Hacker News Reader

Comment by invokestatic | Hacker News Reader

I’m a software consultant for Pharma companies and have worked on projects that used the same kind of study design as the Pfizer COVID vaccine (Kaplan-Meier).

“Raw data” is submitted to the FDA in the CDISC format. This format contains a lot of pretty sensitive medical information, including which diseases a patient has, their medical history, what drugs they take, etc. This is supposed to be anonymized, but if the public were to be able to get this info, I strongly believe there is enough information to re-identify patients. And it’s not as simple as just removing the sensitive medical data because the primary or secondary analyses may be dependent on them.

View on HN

What is the specific basis for your belief that patient re-identification is possible? The federal government has provided clear guidance on de-identification which should eliminate that as a serious concern.

https://www.hhs.gov/hipaa/for-professionals/privacy/special-...

Notice that this is a policy document outlining a process, and that one outcome of following that process can be not sharing the data! It's not as simple as "follow these rules and you can share the data". It can also be "follow these rules, which tell you not to share the data".

It's also possible to reach an outcome that the data can be shared but must be de-identified in a way that precludes important statistical tests. Any sparse feature is incredibly powerful for re-id, and combined with other features might be difficult to share without running afoul of de-id best practice. The problem: rare medical conditions that must be accounted for in a statistical study of vaccine side-effects are examples of sparse features. So you can share the dataset, but not in a way that's useful for a non-GIGO statistical study.

The thing is; in practice, how can you re-id someone that has a very rare medical condition if you don't already know that the person has this very rare medical condition ?

"this person is certainly my biology teacher, who shared the fact that she had a rare genetic disorder during our Genetics unit as well as <insert otherwise non-identifiable columns>. She has herpes. Or also she has an alcohol problem and used to do acid." Teacher is now fired.

You also keep ignoring the issue of consent. Step one is to ask patients.

Or the person shared their story on the public website of a "Run For The Cure" style website about that genetic disorder.

Or so on.

"Sparse Features" aren't always a thing that the person wants to keep private.

You can construct all sorts of artificial theoretical risks. There's no evidence of that being a real risk with this particular data set.

It's that knowing that someone has a rare medical condition that someone willingly shared can be a signal to find out other things in their medical records that they may not have wanted to share with others they know.

Let's look in practice, as they exist: look at VAERS for example, it's in this exact situation (these are public records posted on a public and non-confidential HTTP server):

https://vaers.hhs.gov/data/datasets.html

This is the type of raw records we are talking about, and they carry useful information.

Yes, maybe the dates could be anonymised better, if I know the age of someone, and I know when he got his vaccine precisely, and when he got his MRI and why he did it, then maybe I can find and connect back the record. But how likely this attack can be done in practice, and why would you do it to someone who already disclosed part of their records, plus how does it scale ?

However, the benefits are really present, it's not sharing just for the sake of sharing but to bring advance to the global research and knowledge of medicine.

In practice, who is it ? I don't know, who can know ? Doctors who can tie it to other pieces of information that we don't have...

However, in the meantime, the researchers and doctors who don't have these foreign keys, they can totally do interesting and useful discoveries about drug interactions and vaccine side-effects.

I can show you 10 code snippets that don’t contain sec vulns. Therefore, software security is easy.

What this boils down to is a set of observable factors being multiplied. Probably millions of people got the shot in August. From them, probably tens of thousands were overweight. From them, hundreds had diabetes. Add a few other factors like rough age and gender and you get to that one person along with all of their medical history. If we are not talking about the entire US but can know the state, for example, the task becomes so much easier.

Under the safe-harbor deidentification guide you posted, all dates must be removed except for the year. If this was done on a clinical trial dataset, the data would be useless. Specifically for the COVID vaccine trial, the “statistic” used is the number of days between when the patient enters the study and when they get COVID. This is called TTE or time-to-event and underpins the entire study design. You need the exact date the patient entered the study AND contracted COVID to calculate the TTE value. Without this information, you have no chance of validating the results of the study.

