The lawsuit demonstrates the tension between building A.I. systems and protecting the privacy of patients.
By Daisuke Wakabayashi
SAN FRANCISCO - When the University of Chicago Medical Center announced a partnership to share patient data with Google in
2017, the alliance was promoted as a way to unlock information trapped in electronic health records and improve predictive analysis in medicine.On Wednesday, the University of Chicago, the medical center and Google were sued in a potential class-action lawsuit accusing the hospital of sharing hundreds of thousands of patients' records with the technology giant without stripping identifiable date stamps or doctor's notes.
On first glance, this isn't related to telecommunications - except it is.
HIPAA has exceptions that facilitate statistical analysis, which is one of the most important tools available to researchers who study environment-sensitive diseases such as cancer. I agree that they need that data, but ISTM that HIPAA is being honoroed more in the breach than in the observance.
Database providers have been relying on a work-around hack called "Tokenization" to meet HIPAA privacy requirments. In theory, it's simple: a name like "Bill Horne" becomes "B243677 H38fr05," and my social security number becomes "987-65-4321," and my date of birth becomes "2204-05-31" - and then the data can't be tied to an individual named "Bill Horne". In theory.
Sad to say, the theory doesn't work when it meets business reality: marketers at the database companies don't want to know that B243677 H38fr05 had cancer: they can't sell that fact. They want to be able to tell their clients - such as HR departments in mid-to-large-sized corporations - that they can enter "Bill Horne" into the web interface of a server located in Sri Lanka or Mexico or Kazakhstan, and find out that B243677 H38fr05 might raise their group health-insurance rates and miss a lot of man-hours.
Of course, there are other customers: the morticians at Forest Yawn, hedge-fund managers looking for hidden toxic-waste dumps, medical-tourism salesdroids pitching offshore medical miracles, car salesmen hawking loan insurance with "no physical required," politicians willing to pretend they care about B243677 H38fr05's health, and touchy-feely worthy causes seeking to be included in Mr. H38fr05's last will and testament. The list goes on and on ...
There's more than one way to skin a regulation, and the "Tokenized" data can be traced back to an individual when combined with other databases - wait for it - such as those available from cellular companies.
If B243677 H38fr05 had a polyp removed from his colon at the Dana Farber Cancer institute on 2268-01-06, and a cellular phone belonging to Bill Horne was at that location on that date, and placed or received calls from a physician who performs colonoscopies at Dana Farber, then the Tokenized data has just become part of token security.
Bill Horne Moderator