http://www.thehealthcareblog.com/the_health_care_blog/2009/09/hipaas-broken-promises.html#comments

Orwellian indeed! The word panopticon comes to mind, too. When I put out a few key points of this article on Twitter I got back another haunting phrase: “gossip biography” (from @EvidenceMatters).

Thanks so much for adding these insights. I love the idea of working towards a “utility curve.” Can lawyers, coders, health researchers, patients, etc. all contribute to getting there?

At first I read:

“Ohm uses a haunting phrase to describe the possibility of re-identification: the database of ruin. It will reveal all our secrets to everyone, at any time, and follow us wherever we go.”

…and I thought “Database of Ruin” sounds a bit Orwellian. But the reality is, as more and more data is collected it will be increasingly impossible to completely anonymize it.

But who would want to access to this identifiable roster?

THEY would need ALL the data and very SOPHISTICATED ALGORYTHYMS and trained HUMAN ANALYSIS to kludge it all together again…maybe some Computer Scientist structured data Subject Matter Experts can make it LOOK easy, but not so much. This would be a considerably difficult undertaking. Although it seems nearly impossible, the entire health industry and IT industry are moving in that direction, and with there funding and talented ability to avoid regulatory impediments, they’ll most likely get there.

I believe this is an inevitability due to the efficiencies and benefits of information sharing, especially in a field where basic, clinical, and longitudinal studies are very active, not to mention information intensive decision cycles in treatment.

That said, the debate should be elevated to determine how to manage the risks…how to know when it’s worth the danger of ‘being revealed’ for the benefits of informing researchers and care givers. It may be more productive than the polarizing ‘they’ who will build a ‘database of ruin’ to destroy humanity vs. ‘they’ who impede science to ‘hide’ their ‘gluttonous’ preventable illnesses.

This type of novel research in Risk Management will benefit several other industries which as a result of the Information Age (and globalization) are facing regulatory, policy, ethics, and poignantly ‘management’ debates surrounding information management. Many of these topics are classical legal and political issues, which have resurfaced in modernized forms, being revisited generally because IT advancements. A great case in point is digital signatures…many lawyers had to dust off the books when that rolled around in the early ’90s.

IMHO, it’s really a utility curve we should be working towards. A model which all stakeholders could leverage as means to inform and empower themselves in their individual roles (especially patients and regulators), and to hopefully optimize the Health Care Information Market.

I have to give credit to Jules Polonetsky, Co-chair and Director of the Future of Privacy Forum, who called Paul Ohm’s article “one of the most important papers of the year.” (Follow his tweets: http://twitter.com/JulesPolonetsky )

One of my goals in writing this is to bring together the two worlds of health mavens and privacy mavens. Just as we’ve urged statistical literacy and data literacy, I am urging privacy/security literacy.

Ohm’s article is a great place to start because it’s a page-turner — how can you resist a writer who refers to unicorns and mermaids?? This debate shouldn’t be limited to law professors and code geeks. Too much is at stake.

Great article by Ohm, great take on it by you, Susannah. REALLY puts a potent, relevant light on the subject.

When I first got exposed to all the deep geeky talk about HIPAA (in a meeting at the Center for Democracy and Technology – experts chatting informally about breach notifications, variations in laws, and all that), it was way over my head but I could at least say “As far as I can tell, ALL of these concerns are to protect people from having their data used against them, right?” Everyone nodded.

Now I see this in a whole different light: the data is NOT secure, not at all. So I think you’re exactly right: given that, what do we do?