Focusing on the date aspect for a minute: is it possible to adjust the data (before the deidentification process) and convert relevant absolute dates into durations? For example, is it possible (and is it useful) to adjust the data so that it says something like "patient abc123 entered the study in 2021 and 83 days after receiving a vaccine they showed started to show symptoms. Symptoms ended 3 days later"

This would be great :)

COVID has a strong absolute-calendar trends (variants, waves), so removing the absolute dates might harm the analysis.

Interesting point, that makes sense. Thanks.

You will know when a patient visits a study site from the deidentified data. At minimum they will have two visits for shots and a follow-up for a blood draw. You'll also know at least their approximate age and sex. Publicly available location trace databases and purchase histories are probably enough to match a lot of the trial participants.

MIT researchers have been able to assign cafeteria bills to individuals with 80% probability. With any identification information as well as timestamps removed. Correlating datasets gets pretty powerful pretty fast. Also, if the data is made public, we are basically betting, that it is not possible to deanonymize in the future. Given the rate of technological development, I’d be very reluctant to make that bet.

didn't netflix have to stop their algorithm recommendation competition because people were starting to identify real people through the samples provided?

See also: the AOL search CD ROM set and many other releases where it turned out that anonymous data isn't.

I’m intrigued. Got any more info on this or something I can google?

I think the AOL search leak reference is this: https://en.m.wikipedia.org/wiki/AOL_search_data_leak

Even if you take more care than AOL did in anonymizing your data, the unfortunate reality is that any publication of data increases the knowledge an adversary has at identifying somebody. Anonymizing is more about reducing the chance someone is identified than guaranteeing they never will be. And high dimensional data is particularly hard to do so in a way that retains the data's usefulness.

33 bits is an old defunct blog on this topic, but it has some interesting posts and academic papers if you want to go down the rabbit hole: https://33bits.wordpress.com/about/

Specific paper on Netflix deanonymization: https://33bits.wordpress.com/about/netflix-paper-home-page/

They key is to combine more than one anonymized dataset, this vastly increases your chances at de-anonymization.

This paper is a very good starting point:

https://papers.ssrn.com/sol3/papers.cfm?abstract_id=1450006

I hear the concern, but no.

There are ways to inject randomness into a dataset, giving subjects plausible deniability without compromising the integrity of the outputs. See https://pair.withgoogle.com/explorables/anonymization/ for a nice example.

Bottom line is, there are ways to share such data safely. Whether the data owner cares enough to do the extra work, especially if doing so removes a competitive advantage, is another story.

I have no qualms with releasing a subset of the data that is properly and irreversibly anonymized. But you have to keep in mind that by introducing “randomness” into the dataset, you limit it’s usefulness to check to make sure the statistics match up with the study’s official topline results.

Furthermore, the FDA submission dataset is essentially a database with dozens of tables each with often hundreds of columns. It’s a LOT of data, with exponential complexity to make sure all the right fields are redacted. There’s also the point that pharma companies are under no obligation to release this data. It’s generally considered proprietary. That said, due to the substantial amount of government funding provided to the development of the vaccine, I think we should be entitled to this information.

If the point is to improve public trust “don’t worry, we manipulated the data to make it more anonymous, but we pinky swear that we didn’t manipulate it in a way that changes the results” is not a good approach.

It is when it's mathematically robust by design, as in the linked post.

Nobody's saying "tamper with the evidence to demonstrate favourable outcomes" here.

And if tampering with the data to favour the data donor were a concern in the first place, then it should be a concern regardless of whether the data donor said they followed further anonymization protocols or not.

> Nobody's saying "tamper with the evidence to demonstrate favourable outcomes" here.

Yeah, so you have badly misread my point, and you're arguing against something completely unrelated to what I'm saying.

