40 ms·
Do no harm petition: Don't give big tech access to our medical records
- xaedes 3y agoIn Germany they decided to make the EPA (electronic medical record) opt-out starting by 2024. Managed by "gematik GmbH", a company with limited liability. Because why should the entity responsible for all medical records have some liability. It is a joke, a bad one. They don't even say how to opt-out.
- mo_42 3y ago> Managed by "gematik GmbH", a company with limited liability. Because why should the entity responsible for all medical records have some liability. I think it doesn't really matter in what form the government appears. It's still the government and so its rules apply.
- denton-scratch 3y ago> I think it doesn't really matter in what form the government appears. It's still the government and so its rules apply. If it's a "limited company", that means it's liability is limited to shareholder capital. It's going to have to have an awful lot of capital if it's going to be able to compensate the entire population for mishandling their data. Also, if it's a limited company, then the shareholders can sell their shares; the company can change hands, often to owners in a different jurisdiction. A limited company is not an arm of the government, and I can't hold a limited company accountable in the same way I can the government; especially if my personal data has left the jurisdiction.
- mo_42 3y agohttps://www.bundesverfassungsgericht.de/SharedDocs/Entscheidungen/DE/2011/02/rs20110222_1bvr069906.html https://www.bundesverfassungsgericht.de/SharedDocs/Entscheid... Translation using Deepl: Leasts on the Judgment of the First Senate of February 22, 2011 - 1 BvR 699/06 - Mixed-economy enterprises controlled by the public sector in private-law form are subject to a direct fundamental-rights obligation in the same way as wholly state-owned public enterprises organized in private-law forms.
- NavinF 3y ago> GmbH This is apparently the German equivalent to an LLC. Pretty sure you misunderstood what "limited liability" means. Pretty much all organizations today have the same legal status: https://en.m.wikipedia.org/wiki/Limited_liability https://en.m.wikipedia.org/wiki/Limited_liability
- ClumsyPilot 3y ago> Pretty much all organizations today have the same legal status Thats exactly the issue
- Nifty3929 3y agoLimited Liability is a GREAT thing. It allows us to build businesses that serve society that we wouldn't otherwise. Would you start a company or invest in one if you could lose all your personal wealth? Few would.
- hideo 3y agoYou're missing GPs point. GP is not arguing to remove the concept of LLCs. GP is arguing that the entity in charge of all your medical information should not be an LLC. LLCs in general are great. This company probably shouldn't be LLC.
- Nifty3929 3y agoIf their lability was not limited, the company would not have been started.
- chopin 3y agoIf the liability is so great that an LLC is necessary maybe it shouldn't be done in the first place.
- ianburrell 3y ago
- LatteLazy 3y agoFYI, all liability is limited...
- jmclnx 3y agoLooks like this is for Europe. I think US needs one too.
- bpodgursky 3y agoI don't think most people appreciate that medical research moves, at minimum, 20x slower than it would with open data access. Doing the simplest possible regression across two institutional datasets is a $100,000 project involving lawyers, de-identification, consents, and a host of bureaucracy. Since most projects end in null results, most don't happen. These laws, while well-intentioned, kill people. If you think that's an OK tradeoff, I guess you're free to accept that. But there is very real blood on your hands, the fact that none but the most egregiously common diseases are studied. It doesn't have to be this way.
- ChrisMarshallNY 3y ago> These laws, while well-intentioned, kill people. So does medical fraud, and it's not well-intentioned at all. Just sayin'. I have almost no faith at all in the types of folks that found and run tech companies, these days. They have proven, over, and over, and over again, that They. Just. Can't. Be. Trusted. If the tech industry were to create an ethics board, with real enforcement teeth (like the Bar Associations, or Medical Boards), then that could be a start. The problem is, as soon as anyone even mentions the possibility of restricting tech companies, they are taken out behind the woodshed.
- TZubiri 3y agoSo do guns
- polishrandomguy 3y agoThat's why they are banned throughout the EU much more rigorously than in US
- denton-scratch 3y agoHeh. Open health data doesn't kill people, med-tech bros do. /s
- _piif 3y agoI agree. It's hard for me to get excited about anything tech companies output nowadays as more than likely it will be surveillance, ad, upsell and subscription-driven with growth and profits triumphing any regards and respect for the end-user experience and privacy. I have zero reason to trust them not to abuse my health data for their own interests rather than use it for the greater good.
