<story><title>Hospitals are selling troves of medical data</title><url>https://www.theverge.com/2021/6/23/22547397/medical-records-health-data-hospitals-research</url></story><parent_chain></parent_chain><comment><author>prepend</author><text>I’m glad to see this getting more attention as it seems scary to me as a private citizen who wants my medical data to stay private.&lt;p&gt;I’m not sure how to defend against this as it seems based on HIPAA and what it allows. Since de-identified data can be legally sold, I think it will.&lt;p&gt;The theoretical defense I’ve thought up is a class action lawsuit for synthetic breaches. Since these data are deemed de-identified by expert determination [0] and that’s hazy, if I could reidentify myself after de-id, and I didn’t authorize it, then I could be eligible for breach damages for HIPAA violations up to $50k per person [1].&lt;p&gt;Since these sets have millions of people, likely everyone in the country. And since expert determination can possibly classify an acceptable re-id risk as less than 1%, this could be a million or two people. So a big enough pool to attract big legal investments.&lt;p&gt;That would increase the cost and risk of doing this to outweigh the benefits. But currently it’s “free money” for any healthcare system that’s kind of impossible for me as a patient to opt out.&lt;p&gt;[0] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.hhs.gov&amp;#x2F;hipaa&amp;#x2F;for-professionals&amp;#x2F;privacy&amp;#x2F;special-topics&amp;#x2F;de-identification&amp;#x2F;index.html&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.hhs.gov&amp;#x2F;hipaa&amp;#x2F;for-professionals&amp;#x2F;privacy&amp;#x2F;special-...&lt;/a&gt;
[1] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.injuryclaimcoach.com&amp;#x2F;hipaa-violations.html&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.injuryclaimcoach.com&amp;#x2F;hipaa-violations.html&lt;/a&gt;</text></comment>
<story><title>Hospitals are selling troves of medical data</title><url>https://www.theverge.com/2021/6/23/22547397/medical-records-health-data-hospitals-research</url></story><parent_chain></parent_chain><comment><author>Frost1x</author><text>Information is information and the more you have, the easier it is to figure out where it came from. Some data makes it easier than others.&lt;p&gt;I worked with a hospital awhile back with patient radiological data (for free and for science). Patients had to explicly sign-off that they were sharing their data with us and what we planned to use it for. A lot of the metadata from DICOM wasn&amp;#x27;t even wiped, I had their names, street addresses, all sorts of stuff which was supposed to be wiped (de-identified).&lt;p&gt;Even then, I worked with data from a patient with a brain tumor and their neurosurgeon looking to remove it. That data was correctly anonymoized but it was their head, so I could basically reconstruct their face--so is a coarse geomerric sampling of a face de-identified? I guess it depends on how coarse it was.&lt;p&gt;Just look at what&amp;#x27;s done with social media, advertising, and browser data to get an idea of where things can go.</text></comment>