Of course you can add randomness to the results to hide individuals without messing with the results in aggregate. That's obvious, and I'm not disputing it. The issue is that that's a PR nightmare. Nobody here might be saying "tamper with it to change the outcome", but I guarantee you that people out wider media will accuse the CDC and Pfizer of doing exactly that. I can see the chyron now, "CDC ADMITS TO MANIPULATING DATA".

Organizations like the CDC need to think not just about how their message will be heard, but how it might be twisted and abused by bad faith actors. You are absolutely right about how you can safely introduce randomness, but you are completely wrong about how that will be handled by the public after bad faith actors get their hands on that fact.

Well now we're completely in the realm of speculation, but, ok, sure.

But I don't necessarily think this would go down much worse than "Big Pharma refuses to share data, what could they be hiding from us" bad faith actors.

At least in the 'inject randomness' scenario you can do some damage control in the media by bringing in experts to explain how this is a valid thing to do and how it protects the average joe from having their lives turned upside down just because they foolishly agreed (or worse, did not agree) to have their data collected.

PHI is not the ‘raw data’ they’re referring to, and you know it.

I think the level of effort we make as a society on medical privacy is backwards. All health information should be public except in extreme circumstances. Right now, it's almost impossible to get datasets on health data. Imagine if 100% of everyone's data was digitized. The amount of health innovation, lives saved, cures found, is likely to be incredibly large. All the costs that go into trying to comply with HIPPA, could be gone.

I get that some people want to prevent the use of the data for discrimination...just legislate that then.

You don't see any potential misuse if having people's STD results publicly available? (To use an extreme case)

With black box AI, any legislation on data use is impossible to enforce. So limiting access to the data might be the only way.

> Raw data” is submitted to the FDA in the CDISC format. This format contains a lot of pretty sensitive medical information, including which diseases a patient has, their medical history, what drugs they take, etc. This is supposed to be anonymized, but if the public were to be able to get this info, I strongly believe there is enough information to re-identify patients

At the time when you inject hundreds of millions of people with it, I'd say this should be mandatory to disclose as much information as possible regarding the actual trials. I don't trust the FDA one bit.

And ? Where is the bad thing to open a dataset of comorbidities and related / suspected effect of vaccines / medications ?

>And ?

What's not to get? OP said:

>... I strongly believe there is enough information to re-identify patients.

Their concern is that just dumping raw data like this into the public would be a massive violation of privacy for countless individuals.

Re-identify based on what ? There are no databases that you can link against if you strip out the major identifiers (like city and date of birth).

It's for the benefit of patients, and this raw data is already available, but under a loose NDA for commercial partners and researchers...

> Re-identify based on what ?

The fact that you poo-poo this question is telling. Preventing re-identification attacks is incredibly subtle and sometimes impossible. Removing "city and date of birth" is nowhere near sufficient.

> this raw data is already available, but under a loose NDA for commercial partners and researchers...

Yes. It's available to people who have their real identities tied to their access and can be sued into oblivion or possibly even prosecuted for wanton misuse of the data. Surely you see how this is different from throwing it on a public s3 bucket, right?

It looks like from what you are saying that it's an incommensurable effort to anonymize reasonably the dataset (the majority of the risks can be hedge by bucketing, and then there can be subtle deanonymization edge cases but they don't scale).

It reminds me the FDA saying they can't release the COVID-19 documents because reviewing 44'000 documents would take 50 years.

It didn't take 50 years to produce them...

Yes there is some effort needed to anonymize reasonably the data but it's not an impossible task. It's a question of motivation.

Here, clearly, the labs and administration don't really want to put efforts into that.

Presumable FDAs analysis assumed current staffing levels. Going to go out on a limb and assume they’ve got a LOT more people involved in creating docs than in deidentifying docs.

And, yes, I think public data on this sort of stuff is important and should be properly resourced.

I think:

Step 1. ASK PERMISSION before changing the way data is handled.

Step 2. Share full datasets more generously, but still gated by use and handling agreements. This probably means a private citizens without ethics research training and a supporting it dept can’t get a copy and peruse it on their personal laptop, but also that a truly enormous number of researchers would be able to access the data.