- TZubiri 3y agoWho gives a shit if Google has your medical records?
- jnsie 3y agoAnyone with a desire for privacy who possesses critical reasoning.
- genocidicbunny 3y agoSeriously, this question seems to indicate a critical lack of common sense in the poster. You don't even need to have a desire for privacy, just a modicum of risk aversion. Here's a simple example of what can happen with your medical data: Medical data ends up somewhere like LexisNexis -> Company looks you up before hiring -> Company sees that you have a health condition that will cost them more in health insurance costs -> Company doesn't hire you because "it's not a culture fit". Oh, you don't have a health condition right now? Well, pray you never develop one either -- your boss will probably be able to sign up for push notifications for when there's a new diagnosis for you.
- cesarvarela 3y agoIt is a bit of a chicken egg problem, because with more data available the cure for that health condition could be found earlier.
- dmbche 3y agoNot necessarily - it could very well not help that much. These are just claims.
- mdale 3y agoThere are already real bias actualized on the name and gender of the applicant at the very first stage of company hiring. Late stage investigations credit reports, public court records, online social profiles can happen but rarely do. Companies focus on referrals and confirmed job history. I can't imagine more invasive investigations into health history. Secondly why are companies paying more for healthcare given a employee sickness. The point of insurance is that it normalize cost across the entire pool of people and must be regulated to not be prejudice of pre existing conditions.
- Calvin02 3y agoWe need a nuanced approach. Blanket bans, while sounding good, can slow down pace of innovation in an area that desperately needs more of it - esp as the world is aging. This needs to be a combination of informed consent, clear access auditing and usage, and laws to heavily penalize misuse of this data.
- deleted 3y ago[deleted]
- jillesvangurp 3y agoEverybody wants privacy. But they also want treatment for whatever ails them. These things don't have to be mutually exclusive. Lack of information is a big challenge for doctors. When I say challenge, I mean people are dying needlessly because of their doctors don't have access to critical information and this leads to bad decision making. Here in Germany doctors are completely in the dark. Even basic information like who I am or where people live isn't being shared. Because privacy. Every doctor you talk to first needs to take down all your basic details. Address, date of birth, etc. Every medical appointment is ground hog day. They know nothing of you, your personal details, or your medical history. And German GPs don't do a lot themselves. You get referred for even the most basic things but without them sharing information. So, all the obvious things happen on a daily basis. People receiving the wrong medications. Doctors not acting because they are unaware of the history of the person in front of them. Or wasting time on diagnosing things that have already been diagnosed. Or mis-diagnosing those things. That's the consequence of bad data. The standard German sentiment against any digital is "I don't like this". But the consequences are that they have to suffer bad health care, a stupendously inefficient system that they pay for through really expensive insurance every month, and preventable deaths because essential data isn't being exchanged to those who need it. And their privacy sucks anyway, because IT security is about what you expect from a sector running on ancient hardware and software. IT incompetence/ignorance is the norm. Quite a contrast with other countries I've lived in.
- JohnFen 3y ago> Everybody wants privacy. But they also want treatment for whatever ails them. These things don't have to be mutually exclusive If I didn't have a modicum of assurance that what happens between me and my doctor stays between me and my doctor, I would absolutely avoid going to see a doctor to the greatest extent possible.
- iandanforth 3y agoI strongly oppose this kind of law. HIPAA is a massive burden on medical and research organizations of all sizes, I've personally spent hundreds of hours navigating both human and technical bureaucracy related to HIPAA and I wouldn't wish that on my worst enemy. Ultimately however the worst part of these laws is that they are so harmful to research in the long run. With easy and ready access to medical data we could be decades ahead of where we are today. There are legitimate concerns about health privacy (especially for women in the US) but the upside is just so much larger than the harms. It could be 10x less costly and time consuming to do both epidemiology and longitudinal intervention studies if we only had access to data. We could be directly tackling disease causal factors in ways that researchers today only dream of. It really is tens of thousands of lives lost each year that could have been saved if we could only have moved faster toward interventions. I believe medical records should be open and laws should address how people use the data, not trying to make something so valuable to all humanity secret from the beginning. For example you can download my genetic code here: https://www.openhumans.org/member/iandanforth/ https://www.openhumans.org/member/iandanforth/
- dmbche 3y agoWhat are your thought on privacy then? Shouldn't my records be my own business?
