5 ms·

Which sucks because there is tremendous value in anonymized collections of health records, yet we can’t use these health records for research at all. I realize

Which sucks because there is tremendous value in anonymized collections of health records, yet we can’t use these health records for research at all. I realize it was out of scope for the bill, but damned if it didn’t stymie medical research to a ridiculous degree.

mr_toad 3y ago
Anonymised collections of health records are available to bona fide researchers.
- ghaff 3y ago
  The point is that "anonymized" data is frequently relatively straightforward to de-anomymize at least on a statistical basis.
  - mr_toad 3y ago
    That doesn’t make what I said any less true. Anonymised datasets have been available to researchers for decades.
kccqzy 3y ago
Anonymization is hard. Unless you have very accomplished cryptographers defining and implementing anonymization, I do not trust it. That basically means not trusting anyone but large governments and FAANG companies. That said I do think agencies like NIST should define anonymization standards.
- bombcar 3y ago
  And medical issues are such that even fully anonymous you can probably identify who is whom.
  - jasonhong 3y ago
    Latanya Sweeney demonstrated how hard it is to anonymize health data back in the late 1990s as part of her dissertation work: https://arstechnica.com/tech-policy/2009/09/your-secrets-live-online-in-databases-of-ruin/ https://arstechnica.com/tech-policy/2009/09/your-secrets-liv... "At the time GIC released the data, William Weld, then Governor of Massachusetts, assured the public that GIC had protected patient privacy by deleting identifiers. In response, then-graduate student Sweeney started hunting for the Governor’s hospital records in the GIC data. She knew that Governor Weld resided in Cambridge, Massachusetts, a city of 54,000 residents and seven ZIP codes. For twenty dollars, she purchased the complete voter rolls from the city of Cambridge, a database containing, among other things, the name, address, ZIP code, birth date, and sex of every voter. By combining this data with the GIC records, Sweeney found Governor Weld with ease. Only six people in Cambridge shared his birth date, only three of them men, and of them, only he lived in his ZIP code. In a theatrical flourish, Dr. Sweeney sent the Governor’s health records (which included diagnoses and prescriptions) to his office." This same article also mentions one of her more famous findings too: "in 2000, she showed that 87 percent of all Americans could be uniquely identified using only three bits of information: ZIP code, birthdate, and sex."
    - ghaff 3y ago
      Yep. I've used that example in presentations. If you really want to de-anonymize a medical record, it's pretty easy to do so on the basis of other data which is arguably public for good reasons (and/or as a matter of law).
      - bombcar 3y ago
        Even if you remove all location and date information from a medical record, you can likely work out quite a bit of information (certain procedures occur at certain times, etc). And at that point you’re starting to destroy the value of the data.
    - dclowd9901 3y ago
      I’m sorry but I don’t buy that. From a practical stand point, what am I going to do if you hand me a sex, birthdate and zip code and tell me to find who owns them? I would have to talk to every person in that zip code who matched the sex (have to account for the possibility two people have the same birthday). At that point, I’m getting better records pounding the streets than I am from some database.
- MichaelZuo 3y ago
  > Anonymization is hard. Unless you have very accomplished cryptographers defining and implementing anonymization, I do not trust it. That basically means not trusting anyone but large governments and FAANG companies. Huh that is pretty solid point, so anonymization is useless to those who are the most interested in privacy?
  - yieldcrv 3y ago
    no its useless to people with several distinct data points turns out that in this regard, everyone is special
- catchnear4321 3y ago
  > That basically means not trusting anyone but large governments and FAANG companies. that basically means not trusting… anyone?
flandish 3y ago
I worked with de-identification of records - it was not only difficult, but also rewarding. The records were used in research, tied to other biomedical data. Some of it was simply migration of encounter data +/- a date range, with removal of the obvious stuff, too. Other was cool like NLP on doc notes to ensure stuff like “pt said the school shooting they got this wound from was..” (think: cohort sizes for major incidents are often small and therefore easy to re-id.)
KingMob 3y ago
This is just incorrect. I've collaborated in studies using anonymized MRI scans and health data. You don't get a blank check, but there are plenty of studies doing exactly this.