The gold standard of a CSV in a public s3 bucket shouldn’t be the enemy of good enough.

I'm not so sure that you should be so sure that there are no databases that such data can be referenced against. Regarding stripping out major identifiers, please note that OP commented that "it's not as simple as just removing the sensitive medical data because the primary or secondary analyses may be dependent on them".

And of course raw data like this could benefit patients, but keeping access to raw data limited also benefits patients. Sure, the data is readily available under a loose NDA, but it's available to people who have explicit knowledge of the requirements around handling sensitive, identifiable data. Average Joe's and Jane's do not have this knowledge, and bad actors just plain don't give a shit.

I mean, it’s not like anonymous datasets haven’t been de-anonymized before[0]. Successfully anonymizing data sets is a hard and subtle process, and it’s way harder than just removing major identifiers like city and birth date. For example age is obviously super important for vaccine and disease studies, and providing an age narrows down someone’s birthdate significantly.

And no, this isn’t under a “loose” NDA. This would be covered by HIPAA, which tends to be un-subtle about violations.

0 - https://www.cs.princeton.edu/~arvindn/publications/de-anonym...

"There are no databases that you can link against if you strip out the major identifiers"

Isn't that provably untrue? https://bits.blogs.nytimes.com/2015/01/29/with-a-few-bits-of...

What is your full name and address? Age? Weight? Height? Eye color? Blood pressure? What STDs do you have, if any? How often and how much do you drink? Smoke? Any history of drug use? Mental disorders? What about your family?

Where is the bad thing in you posting this information here right now?

Actually, that's not even analogous. A better analogy would be you post all this info under a pseudonym -- e.g., "rvnx" or something like that -- and then the mods doxing you without your consent.

I'm 36, I weigh 190 lbs, I'm 6'1. My eyes are green. Blood pressure 120/80 (last I checked). No STDs. I drink once a week about 3 servings. I don't smoke. I don't use drugs or have a history of mental disorders. Depression runs in my family.

I only really hesitate to post full name and address but, frankly, I'm sure given my user handle it wouldn't be terribly hard for someone to find both of those.

So tell me, what harm have I done to myself by sharing this information?

>So tell me, what harm have I done to myself by sharing this information?

You're comfortable sharing it, that's cool! Is your neighbor? Your friend? Your cousin? Should they be obligated to divulge their own medical information just because you're fine divulging yours?

More to the point, he didn't even share it. The concern here is re-identification and he chickened out of sharing his identity.

No, he gave the path to reidentify him

Right, which - perhaps to your point - demonstrates how a seemingly innocuous piece of data left in a dataset could be used to, with relative ease, identify that individual.

First, I'm guessing that what you provided is a lot less than someone would have to provide in a medical trial.

Second, demonstrating your willingness to describe yourself on a public forum is a lot different than someone expecting confidentiality when participating in medical trials. Most people do not have your level of comfort disclosing medical details. Furthermore, if a company were to break that trust, why would anybody participate in medical trials? The harm is not to you, it is to society.

> So tell me, what harm have I done to myself by sharing this information?

None, and yet you still aren't willing to put your name behind the statement "I'm healthy as a fiddle and never use drugs except the occasional beer".

Also -- and this will apparently come as a surprise to you -- people who have STDs, abuse drugs/alcohol, or have genetic disorders in their family don't necessarily want that info shared on the internet. Shocking, right?!

Apparently pseudonymous internet griping is an essential right but participants in medical trials should -- post-facto -- have their entire medical history shared in a wy that's at significant risk of reidentification.

Frankly, putting up my name with my medical history has far less to do with having the two linked and far more to do with "I'd rather not have a future employer have an easy link to my social media information".

Oh genetic disorders, you didn't ask about that earlier. My family is a carrier for cystic fibrosis. Is that something that's supposed to be super terrible to share?