- ClumsyPilot 3y agono your records are their business Thier corporate records are none of your business if we are gonna have no privacy, it should go both ways - companies lose privacy too
- iandanforth 3y agoI reject the framing. It's about responsibility vs selfishness and fear. Medical information is a byproduct of something you do anyway that can save lives. It is our responsibility to make it available. If you want to opt out, fine, but basic decency demands that as a society we get over our collective hangups and make this information available.
- slackfan 3y agoDon't give? Excuse me? Most bigtech firms already have access to that data.
- hankchinaski 3y agoAs long as PII is not attached to medical metadata I really don’t understand the pettiness of these laws
- danaris 3y agoLook up "deanonymizing" sometime, and you may see why people are concerned.
- tengbretson 3y agoWhen combined with the data the big tech companies already have access to there is no such thing as anonymous medical data.
- masfuerte 3y agoFor the medical data (not metadata) to be useful in models you usually need plenty of associated PII like dob, postcode area, etc. Overfit a model and it will act pretty much as a database lookup on your personal medical data. It needs to be regulated.
- JohnFen 3y agoThey're not petty, they're trying to address a genuine problem. First, the legal definition of "PII" excludes quite a lot of acutal PII. Second, even if there's genuinely no PII attached, it's pretty trivial to reidentify the data.
- forkerenok 3y agoThe article doesn't mention whether those are anonymised records. A PDF from the references expands on that: > Pseudonymisation and anonymisation are not enough: health data is so specific that re-identification can be trivial. Often a person’s social media or financial history, both widely available on today’s data markets, is sufficient to identify medical events that can easily lead to reidentifying supposedly pseudonymised or even anonymised datasets. I agree with the sibling comment that we need more open data if (iff?) we want to increase the pace of medical research. But it seems to be a tough cookie to crack.
- LatteLazy 3y agoYou cannot really anonymised records like these. You can identify most people from only their post code, gender and date of birth (using just public data sources). So stripping names out is meaningless...
- scythe 3y agoYou're really underestimating the depth of anonymization in medicine. Birth dates are considered PII. Treatment dates are PII. Record numbers are PII. Locations "narrower than a state" are PII. Even ages over 85ish are PII because there tend to be very few people that old at a particular facility.
- LatteLazy 3y agoI mean, you can always anonymise data by removing all the useful data. And that is the problem here: how do you remove enough data to make it NOT personally identifiable (or close too) AND not remove so much data that the whole thing is pretty useless. No one has really managed that yet. People who have not tried assume it is possible. But it probably isn't except maybe in very specific cases where you only need very limited data and don't care about correlations with other factors... There are some quite high profile examples of orgs releasing anonymised data and people linking it back to the individuals: https://www.theguardian.com/technology/2019/jul/23/anonymised-data-never-be-anonymous-enough-study-finds https://www.theguardian.com/technology/2019/jul/23/anonymise... Interestingly the UK (I am a limey brit) actually has some really good experience with this, both from NHS medical records and public studies on Civil Servants... https://en.wikipedia.org/wiki/Whitehall_Study https://en.wikipedia.org/wiki/Whitehall_Study
- photochemsyn 3y agoPeople are saying that open access to everyone's medical records would speed up research, but that's not how well-controlled and well-designed medical research works in practice. For example, if you wanted to study lung cancer causes and treatment efficacy, just mining public data would not be that beneficial. Real studies need controls, detailed patient histories, actual observational lab work (blood tests, etc.), and so on. What this data would be used in practice? Insurance corporations would use it to identify people at greater risk of diseases and to deny them coverage (or make it difficult to obtain coverage, remove them from coverage, etc.) in order to increase their profit margins. Now, you could have useful anonymized public databases, for example, imagine if everyone got regular monitoriing of body burden of heavy metals and industrial and agricultural organic chemicals, and that was cross-referenced to their incidence of cancer, liver disease, etc. This could reveal common associations between specific pollutants and various diseases that could then be studied in more detail. Similarly, this could be applied to pharmaceutical products (which sometimes do more harm than good to their users) Of course, that kind of public health-centric database would open up corporations to liability and cause profit loss, which is why such body-burden assessments of pollutants are not part of your normal medical checkup.
