"this person is certainly my biology teacher, who shared the fact that she had a rare genetic disorder during our Genetics unit as well as <insert otherwise non-identifiable columns>. She has herpes. Or also she has an alcohol problem and used to do acid." Teacher is now fired. You also keep ignoring the issue of consent. Step one is to ask patients. Or the person shared their story on the public website of a "Run For The Cure" style website about that genetic disorder. Or so on. "Sparse Features" aren't always a thing that the person wants to keep private.
- nradov 5y ago
  You can construct all sorts of artificial theoretical risks. There's no evidence of that being a real risk with this particular data set.
Tostino 5y ago
It's that knowing that someone has a rare medical condition that someone willingly shared can be a signal to find out other things in their medical records that they may not have wanted to share with others they know.
- rvnx 5y ago
  Let's look in practice, as they exist: look at VAERS for example, it's in this exact situation (these are public records posted on a public and non-confidential HTTP server): https://vaers.hhs.gov/data/datasets.html https://vaers.hhs.gov/data/datasets.html This is the type of raw records we are talking about, and they carry useful information. Yes, maybe the dates could be anonymised better, if I know the age of someone, and I know when he got his vaccine precisely, and when he got his MRI and why he did it, then maybe I can find and connect back the record. But how likely this attack can be done in practice, and why would you do it to someone who already disclosed part of their records, plus how does it scale ? However, the benefits are really present, it's not sharing just for the sake of sharing but to bring advance to the global research and knowledge of medicine. In practice, who is it ? I don't know, who can know ? Doctors who can tie it to other pieces of information that we don't have... However, in the meantime, the researchers and doctors who don't have these foreign keys, they can totally do interesting and useful discoveries about drug interactions and vaccine side-effects.
  - throwawaygh 5y ago
    I can show you 10 code snippets that don’t contain sec vulns. Therefore, software security is easy.
andreskytt 5y ago
What this boils down to is a set of observable factors being multiplied. Probably millions of people got the shot in August. From them, probably tens of thousands were overweight. From them, hundreds had diabetes. Add a few other factors like rough age and gender and you get to that one person along with all of their medical history. If we are not talking about the entire US but can know the state, for example, the task becomes so much easier.

by rvnx 5y ago

The thing is; in practice, how can you re-id someone that has a very rare medical condition if you don't already know that the person has this very rare medical condition ?

throwawaygh 5y ago

"this person is certainly my biology teacher, who shared the fact that she had a rare genetic disorder during our Genetics unit as well as <insert otherwise non-identifiable columns>. She has herpes. Or also she has an alcohol problem and used to do acid." Teacher is now fired. You also keep ignoring the issue of consent. Step one is to ask patients. Or the person shared their story on the public website of a "Run For The Cure" style website about that genetic disorder. Or so on. "Sparse Features" aren't always a thing that the person wants to keep private.

nradov 5y ago
You can construct all sorts of artificial theoretical risks. There's no evidence of that being a real risk with this particular data set.

Tostino 5y ago

It's that knowing that someone has a rare medical condition that someone willingly shared can be a signal to find out other things in their medical records that they may not have wanted to share with others they know.

rvnx 5y ago
Let's look in practice, as they exist: look at VAERS for example, it's in this exact situation (these are public records posted on a public and non-confidential HTTP server): https://vaers.hhs.gov/data/datasets.html https://vaers.hhs.gov/data/datasets.html This is the type of raw records we are talking about, and they carry useful information. Yes, maybe the dates could be anonymised better, if I know the age of someone, and I know when he got his vaccine precisely, and when he got his MRI and why he did it, then maybe I can find and connect back the record. But how likely this attack can be done in practice, and why would you do it to someone who already disclosed part of their records, plus how does it scale ? However, the benefits are really present, it's not sharing just for the sake of sharing but to bring advance to the global research and knowledge of medicine. In practice, who is it ? I don't know, who can know ? Doctors who can tie it to other pieces of information that we don't have... However, in the meantime, the researchers and doctors who don't have these foreign keys, they can totally do interesting and useful discoveries about drug interactions and vaccine side-effects.
- throwawaygh 5y ago
  I can show you 10 code snippets that don’t contain sec vulns. Therefore, software security is easy.

andreskytt 5y ago

What this boils down to is a set of observable factors being multiplied. Probably millions of people got the shot in August. From them, probably tens of thousands were overweight. From them, hundreds had diabetes. Add a few other factors like rough age and gender and you get to that one person along with all of their medical history. If we are not talking about the entire US but can know the state, for example, the task becomes so much easier.