I'm not the GP, but frankly I think it's a little crazy how worried everyone is about being identified through round about methods in medical data. Google has a far better bead on exactly who I am than any doctor and, frankly, I'm far more worried about that advertising profile than I am about the "what if's" of my medical data being shared between hospitals and doctors (and potentially being leaked).

>... my name with my medical history...

>My family...

>... I'm far more worried about that advertising profile than I am about the "what if's" of my medical data...

Again - yours. It's great that you're fine with your data being public, but as is evidenced by the way certain posts in this comment chain are being down/upvoted, clearly many other people share the opposite view and would prefer their data remain private.

Other nations have more open laws about sharing medical data than the US. (I believe Iceland? Greenland? One of those island nations has genetic ancestry data for all citizens).

AFAIK, the world hasn't ended and they aren't living in a dystopia because their medical information is so well documented. On the contrary it has served to stop the spread of genetic disorders and aid in medical research.

Certainly I personally don't have these hangups about privacy. I think it's weird that society has created them. Pre-HIPAA that wasn't the case and it wasn't exactly seen as major breaches of privacy for doctors/nurses to talk relatively openly about diseases their patients had. The sanctimony of medical data is a recent development practically unique to the US.

I'm not advocating that we broadcast to everyone details of every medical checkup. I am, however, saying that we shouldn't have nearly the level of restrictions we have around sharing medical information, particularly between medical institutions doing research.

>I think it's a little crazy how worried everyone is about being identified through round about methods in medical data

Do you realize that people were murdered because of their medical history? Like mental illness and ADD were reasons for killing people in America just a couple of decades ago?

And currently, today there places where it is acceptable to drown your own babies if they demonstrate delayed development. Imagine your village elder coming to you and telling you that your baby needs to go in a bucket of water because he has club feet. That is happening. Today.

> Like mental illness and ADD were reasons for killing people in America just a couple of decades ago?

Citation needed.

You realize a couple of decades ago was 2000, right? The closest I can think of what you might be talking about is the eugenics programs ran up to the early 1960s. Even so, those weren't executions, but rather sterilizations. Barbaric, but not murder.

> And currently, today there places where it is acceptable to drown your own babies if they demonstrate delayed development.

And what part of making health recorders more accessible would influence that one way or another? Do you think it's the fact that heath records are hard to access that protects us from parents murdering their children? How are other nations in the EU managing to not kill all their kids for defects!

> "I'd rather not have a future employer have an easy link to my social media information"

So, to be clear, your right to post random ass thoughts on the internet under a pseudonym is sacred... but it's totally reasonable to RENEGE on EXISTING privacy agreements with real world actual existing real human patients about intimate health records?

Just so long as we're clear about the enormous esteem you hold yourself in and the absolute contempt you have for others' privacy...

In practice, the person can be bucketed in an age, height and weight group and then the problem is solved and there is a constructive dataset.

Address and name are not necessary.

- Person 30-35, living in California, has history of obesity, suffers from type II diabetes, under treatment of med A, and med B.

- first dose: Jan 2021

- second dose: March 2021

Medical outcome: ZZZ

I'm genuinely curious - OP has commented about their direct work with pharmaceutical companies on datasets like what we're discussing. Do you have any history of direct work with similar/same datasets yourself?

> So tell me, what harm have I done to myself by sharing this information?

This is irrelevant.

The conditional probability of my willingness to post this information, given your willingness to post this information, is equal to the the probability of my willingness to post this information. P(X) = P(X|Y). This means that just because you are okay with it, I'm not...and additional people being okay with it doesn't change my opinion regardless of harm.

> I don't use drugs or have a history of metal disorders.

Very happy for you, but if you did, you might have learned by now that people (and employers) can treat you very differently after they find out you're an addict or have a mental disorder, and it's best not to telegraph that information to everyone except close friends you can trust.

Don't they ask in the US when you apply for a job if you have any significant disability / disease ? I remember seeing that in many of the job application forms (which I find strange actually).