- nmca 3y agoThis plainly isn't true, just to briefly articulate: * Hypothesis generation sped up * Candidate participant discovery sped up - including finding controls * large classes of analysis possible on just the data, including difference in difference and natural experiment
- photochemsyn 3y agoIf the data is rigorously anonymized, then it loses all value for the health insurance / advertising sector, who want to exclude high-cost patients from coverage and target individuals with health conditions, respectively. Do you think Big Tech shareholders (with additional holdings in pharmaceuticals, petrochemical, agribusiness etc.) would be interested in a database of rigorously anonymized patient data intended to discover relationships between things like pesticide exposure and Parkinson's disease, or unpleaseant side effects of currently profitable pharmaceutical products?
- w0m 3y agoI honestly think the the taboo-nature of medical records kills people in significant numbers. More-so than anything else, the focus should be on preventing pre-existing conditions from being able to affect individuals negatively than adding hoops for the individual to access their own gated personal records (Moving between hospital systems today can be an absolute nightmare in the states).
- cm2012 3y ago100%. HIPPA is the reason doctors offices still use fax machines and refuse to update patients with emails.
- chopin 3y agoI consider that a good thing.
- tryptophan 3y agoThe funny thing is that fax is completely unencrypted, allegedly HIPAA requirement. Security through obscurity.
- ShowalkKama 3y agoit's about europe. You don't need to "switch hospitals" (at least in my country).
- bdavbdav 3y agoI think theres a general need to dig more into differential privacy and how data can be effectively anonymized for research purposes if its done right. https://towardsdatascience.com/understanding-differential-privacy-85ce191e198a https://towardsdatascience.com/understanding-differential-pr...
- DEDLINE 3y agoFor my W2 job, I broker the commercial sale of "real world evidence". It's usually hospital, insurance and pharmaceutical claims data. The buyer is largely big pharma. They want it for things like monitoring a patient's journey and adverse events related to their drugs. There's use-cases in clinical development and pre-market as well. As archaic as HIPAA is, the tools that we have today to obfuscate PHI (e.g. tokenization) respect the individual's privacy. The major cloud infrastructure providers are all HITRUST certified and ready to sign BAAs to keep everyone accountable. I think we're in a good place right now for innovation with healthcare data. Multi-modal (think genome + claims + social determinants of health) are starting to become a thing. As a population, we'll benefit from more targeted therapies. Technology is catching up with the swaths of data that has been amassed since the 2000's. I hope for more innovation vs. shackling it with uninformed regulation.
- sirspacey 3y agoMedical records are already aggregated by Big Tech companies - they are called “medical billing.” I’d much prefer a different set of companies having access to records at scale for the purposes of improving outcomes, which they will never care about (having seen it first-hand).
- whysafish108 3y agoI am also opposed to this kind of petition on the grounds that it inhibits standardization of file formats. I work at a startup and we work with medical records from a number of different hospitals. So much code is dedicated to just dealing with the spaghetti. A major roadblock for our startup is getting medical information integrated into our system. It's difficult to compete with the IBMs and Epics of the world when we don't have a million developer hours to dedicate to writing plugins for every vendor. It's not just us struggling with crappy data management - it confuses hospital staff, too. Our customers are frustrated when we tell them things like "you gave us <XYZ obscure file type> which doesn't contain the information we need; do you have <ABC obscure file type> instead?". MRI scans (DICOMs) are particularly gnarly. Even the IBMs and Epics of the world struggle to not make crappy software. How do you present a relevant medical record to a doctor at the exact right time they need it? There is so much data to sift through that medical information frequently slips through the cracks when patients transfer hospitals or their hospital merges with another. If there isn't a standard way to query an electronic health record then companies are incentivized to just throw data at an LLM to parse it (which is exactly what we're moving towards). Trying to build AI-type solutions will just make these companies even more data-hungry and result in a less reliable solution. I'm not opposed to continuing to hold startups/big tech accountable for keeping personal health information private and secure.
