Hacker News Reader

Comment by fwdpropaganda | Hacker News Reader

How did they get this data?

From the third sentence in the article:

> To conduct the study, Google obtained de-identified data of 216,221 adults, with more than 46 billion data points between them. The data span 11 combined years at two hospitals, University of California San Francisco Medical Center (from 2012-2016) and University of Chicago Medicine (2009-2016).

I know I'm not supposed to say 'Did you read the article?', so I won't say that.

It was rhetorical. As in: They're not supposed to have this, why are hospitals giving Google our data?

If you deidentify the data, you're allowed to use it for R&D purposes.

On top of this, getting access to this data surely required ethical approval from multiple institutions (IRB). I am getting pictures from a few patients and I had to have a whole security audit on how the information would be stored and secured, along with who would have access.

Yes, the approval of at least one IRB is also required.

de-identified is the key word here. That's how they attained the data in a HIPAA compliant way.

Yes there are problems with combining that data with other datasets to re-identify. Google would be in a rather good place to do that.

Even without googles abilities, it turns out that, to the surprise of no one, the medical field doesn't the level of information security expertise we might all wish they did:

http://www.zdnet.com/article/re-identification-possible-with...

That de-identification is probably the absolute minimum they have to do to achieve compliance, but don't mistake it and think that the data is actually anonymous. We've seen many studies show that 90%+ of the people can be re-identified from such datasets.

Unless Google starts using fully homomorphic encryption or something similar, then you should consider that data non-anonymous. And until that happens, Google and national healthcare agencies should also require consent from the patients before giving the data to Google or any other company for such studies. Otherwise, I hope class action lawsuits will be started against both.

I'm not sure why you are downvoted about this.

I've went through 10 research papers on this very subject last week, all from 2016-2017, and this is a huge problem.

Just because google does it, people assume it's infallible, where in reality there are bunch of methods to deanonymize data, from machine learning to pure mathematical models on binary vs categorical inputs and such.

In this day and age, somebody will publish the deanonymized, cross-referenced (from voting registry or whatever) set online for free searching.

Then again, most people are fine with this, as long as their names aren't on the list, so considering it's 200k sample out of 323M population, at most 0.7% will be really outraged. Which may explain the down votes he's receiving. 99.3% names aren't on the list, and from that set they want the scoop on the rest of their neighbors.

Homomorphic encryption currently doesn't exist in any useful sense. So you are asking for the impossible. If we followed your advice, medical record research would be impossible. All research comes with risks. Society is all about balancing those risks with there potential benefits.

Come back with your criticisms when you have actual evidence of Google mishandling data or misleading the IRB boards.

> All research comes with risks.

And the core foundation of medical ethics is that the patient gets to decide if/how much of that risk to take.

Reply on news.ycombinator.com