3 ms·

Deidentified data isn’t Protected Health Information. There are valid reasons other than the provision of care to access PHI for deidentification, it can also b

Deidentified data isn’t Protected Health Information. There are valid reasons other than the provision of care to access PHI for deidentification, it can also be automated at the time of collection. Healthcare operations being a nice vague one, or a limited dataset. These don’t require consent. Deidentification is technically possible but much harder to do and reidentification risks are higher (e.g. distinctive mark) so it’s strongly advised to obtain consent. I expect most TikTok doctors are getting consent, I’ve heard happy aesthetics patients tend to give consent.

throwaway290 3y ago
If it is an image of a part of my body I don't see how it is deidentifiable. Unless you literally redraw it. Also the article is about the problem of TT doctors who are NOT getting consent.
- haldujai 3y ago
  > If it is an image of a part of my body I don't see how it is deidentifiable Depends how unique the part of your body looks, I agree it’s very hard (potentially impossible) so it shouldn’t be done. My point is mostly about the comment I was replying to which posited this as a hypothetical and incorrectly stated it couldn’t be used, I’m clarifying that’s not how HIPAA works.
- prepend 3y ago
  It’s still deidentified if only you recognize it. It violates deidentification only if others recognize it and tie it to you. And it doesn’t violate HIPAA even in those situations as HIPAA allows a certain percentage of reidentification (not specified in the law, but generally accepted at 1%) before it’s a breach.
balls187 3y ago
We’re talking about pre and post op photos. Not data. Again to reiterate it’s going to be very hard to argue tiktok posts fall under an exception for the privacy rule.
- haldujai 3y ago
  > Not data Photos are a type of data and are equivalent under HIPAA which only considers "Full-face photographs and any comparable images" PHI. For further clarification of what "any comparable images" means we can turn to the slightly less ambiguous commentary from HHS: >Comments: Some comments noted that identifiers that accompany photographic images are often needed to interpret the image and that it would be difficult to use the image alone to identify the individual. >Response: We agree that our proposed requirement to remove all photographic images was more than necessary. Many photographs of lesions, for example, which cannot usually be used alone to identify an individual, are included in health records. In this final rule, the only absolute requirement is the removal of full-face photographs, and we depend on the 'catch-all' of 'any other unique characteristic' to pick up the unusual case where another type of photographic image might be used to identify an individual. https://aspe.hhs.gov/sites/default/files/private/aspe-files/198626/pvcfr06.txt https://aspe.hhs.gov/sites/default/files/private/aspe-files/... > it’s going to be very hard to argue tiktok posts fall under an exception for the privacy rule. I completely agree that it's very hard to deidentify photos to a degree that they can be publicly disclosed (noting that TikTok is not specifically relevant to this challenge, the same considerations apply to a training dataset as one example). However, you described a specific hypothetical (Even if the images are altered to make them impossible to identify the individual) that would by definition satisfy deidentification requirements and no longer be considered PHI per this guidance.

throwaway290 3y ago

If it is an image of a part of my body I don't see how it is deidentifiable. Unless you literally redraw it. Also the article is about the problem of TT doctors who are NOT getting consent.

haldujai 3y ago
> If it is an image of a part of my body I don't see how it is deidentifiable Depends how unique the part of your body looks, I agree it’s very hard (potentially impossible) so it shouldn’t be done. My point is mostly about the comment I was replying to which posited this as a hypothetical and incorrectly stated it couldn’t be used, I’m clarifying that’s not how HIPAA works.
prepend 3y ago
It’s still deidentified if only you recognize it. It violates deidentification only if others recognize it and tie it to you. And it doesn’t violate HIPAA even in those situations as HIPAA allows a certain percentage of reidentification (not specified in the law, but generally accepted at 1%) before it’s a breach.

balls187 3y ago

We’re talking about pre and post op photos. Not data. Again to reiterate it’s going to be very hard to argue tiktok posts fall under an exception for the privacy rule.

haldujai 3y ago
> Not data Photos are a type of data and are equivalent under HIPAA which only considers "Full-face photographs and any comparable images" PHI. For further clarification of what "any comparable images" means we can turn to the slightly less ambiguous commentary from HHS: >Comments: Some comments noted that identifiers that accompany photographic images are often needed to interpret the image and that it would be difficult to use the image alone to identify the individual. >Response: We agree that our proposed requirement to remove all photographic images was more than necessary. Many photographs of lesions, for example, which cannot usually be used alone to identify an individual, are included in health records. In this final rule, the only absolute requirement is the removal of full-face photographs, and we depend on the 'catch-all' of 'any other unique characteristic' to pick up the unusual case where another type of photographic image might be used to identify an individual. https://aspe.hhs.gov/sites/default/files/private/aspe-files/198626/pvcfr06.txt https://aspe.hhs.gov/sites/default/files/private/aspe-files/... > it’s going to be very hard to argue tiktok posts fall under an exception for the privacy rule. I completely agree that it's very hard to deidentify photos to a degree that they can be publicly disclosed (noting that TikTok is not specifically relevant to this challenge, the same considerations apply to a training dataset as one example). However, you described a specific hypothetical (Even if the images are altered to make them impossible to identify the individual) that would by definition satisfy deidentification requirements and no longer be considered PHI per this guidance.