- Nifty3929 3y agoThe effort we spend protecting medical records is out of all proportion to the damage done by any leaks. I really do not understand the reasoning. And this is effort that would otherwise be used to generate other economic benefits, like food, housing, medical treatments, etc. Another problem is that these laws (HIPAA, etc) actually CONTRIBUTE TO the leaks, because they provide a huge blackmail incentive to hackers. The penalties are so large that hackers know they can extort giant payments from companies. Also, it's no small loss that it's so difficult to use this data for legitimate research purposes now, depriving us of all the medical gains we otherwise would have. Certainly, I would not want my records in the newspaper - but really what's the worst outcome? Everybody finds out just how much ED medication I take? I suspect a lot of this legislation is (as usual) motivated the the businesses that stand to gain from it. It creates a large moat around existing large businesses that can afford to cooperate. And funnels a lot of money to the consultancies and other companies that work to comply with these policies.
- nmca 3y agoSome folks would be materially harmed by medical record release; e.g. women who have had abortions in states where it is illegal, gays in very conservative areas, passing trans people, the functional severely depressed, passing folks with autism etc
- JohnFen 3y ago> The effort we spend protecting medical records is out of all proportion to the damage done by any leaks. I disagree entirely. > really what's the worst outcome? Well, let's look at what's happened in the past. You could be denied employment, denied housing, denied insurance coverage, even denied essential medical treatment, for starters.
- tmcb 3y agoThe worst outcome is that individuals may have sensitive information in their medical history that could be poorly received by their social circles if it becomes public. In extreme cases, this could even lead to threats on their life. Consider this: the same argument could be applied to our endeavor to safeguard the secrecy of voting. What is the worst outcome if everyone discovers who you voted for? Such conclusions are inherently biased because we are unable to accurately evaluate the importance of these very existing protective measures in a civilized society.
- dudeinhawaii 3y agoBig Tech, Small Tech, someone will eventually have access to our medical records and honestly it's the direction things need to go in order to have cheaper, more transparent healthcare as well as drive innovation in the space a large. It's less about "who" and more about "how". How will we grant this access in safe and (preferably) anonymous ways.
- JohnFen 3y ago> It's less about "who" and more about "how". It's both. "Who" is a very critical thing, because there are so many bad actors out there.
- journey_how 3y ago[dead]
- mannyv 3y agoThe problem with data masking is that you don't know what data is important. Want to see if there's a geo cluster? Oh sorry, there's no location data. Do you want to see if something affects age band 12-14 instead of 16-18? Sorry, everyone in that group is in a HIPAA bucket. Do you want to see if there's a commonality among treatment options for obese women over 65 who are diabetic in rural communities? Nope, sorry. Do you want to determine the success rates and outcomes for different treatments in different regions for a given condition, and if they differ bu age/gender/ethnicity/place of treatment? Nope. If there are uses that are prohibited prohibit them. Thats what the law is for.
- activiation 3y agoIf anything, they need to be completely anonimized and I don't know if that's possible
- rootusrootus 3y agoDo the big tech companies self-insure for medical coverage? They'd probably have pretty good access to their employees' medical records already. Not that it's a good idea to expand that more widely, but I suspect many people have no idea how widely distributed their medical information already is.
- denton-scratch 3y agoThis is actually a bigger problem in the UK (no longer in the EU). NHS England has been trying repeatedly to make huge amounts of NHS data available to various kinds of commercial "partners". It started with supplying the Society Of Actuaries with the records of a million patients. For £3,000! Actuaries, of course, are primarily employed by insurance companies - not the kind of people I want having access to my medical data. We were given the chance to opt out; you had to get and complete the official form from your GP, and go to the clinic and hand it in. But it turned out that only covered your GP's records; hospital records were subject to a different opt-out. You had to ask for a form from your local Health Trust, complete that, and mail it in. None of this was electronic or online. Then there was a new plan, all your old opt-outs were obsoleted, and you had to go through the whole rigmarole again. The UK has the finest collection of medical data in the world; a population of 70 million, and a consolidated health service dating back 80 years. No other country has this. I have no problem with that data being used by the NHS to improve existing treatments and develop new treatments. But handing it over for peanuts to J. Arthur Random really isn't on. There are evidently civil servants in NHS England who are fanatical about sharing NHS data for commercial profit, even if that profit doesn't accrue to the NHS.
- LeonTheremin 3y ago[dead]