I don’t think they are allowed to ask those questions. They certainly aren’t allowed to discriminate in hiring or employment based on disabilities

https://www.eeoc.gov/laws/guidance/your-employment-rights-in...

>I don’t think they are allowed to ask those questions

They are DEFINITELY not allowed to ask.

for example, from a startup interview process: Calico, subsidiary of Alphabet: https://www.calicolabs.com/careers?gh_jid=5785761002

> "We are required to measure our progress toward having at least 7% of our workforce be individuals with disabilities. To do this, we must ask applicants and employees if they have a disability or have ever had a disability. Because a person may become disabled at any time, we ask all of our employees to update their information at least every five years.

Identifying yourself as an individual with a disability is voluntary, and we hope that you will choose to do so."

That wording is literally from a US Department of Labor form: https://www.dol.gov/sites/dolgov/files/OFCCP/regs/compliance...

Just stop. This is embarrassing.

It looks like you are trying to drift the intent and scope of the dataset disclosure.

For example, having the list of symptoms, medications and even (just an imaginary example) pulmonary X-Ray or also on the chest having an open dataset of MRI pictures with the age of the patient, history of diseases would considerably help and there is no way you can link it back unless you know the history of the patient already (but then, what's the issue; none because you already know the information).

Plus if you ask the person about it, I really don't see the problem :|

Yes in theory, there is a possibility that someone has a database somewhere of all the boobs spacing, and can determine approximate lungs size, try to guess what could be the likely owner of a lung picture, etc etc, all of that for what ?

The person who is going to benefit from it, is clearly the COVID-19 researchers, and the end-patient.

> It looks like you are trying to drift the intent and scope of the dataset disclosure.

No. Intent doesn't matter. That's the whole point.

To wit: there's a reason that reidentification attacks are called attacks! No one intends to be hacked, and writing a program that you intend to be secure doesn't imply that the program is in fact secure. So too with anonymization.

> having an open dataset of MRI pictures

But we're not talking about MRI pictures, are we?

OP strongly believes that, in this case, there is enough information to re-identify patients. I agree.

Ok then next steps:

Plan A: - sit and do nothing "it's impossible to release any data, too bad, we'll never know!"

Plan B: - "we have a risk that a few % of ppl may be identified if we already know their medical history/details, it's impossible to release any data, too bad!"

Plan C: - "we remove the biggest identifiers to make sure the majority of the people cannot be reasonably identified, this is going to take a few days or weeks of work but will bring benefits to the overall population and transparency on the treatments"

Why don't you include a step where you ask patients if they're ok with their medical history being put in a public s3 bucket?

I'm fully supportive of the right to pseudonymous speech, but it strikes me that you are in an awfully awkward position of speaking anonymously while demanding that you should have access a trove of patient history without signing any sort of data use agreement and without even the most basic step of getting permission from the people whose patient history you insist on seeing.

Ok, why not, this is what I propose:

Asking the user:

"This record is going to be shared publicly, do you agree to share this information (without revealing your name and address) ?

> [...]

This information can help researchers, doctors and people interested into science to discover new information about drugs and diseases interaction."

Cool. Now you’ve got a whopping pile of selection bias added to the dataset.

Yeah, useful selectors for researchers, and still no identity.

We learnt that somewhere there is a man/woman that is depressed and has weight management issue.

We can take policy actions in order to improve the situation and monitor how this affects life of people (e.g. how much antidepressants are used in a year, are the food policies effective, what conditions are often linked to sudden cardiac arrest, etc).

And "Rebecca", nobody knows it's her, except herself, and those to whom she decide to publicly disclose her conditions (e.g. on social networks or to specialists).

No, you’re missing the point.

Asking people in the study if it’s OK to release their data means the resulting data set is skewed. People with certain conditions and other variables will be more or less likely to agree, leaving a non-representative sample of the actual study.

It will no longer be random.

Exactly.

