Hacker News Reader

Comment by dekhn | Hacker News Reader

An aside: doctors shouldn't be discussing people's test results, even if they anonymize and/or aggregate the patient data, without previously receiving consent, and even then I don't think it's really wise to provide quotes like this to reporters.

View on HN

There are well-considered standards for patient anonymity. Saying "I had a patient with X disease" is not compromising the identity of the patient. Without that, doctors couldn't teach medicine to med students or explain their cases at conferences.

Fair enough, but I'm not sure that will be good enough for much longer. With bigger and better datasets it should be increasingly easy to de-anonymize someone based on just knowing something like that.

Something like what, that a specific doctor has treated someone with a specific condition? I'm not sure that's enough metadata.

I can confirm that's not and could never be a HIPAA violation. The information that Doctor X once ordered a blood test for John or Jane Doe with Result Z is totally fine. There's no non-HIPAA violating metadata that could make that information useful.

There are papers about de-anonimizing patient records and they show that for instance, patient records + facebook is definitely enough to fill in the names correctly.

You do realize that with your standard of never-say-anything you're calling pretty much 200 years of medical study on violation.

That sounds great until you read the original stories detailing how they arrived at these standards.

I mean it's utilitarian attitude on the surface, but the usefulness of medicine will be significantly degraded for everyone if patient records become public records.

> the usefulness of medicine will be significantly degraded for everyone if patient records become public records

Huh? The reason why doctor-patient confidentiality exists is to encourage people to seek treatment without fear of embarrassment or retaliation.

Actually, sufficiently aggregated health data is generally fine to release publicly since it can not be tied to an individual. Anonymized data you must be very careful with, since individual data elements can frequently be combined to re-identify someone.

In support of your point about "sufficently aggregated" data, I occasionally work on projects that publish aggregate health statistics, and you have to be very careful about the size of your denominators. For instance, even without telling what numbers you are dividing, you probably couldn't publish the percentage of HIV positive results among pacific islanders in Nebraska. Because there might be only six such people.

Good point!

IIRC this is why HHS and HIPAA regulations specify "all ages over 89" as protected health information for purposes of data deidentification – there just aren't that many people who have lived that long.

It also specifies all date elements for patient-specific events (including treatment) more specific than the year must be removed for deidentification generally.

So "I treated a skier with a broken leg in the last skiing season" is something a doctor can't say? (Skiing season is shorter than a year.)

Actually, giving a year of a winter/summer sport-related accident already provides a shorter window for when the accident has occurred. So should all case reports about such be giving at least a two year long window?

Oddly enough, it turns out to be 836(!), which is definitely higher than I would have guessed.

http://www.infoplease.com/us/census/data/nebraska/demographi...

Those are presumably not all HIV positive.

Yes, but what personal or privacy-compromising information does "6 of this list of 836 people have HIV" convey? That that population has a higher-than-normal incidence of HIV as compared the US at large? That's potentially valuable aggregate health information, but I don't see how that compromises anyone's privacy.

It would if you reported "6 of 836 were HIV+ on Tuesday. The next day, a new couple moved into town. On Wednesday, 7 of 838 were HIV+." I don't think the aggregated data that is contemplated here is released on nearly that frequency.

All of the responses to my comment are missing the point: you're discussing medical researchers. This was a random doctor in the affected area who spoke to reporters.

I'm quite aware of what is acceptable to release in a medical context; this was not that.

I'm not sure what the problem is though. In all likelihood the doctor has been trained on HIPAA procedures.

And yet seems to have violated them (I've cited the specific section of regs elsewhere in the thread). But deidentification is one of those things people who don't freak with it often, even trained in the rules, always seem to think is easier than it is.

I never said the doctor violated a law. I think what the doctor said (in speaking about a specific patient): "The doctor said one corrected report is for a patient she sent to the emergency room after receiving abnormally elevated test results from Theranos in late 2014." was ethically dubious.

Most of the people who are replying negatively to my comments are misinterpreting my position: either suggesting that I implied there was a HIPAA violation, or that I think medical research data should be suppressed. Neither of those is true.

I'm quite aware of what is acceptable to release in a medical context; this was not that.

I'm sure you'll be able to cite the regulation that was broken, then.

That's not quite how HIPPA works. I don't see anything wrong with the amount of information given here. How else could they talk about stuff like this, anyway? It's important to get out there for people to be aware of.

As long as HIPAA rules are followed I don't see an issue. Further more I would argue that the doctors in this case have a moral imperative to inform the public just how harmful these faulty test results have been. It is becoming clear that Theranos has harmed patients and public knowledge of this is crucial to discover more cases and inform those whom may have had medical decisions made on faulty testing.

Unless specifically cleared by a deidentification expert as provided in 45 CFR 164.514(b)(1), this doesn't meet the requirements of HIPAA for deidentification of information derived from PHI, since it does not remove "All elements of dates (except year) for dates directly related to an individual, including birth date, admission date, discharge date, date of death" [0], in that it includes the specific month of the test.

[0] 45 CFR 164.514(b)(2)(i)(C)

No your interpretation is wrong. Date does not means month. Date contains Day/Month/Year. Here are 2.5 Million raw inpatient visits released by New York State meeting criteria for HIPAA Limited data, as you can see not only do they contain month and year but also day of the week. [1,2]

[1] http://www.hopkinsmedicine.org/institutional_review_board/hi... [2] https://health.data.ny.gov/Health/Hospital-Inpatient-Dischar...

I might be missing the obvious, but I don't see any months in the de-identified dataset you linked?

Your second link also says a limited dataset is considered PHI and can only be shared with third party under certain conditions and with a data use agreement.

Date consists of day/month/year, yes.

Elements of date other year, what must be removed to meet the blanket, by element test, means both month and date must be removed.

The alternate standard, which is typically used by large scale releases, is review by a professional expert (the specific expertise and determination is in the reg I cited) to validate that they aren't reidentifiable.

Your first link is not what you describe, it's a description of the definition of a limited data set under HIPAA, which can be disclosed for research, public health, and health care operations purposes. It notes that it can include full dates, and also explicitly notes that it is explicitly not considered deidentified, but is still PHI under HIPAA.

Your second link is unrelated to the first, and does contain day of week and year, but I don't see month. In any case, it's the kind of release from the kind of organization that is likely to have professional on staff and not rely on the blanket, by-element deidentification standard. That's not true of most practices and practitioners.

Actually individual physicians who have treated patients have far far lower requirements, otherwise they would not be able to discuss cases with their colleagues and would have a chilling effect on practice of medicine. What the links show is that its considered acceptable even at level of millions of patients.

that's the kind of thinking that is the reason we have such bad medicine.

medicine and all its research needs to be open, people have no privacy anywhere else, and to keep insisting on it for medical data is only allowing governments and huge corporations to take advantage of our lack of knowledge about drug affects etc..

the major reason there is even a debate about vaccines is because of this weird belief that we need to keep medical records siloed from researchers and the public when this information is probably of the highest value to us as a society.

but instead we just post everything else about ourselves on the Internet and those things can actually be used to hurt or segregate us from knowledge that will help us overall.

one of those weird things I've never understood about society's ability to be completely distracted from its own self interest.

Are you suggesting all health records should be available to the public?

Yes, they should. And they should make it easier to do so. Privacy in medicine is holding us back.

Reply on news.ycombinator.com