3 ms·
> when you talk to compliance people, they often take a very narrow view of what "identifiable" is. The standard is often that it has to be more or less trivial
by ronaldx 13y ago
> when you talk to compliance people, they often take a very narrow view of what "identifiable" is. The standard is often that it has to be more or less trivial to do.
Frankly, I would expect those compliance people to be disciplined for this obvious neglect of their duties.
(or whoever is responsible for the custom that 'identifiable' means 'identifiable to a 2 year old')
This reminds me strongly of ethically obviously-wrong tax avoidance schemes. "Yes, it's OK to pretend you're a used car salesman for tax purposes. There's nothing illegal about it." Let's get real.
- JunkDNA 13y agoThis stuff isn't done in a vacuum by compliance offices. It's done with guidance from HHS. HIPAA has a lot of stuff that is not clearly defined. As a result, it's important to be keeping with the spirit of the rule or HHS will come after you. The analogous healthcare loophole scenario you describe would not hold water with HHS. Again, my perspective is from the biomedical research world for which the HIPAA privacy rule gives certain limited affordances for communicating patient data that is de-identified to other institutions. Without that safety valve of de-identification being fairly reasonable, there are tons of research studies that would not be allowed to go forward. There is a point where the very tiny risk of re-identification is vastly outweighed by the good of a research study going forward. This is what HHS and institutional review boards struggle with all the time.
- rmrfrmrf 13y ago> (or whoever is responsible for the custom that 'identifiable' means 'identifiable to a 2 year old') You mean the American people? If you don't like that definition, propose a bill and get signatures.