Actually, set aside consent entirely.

The problem is NOT "how do we de-anonymize". That is super easy.

The problem is "how do we de-anonymize IN A WAY THAT LEAVES RESULTS OF RELEVANT STATISTICAL TESTS INVARIANT". Much harder. Remove a bunch of probably non-random points and make any logisitic regression on that dataset return the same result within some delta. There are trivial impossibility theorems. Really, really trivial. "Left as freshman exercise and if you can't some up with an example maybe step back and stop talking about this topic" trivial.

Now, add back consent. "how do we delete a subset of data that is likely not uniformly distributed with respect to risk variables and also de-anonymize the remaining subset of data.... AGAIN, IN A WAY THAT LEAVES RESULTS OF RELEVANT STATISTICAL TESTS INVARIANT". The position is untenable.

And how do you ensure that statistical tests on the original data set are INVARIANT TO THE DE-ANONMYIZATION PROTOCOL WITH RESPECT TO ANY RELEVANT QUERY?

That is WAY harder that it sounds. When you add public disclosure of mismatch between results on public data and private (full) data things are even harder.

Specifically: suppose an independent researcher determines X is true via statistical test Y on the public dataset. Officials must respond, and say "True" or "False".

A small number of queries via this process can be used to infer data that makes re-identification possible. And there will be many more than a small number of queries, including from adversarial agents specifically designing queries to maximize information gain based on previous (public) revelations.

This is a game, in the game theory sense, in which the goal is to exploit the mathematical properties of statistical tests and social dynamics to force public revelations of binary assessments that yield information about individual cells or sets of cells and make re-id possible.

Have you actually studied this stuff, designed de-anonymization protocols, developed re-id threat models, thought about privacy budgets in public disclosure mandates, and at last put your reputation and your customer's privacy on the line when asserting that your statistical methods are resilient against attacks? Or are you just a jawboning know-it-all anonymous coward without any actual experience balancing privacy against public disclosure?

To be honest, all of your posts read like "just stop writing vulnerable software and then there will be no more hackers mmmkay?"

There's no drift, OP stated this clearly in the original post when he wrote: "I strongly believe there is enough information to re-identify patients"

If you were to have access to my MRIs you could almost certainly identify me based on physical characteristics which can be seen in my MRI data which would correlate with data found on social media where I've sometimes generally discussed my medical conditions without going into specifics. There are MRIs for conditions I haven't discussed, in addition to the identifying ones I have.

There are a lot of people with fairly unique medical conditions and body situations (eg: missing a limb, surgical implants). The gap between "I got hurt in this way" and "here's the MRI scans of my body in detail along with other lab notes and other unrelated and possibly extremely embarrassing conditions" is huge

Fair enough, what do you propose to give access to people who want to help ?

Go to work in the field.

A strict data use agreement signed by a real person with tangible assets and reputation at stake, outlining the acceptable and unacceptable uses of the data and well as appropriate data handling rules.

Until/unless patients agree otherwise.

I.e., the status quo.

Anonymizing datasets is time consuming and would take resources away from the FDA to implement, instead of doing it themselves. I have no doubt people want to help but the only way they really could would be to sign a contract with someone who is allowed to share that data internally, and operate in a embargoed situation (such as on-premise) under an NDA.

Otherwise it's sort of like my 10-year-old wanting to help me replace an engine in a car. It's important to let him do it so he can learn but it's likely going to take me much longer to on-board him and get him up to speed than if I did it myself.

I think Pfizer got 50B+ USD in revenue in 2021, maybe they can find a little bit of change somewhere to hire specialists to prepare the data cleanly and release it ?

A dataset that Pfizer spends a ton of money redacting before releasing might not address concerns that Pfizer could be hiding something.

This is already a solved problem.

I have deposited datasets with full transcriptome data, which you can use to infer most of the genome in a straightforward manner, from clinical trials. In that case, you simply use off-the-shelf tools to anonymize datasets by flipping lots of SNPs. Additionally, raw data is made accessible only through an ethics committee. Summary counts from transcriptomes are publicly available, though. There are equivalent practices for other biomarkers.