mr_toad 3y ago

Anonymised collections of health records are available to bona fide researchers.

ghaff 3y ago
The point is that "anonymized" data is frequently relatively straightforward to de-anomymize at least on a statistical basis.
- mr_toad 3y ago
  That doesn’t make what I said any less true. Anonymised datasets have been available to researchers for decades.

kccqzy 3y ago

Anonymization is hard. Unless you have very accomplished cryptographers defining and implementing anonymization, I do not trust it. That basically means not trusting anyone but large governments and FAANG companies. That said I do think agencies like NIST should define anonymization standards.

bombcar 3y ago
And medical issues are such that even fully anonymous you can probably identify who is whom.
- jasonhong 3y ago
  Latanya Sweeney demonstrated how hard it is to anonymize health data back in the late 1990s as part of her dissertation work: https://arstechnica.com/tech-policy/2009/09/your-secrets-live-online-in-databases-of-ruin/ https://arstechnica.com/tech-policy/2009/09/your-secrets-liv... "At the time GIC released the data, William Weld, then Governor of Massachusetts, assured the public that GIC had protected patient privacy by deleting identifiers. In response, then-graduate student Sweeney started hunting for the Governor’s hospital records in the GIC data. She knew that Governor Weld resided in Cambridge, Massachusetts, a city of 54,000 residents and seven ZIP codes. For twenty dollars, she purchased the complete voter rolls from the city of Cambridge, a database containing, among other things, the name, address, ZIP code, birth date, and sex of every voter. By combining this data with the GIC records, Sweeney found Governor Weld with ease. Only six people in Cambridge shared his birth date, only three of them men, and of them, only he lived in his ZIP code. In a theatrical flourish, Dr. Sweeney sent the Governor’s health records (which included diagnoses and prescriptions) to his office." This same article also mentions one of her more famous findings too: "in 2000, she showed that 87 percent of all Americans could be uniquely identified using only three bits of information: ZIP code, birthdate, and sex."
  - ghaff 3y ago
    Yep. I've used that example in presentations. If you really want to de-anonymize a medical record, it's pretty easy to do so on the basis of other data which is arguably public for good reasons (and/or as a matter of law).
    - bombcar 3y ago
      Even if you remove all location and date information from a medical record, you can likely work out quite a bit of information (certain procedures occur at certain times, etc). And at that point you’re starting to destroy the value of the data.
  - dclowd9901 3y ago
    I’m sorry but I don’t buy that. From a practical stand point, what am I going to do if you hand me a sex, birthdate and zip code and tell me to find who owns them? I would have to talk to every person in that zip code who matched the sex (have to account for the possibility two people have the same birthday). At that point, I’m getting better records pounding the streets than I am from some database.
MichaelZuo 3y ago
> Anonymization is hard. Unless you have very accomplished cryptographers defining and implementing anonymization, I do not trust it. That basically means not trusting anyone but large governments and FAANG companies. Huh that is pretty solid point, so anonymization is useless to those who are the most interested in privacy?
- yieldcrv 3y ago
  no its useless to people with several distinct data points turns out that in this regard, everyone is special
catchnear4321 3y ago
> That basically means not trusting anyone but large governments and FAANG companies. that basically means not trusting… anyone?

flandish 3y ago

I worked with de-identification of records - it was not only difficult, but also rewarding. The records were used in research, tied to other biomedical data. Some of it was simply migration of encounter data +/- a date range, with removal of the obvious stuff, too. Other was cool like NLP on doc notes to ensure stuff like “pt said the school shooting they got this wound from was..” (think: cohort sizes for major incidents are often small and therefore easy to re-id.)

KingMob 3y ago

This is just incorrect. I've collaborated in studies using anonymized MRI scans and health data. You don't get a blank check, but there are plenty of studies doing exactly this.