There was an interesting Businessweek article[1] on the sale of pseudoanonymised data to private companies in the US. One Harvard researcher acquired one such database and was able to identify some individuals:
Latanya Sweeney, the director of Harvard University’s Data Privacy Lab, identified 35 patients from a Washington database by buying state medical data and creating a simple software program to cross-reference that information with news reports and other public records. “All I have to know is a little bit about a person and when they went to a hospital, and I can find their medical record in this kind of data,” Sweeney says. She says data in 25 other states are just as vulnerable.
The whole article is an interesting read. Apparently the data is sold pseudoanonymised in some states, leaving it up to the purchaser to truly anonymise the data.
Police and researchers have provisions to request access to the database under HIPAA
The Harvard researcher probably fell under research for public health. I'd hope private researchers can access public health data. The goal for "ICD" global standardized diagnoses codes is to help research.
There are rules for distribution and compliance that should carry over to each handler of the data sets.
Given all that, I still have anxiety of bad actors handling the private information.
It's not as cut and dry as that, apparently. From that BusinessWeek article:
Washington State’s health agency sold its database 95 times that year, collecting a mere $15,950. Donn Moyer, a spokesman for the state’s health department, says it chose to release extra identifying information such as patients’ Zip Codes to make its data more useful.
The Harvard researcher's point is that it's possible to identify individuals in the datasets being sold in some scenarios.
Comments
There was an interesting Businessweek article[1] on the sale of pseudoanonymised data to private companies in the US. One Harvard researcher acquired one such database and was able to identify some individuals:
The whole article is an interesting read. Apparently the data is sold pseudoanonymised in some states, leaving it up to the purchaser to truly anonymise the data.
[1]http://mobile.businessweek.com/articles/2013-08-08/your-medi...
Police and researchers have provisions to request access to the database under HIPAA
The Harvard researcher probably fell under research for public health. I'd hope private researchers can access public health data. The goal for "ICD" global standardized diagnoses codes is to help research.
There are rules for distribution and compliance that should carry over to each handler of the data sets.
Given all that, I still have anxiety of bad actors handling the private information.
It's not as cut and dry as that, apparently. From that BusinessWeek article:
The Harvard researcher's point is that it's possible to identify individuals in the datasets being sold in some scenarios.