I must say The British Biomedical Journal (BMJ) is really spearheading all transparency efforts. They have been publishing lots of inconvenient truths for many years. For example, they reported some fairly serious conflicts of interest where professors from Oxford are getting huge "consulting" fees from pharma. And they pretty much publish any reasonable letter to the editor. Nature, Science and Cell, on the other hand, are heavily biased.

> This is already a solved problem... raw data is made accessible only through an ethics committee. Summary counts from transcriptomes are publicly available, though.

Right.

1. I'm not sure you understand the extreme position being taken by rvnx in this thread.

2. Presumably the patients agreed that their transcriptome data could be shared in this way, and you didn't change your data handling post-facto without their consent.

Of course patients need to agree. It's actually even simpler. When you recruit patients into a study they sign an agreement that is broad and usually includes data sharing terms. Properly anonymized, of course.

Said agreements have previously gone through ethics committees which tend to be extremely strict. They are rarely changed afterwards, since this requires agreement of patients, which is impractical to obtain in all but tiny studies.

The only exception I can think of is Scandinavia. They have national registries where all census information, plus electronic health records, is available to researchers by default, unless you explicitly opt out. Their philosophy is that this is a negligible reduction in privacy, in exchange for medical progress. I must note said records are not publicly open, you need to apply for access.

As a consequence, Sweden and Denmark have some of the best epidemiological research in the world and they've been able to spot pretty odd correlations (e.g. ibuprofen and male infertility).

A broad agreement will most likely NOT make it past the institution review board. Any experiment with human subjects has strict rules around consent and data sharing agreements. The legal exposure is huge.

Broad meaning sequencing data (e.g. RNA) from tissues will be made available in public repositories, and accessible via application to committee.

I have had helped draft at least 6 studies with materials coming from our own clinical trials and deposited all data myself. Went through institution review boards without an issue, just like many other equivalent studies.

Perhaps your experience is different because of location? I'm referring to EU.

> Perhaps your experience is different because of location?

AFAIK this is also possible in the US. Probably more hoops to jump through? I don't know anything about the EU. (But also this discussion is basically totally unrelated to the original article or this thread.)

I think we are in violent agreement on substance.

Your comment is somehow relevant to the article and insightful wrt the topic but also off-topic in this thread.

The type data you are suggesting should be shared -- and, more importantly, the consent assumptions -- are not related to the current discussion.

> having an open dataset of MRI pictures with the age of the patient, history of diseases would considerably help and there is no way you can link it back

Facial recognition works perfectly fine on MRI face renders. You speak awfully confidently about a problem you seem to have very little experience in.

As with cryptography: Anyone can come up with suggestion that they themselves can't find an attack against.

True, true, pictures are even one level higher in terms of difficulty to anonymise right (and that's not even what they are asking, here it's about structured text records).

FYI, high-res face MRI are just pictures of the face. So yes, if you share the picture of the face of someone, they may find your identity back, but it's not specific to MRI.

Dealing with any medical record that contains pictures of patient you should take additional steps to prevent identification, and face is the most sensitive part of the body as it can be most likely identified.

If tomorrow there are publicly available anonymised close-up pictures of cardiac MRI, it'd be extremely challenging to map them to their real owner with a 100% certainty but the discoveries it could lead to are very exciting (and the same with skin cancer pictures for example, or suspiciouses moles)

I'll just note that I have no problem with all this information being public for health research. I'd take privacy hits all day long in return for better cures, health, and longevity.

Just curious, do you have anything particularly embarrassing to share? Easy to say when everyone on Tinder can’t Google your name and get “alcoholic with herpes”. I would also be open to share if there was tangible benefit today because I’m healthy. But in the future who knows.

That's admirable, but participants may not share your feelings and they have rights.

Reply on news.ycombinator.com