|
|
|
|
|
Identifiability Project |
Response to Amici Brief of El Emam and Yakowitz by Latanya Sweeney
This paper addresses Respondent's arguments, as supported by an amici brief filed
by Dr. Khaled El Emam and Jane Yakowitz, which in turn, addressed Petitioner's
arguments, as supported by amici briefs filed by the Electronic Privacy Information
Center, the Electronic Frontier Foundation, the AARP and the National Legislative
Association on Prescription Drug Prices, and the Vermont Medical Society, on the
limited issue of privacy risks of de-identified patient data that is regulated
by the Vermont statute.
L. Sweeney
Patient Privacy Risks in U.S. Supreme Court Case
Sorrell v. IMS Health Inc.: Response to Amici Brief of El Emam and Yakowitz.
Data Privacy Lab Working Paper 1027-1015B. Cambridge 2011.
(PDF).
Keywords: HIPAA Privacy Rule, identifiability, data privacy, re-identification
Related links:
In today's data rich networked society, money and outmoded privacy practices
are driving personal data into the vaults of private industry networks, notwithstanding
potential harms that can result to data subjects. A classic example is IMS Health ("IMS"),
which receives prescription data from pharmacies and sells versions of it to pharmaceutical
companies for marketing purposes. IMS relies on what can be the weakest of the HIPAA data
sharing provisions, allowing for self-assessed claims of confidentiality. There is no
external review of IMS' de-identification process, no public detailed statement
describing it, and what is reported about it, exposes known vulnerabilities for
re-identifying patients. Once data are deemed de-identified under HIPAA,
they can be shared widely for any purpose. A stronger HIPAA provision exists,
but presumably IMS does not use it because doing so would thwart linking and the ability
to construct longitudinal patient records. During the 8 years of the HIPAA Privacy Rule,
society has experienced an explosion in the amount of data collected on individuals,
challenging HIPAA's 1990s styled protection. Yet, IMS has expressed no desire to adapt
or seek less privacy-invasive approaches, which are possible under HIPAA. IMS has
not augmented its approach with traditional remedies (e.g. Fair Information Practices
or informed consent), nor has IMS reported interest in exploring new promising scientific
or societal approaches to privacy protection. The Vermont Statute, which prohibits
the sharing of prescription records, is an effective privacy guard. Unfortunately,
IMS and the Vermont Statute leave society with a false belief that one must choose
between a secretive privacy-invasive approach or no data sharing at all, overlooking
possible ways for society to reap data sharing benefits with privacy protection.