5 ms·

The information is supposedly de-identified. That means it's not a HIPAA violation. You can look at the HIPAA de-identification standard right over here (https:

The information is supposedly de-identified. That means it's not a HIPAA violation. You can look at the HIPAA de-identification standard right over here (https://www.hhs.gov/hipaa/for-professionals/privacy/special-topics/de-identification/index.html#standard https://www.hhs.gov/hipaa/for-professionals/privacy/special-...).

alexb_ 5y ago
I will never believe someone when they say info is "de-identified", because even if it is, it is shockingly easy to pinpoint 1 person out of millions based on a very small number of unique factors.
- nerdponx 5y ago
  A lot of people simply don't know this. Politicians either don't know or claim to not know. This is a good example of the law and popular conception of a concept being badly out of date, to the advantage of industry and disadvantage of regular people. Therefore industry has a vested interest in keeping the public perception focused on "de-identified" with a narrow definition of PII.
- tomrod 5y ago
  There are academic subfields that study the risk of de-identification.
- samhw 5y ago
  I think it’s because the word “anonymous” permeates our understanding of the concept, and – even for people who didn’t actually study Greek – the tie to “name” is clear. We need to understand that “knowing someone’s identity” is not coextensive with “knowing their name”, and that in fact knowing someone has a rare medical condition may be more identifying[0] than knowing their name. [0] Or k-deanonymising, for anyone who’s pedantic about identity being an absolute.
- walnutclosefarm 5y ago
  I spent a good deal of my professional life in the last decade dealing with the problem of de-identifying medical data. You are correct that it's hard, but the HIPAA rule is actually not a bad go at it. See https://www.hhs.gov/hipaa/for-professionals/privacy/special-topics/de-identification/index.html https://www.hhs.gov/hipaa/for-professionals/privacy/special-.... For the kind of data in this particular database (mostly insurance claims data), it's highly unlikely that you could learn much through re-identification of the data.

alexb_ 5y ago

I will never believe someone when they say info is "de-identified", because even if it is, it is shockingly easy to pinpoint 1 person out of millions based on a very small number of unique factors.

nerdponx 5y ago
A lot of people simply don't know this. Politicians either don't know or claim to not know. This is a good example of the law and popular conception of a concept being badly out of date, to the advantage of industry and disadvantage of regular people. Therefore industry has a vested interest in keeping the public perception focused on "de-identified" with a narrow definition of PII.
tomrod 5y ago
There are academic subfields that study the risk of de-identification.
samhw 5y ago
I think it’s because the word “anonymous” permeates our understanding of the concept, and – even for people who didn’t actually study Greek – the tie to “name” is clear. We need to understand that “knowing someone’s identity” is not coextensive with “knowing their name”, and that in fact knowing someone has a rare medical condition may be more identifying[0] than knowing their name. [0] Or k-deanonymising, for anyone who’s pedantic about identity being an absolute.
walnutclosefarm 5y ago
I spent a good deal of my professional life in the last decade dealing with the problem of de-identifying medical data. You are correct that it's hard, but the HIPAA rule is actually not a bad go at it. See https://www.hhs.gov/hipaa/for-professionals/privacy/special-topics/de-identification/index.html https://www.hhs.gov/hipaa/for-professionals/privacy/special-.... For the kind of data in this particular database (mostly insurance claims data), it's highly unlikely that you could learn much through re-identification of the data.