Hacker News Reader

Comment by nradov | Hacker News Reader

What is the specific basis for your belief that patient re-identification is possible? The federal government has provided clear guidance on de-identification which should eliminate that as a serious concern.

https://www.hhs.gov/hipaa/for-professionals/privacy/special-...

View on HN

Notice that this is a policy document outlining a process, and that one outcome of following that process can be not sharing the data! It's not as simple as "follow these rules and you can share the data". It can also be "follow these rules, which tell you not to share the data".

It's also possible to reach an outcome that the data can be shared but must be de-identified in a way that precludes important statistical tests. Any sparse feature is incredibly powerful for re-id, and combined with other features might be difficult to share without running afoul of de-id best practice. The problem: rare medical conditions that must be accounted for in a statistical study of vaccine side-effects are examples of sparse features. So you can share the dataset, but not in a way that's useful for a non-GIGO statistical study.

The thing is; in practice, how can you re-id someone that has a very rare medical condition if you don't already know that the person has this very rare medical condition ?

"this person is certainly my biology teacher, who shared the fact that she had a rare genetic disorder during our Genetics unit as well as <insert otherwise non-identifiable columns>. She has herpes. Or also she has an alcohol problem and used to do acid." Teacher is now fired.

You also keep ignoring the issue of consent. Step one is to ask patients.

Or the person shared their story on the public website of a "Run For The Cure" style website about that genetic disorder.

Or so on.

"Sparse Features" aren't always a thing that the person wants to keep private.

You can construct all sorts of artificial theoretical risks. There's no evidence of that being a real risk with this particular data set.

It's that knowing that someone has a rare medical condition that someone willingly shared can be a signal to find out other things in their medical records that they may not have wanted to share with others they know.

Let's look in practice, as they exist: look at VAERS for example, it's in this exact situation (these are public records posted on a public and non-confidential HTTP server):

https://vaers.hhs.gov/data/datasets.html

This is the type of raw records we are talking about, and they carry useful information.

Yes, maybe the dates could be anonymised better, if I know the age of someone, and I know when he got his vaccine precisely, and when he got his MRI and why he did it, then maybe I can find and connect back the record. But how likely this attack can be done in practice, and why would you do it to someone who already disclosed part of their records, plus how does it scale ?

However, the benefits are really present, it's not sharing just for the sake of sharing but to bring advance to the global research and knowledge of medicine.

In practice, who is it ? I don't know, who can know ? Doctors who can tie it to other pieces of information that we don't have...

However, in the meantime, the researchers and doctors who don't have these foreign keys, they can totally do interesting and useful discoveries about drug interactions and vaccine side-effects.

I can show you 10 code snippets that don’t contain sec vulns. Therefore, software security is easy.

What this boils down to is a set of observable factors being multiplied. Probably millions of people got the shot in August. From them, probably tens of thousands were overweight. From them, hundreds had diabetes. Add a few other factors like rough age and gender and you get to that one person along with all of their medical history. If we are not talking about the entire US but can know the state, for example, the task becomes so much easier.

Under the safe-harbor deidentification guide you posted, all dates must be removed except for the year. If this was done on a clinical trial dataset, the data would be useless. Specifically for the COVID vaccine trial, the “statistic” used is the number of days between when the patient enters the study and when they get COVID. This is called TTE or time-to-event and underpins the entire study design. You need the exact date the patient entered the study AND contracted COVID to calculate the TTE value. Without this information, you have no chance of validating the results of the study.

Focusing on the date aspect for a minute: is it possible to adjust the data (before the deidentification process) and convert relevant absolute dates into durations? For example, is it possible (and is it useful) to adjust the data so that it says something like "patient abc123 entered the study in 2021 and 83 days after receiving a vaccine they showed started to show symptoms. Symptoms ended 3 days later"

COVID has a strong absolute-calendar trends (variants, waves), so removing the absolute dates might harm the analysis.

Interesting point, that makes sense. Thanks.

This would be great :)

MIT researchers have been able to assign cafeteria bills to individuals with 80% probability. With any identification information as well as timestamps removed. Correlating datasets gets pretty powerful pretty fast. Also, if the data is made public, we are basically betting, that it is not possible to deanonymize in the future. Given the rate of technological development, I’d be very reluctant to make that bet.

You will know when a patient visits a study site from the deidentified data. At minimum they will have two visits for shots and a follow-up for a blood draw. You'll also know at least their approximate age and sex. Publicly available location trace databases and purchase histories are probably enough to match a lot of the trial participants.

Reply on news.ycombinator.com