News for hackers. Stuff that matters.
Re:Theranos Voids Two Years of Edison Blood-Test Results by dekhn on Wednesday May 18, 2016 @09:58PM (#11727417)
An aside: doctors shouldn't be discussing people's test results, even if they anonymize and/or aggregate the patient data, without previously receiving consent, and even then I don't think it's really wise to provide quotes like this to reporters.
Re:Theranos Voids Two Years of Edison Blood-Test Results by jonlucc on Wednesday May 18, 2016 @10:25PM (#11727521)
There are well-considered standards for patient anonymity. Saying "I had a patient with X disease" is not compromising the identity of the patient. Without that, doctors couldn't teach medicine to med students or explain their cases at conferences.
Re:Theranos Voids Two Years of Edison Blood-Test Results by SilasX on Wednesday May 18, 2016 @10:39PM (#11727578)
Fair enough, but I'm not sure that will be good enough for much longer. With bigger and better datasets it should be increasingly easy to de-anonymize someone based on just knowing something like that.
Re:Theranos Voids Two Years of Edison Blood-Test Results by rhizome on Wednesday May 18, 2016 @10:44PM (#11727599)
Something like what, that a specific doctor has treated someone with a specific condition? I'm not sure that's enough metadata.
Re:Theranos Voids Two Years of Edison Blood-Test Results by Dr_tldr on Wednesday May 18, 2016 @11:19PM (#11727716)
I can confirm that's not and could never be a HIPAA violation. The information that Doctor X once ordered a blood test for John or Jane Doe with Result Z is totally fine. There's no non-HIPAA violating metadata that could make that information useful.
Re:Theranos Voids Two Years of Edison Blood-Test Results by iofj on Wednesday May 18, 2016 @10:56PM (#11727640)
There are papers about de-anonimizing patient records and they show that for instance, patient records + facebook is definitely enough to fill in the names correctly.
Re:Theranos Voids Two Years of Edison Blood-Test Results by jonathankoren on Thursday May 19, 2016 @06:04AM (#11729086)
You do realize that with your standard of never-say-anything you're calling pretty much 200 years of medical study on violation.
Re:Theranos Voids Two Years of Edison Blood-Test Results by iofj on Thursday May 19, 2016 @10:51AM (#11730659)
That sounds great until you read the original stories detailing how they arrived at these standards.

I mean it's utilitarian attitude on the surface, but the usefulness of medicine will be significantly degraded for everyone if patient records become public records.

Re:Theranos Voids Two Years of Edison Blood-Test Results by jonathankoren on Thursday May 19, 2016 @11:39AM (#11731028)
> the usefulness of medicine will be significantly degraded for everyone if patient records become public records

Huh? The reason why doctor-patient confidentiality exists is to encourage people to seek treatment without fear of embarrassment or retaliation.

Re:Theranos Voids Two Years of Edison Blood-Test Results by pvnick on Wednesday May 18, 2016 @10:23PM (#11727511)
Actually, sufficiently aggregated health data is generally fine to release publicly since it can not be tied to an individual. Anonymized data you must be very careful with, since individual data elements can frequently be combined to re-identify someone.
Re:Theranos Voids Two Years of Edison Blood-Test Results by sopooneo on Wednesday May 18, 2016 @10:36PM (#11727565)
In support of your point about "sufficently aggregated" data, I occasionally work on projects that publish aggregate health statistics, and you have to be very careful about the size of your denominators. For instance, even without telling what numbers you are dividing, you probably couldn't publish the percentage of HIV positive results among pacific islanders in Nebraska. Because there might be only six such people.
Re:Theranos Voids Two Years of Edison Blood-Test Results by sib on Wednesday May 18, 2016 @11:47PM (#11727822)
Oddly enough, it turns out to be 836(!), which is definitely higher than I would have guessed.

http://www.infoplease.com/us/census/data/nebraska/demographi...

Re:Theranos Voids Two Years of Edison Blood-Test Results by semi-extrinsic on Thursday May 19, 2016 @01:46AM (#11728264)
Those are presumably not all HIV positive.
Re:Theranos Voids Two Years of Edison Blood-Test Results by sokoloff on Friday May 20, 2016 @09:11AM (#11737461)
Yes, but what personal or privacy-compromising information does "6 of this list of 836 people have HIV" convey? That that population has a higher-than-normal incidence of HIV as compared the US at large? That's potentially valuable aggregate health information, but I don't see how that compromises anyone's privacy.

It would if you reported "6 of 836 were HIV+ on Tuesday. The next day, a new couple moved into town. On Wednesday, 7 of 838 were HIV+." I don't think the aggregated data that is contemplated here is released on nearly that frequency.

Re:Theranos Voids Two Years of Edison Blood-Test Results by pvnick on Wednesday May 18, 2016 @10:52PM (#11727626)
Good point!
Re:Theranos Voids Two Years of Edison Blood-Test Results by facetube on Wednesday May 18, 2016 @11:44PM (#11727802)
IIRC this is why HHS and HIPAA regulations specify "all ages over 89" as protected health information for purposes of data deidentification – there just aren't that many people who have lived that long.
Re:Theranos Voids Two Years of Edison Blood-Test Results by dragonwriter on Thursday May 19, 2016 @12:12AM (#11727918)
It also specifies all date elements for patient-specific events (including treatment) more specific than the year must be removed for deidentification generally.
Re:Theranos Voids Two Years of Edison Blood-Test Results by robryk on Thursday May 19, 2016 @05:41AM (#11729022)
So "I treated a skier with a broken leg in the last skiing season" is something a doctor can't say? (Skiing season is shorter than a year.)

Actually, giving a year of a winter/summer sport-related accident already provides a shorter window for when the accident has occurred. So should all case reports about such be giving at least a two year long window?

Re:Theranos Voids Two Years of Edison Blood-Test Results by dekhn on Wednesday May 18, 2016 @10:39PM (#11727576)
All of the responses to my comment are missing the point: you're discussing medical researchers. This was a random doctor in the affected area who spoke to reporters.

I'm quite aware of what is acceptable to release in a medical context; this was not that.

Re:Theranos Voids Two Years of Edison Blood-Test Results by pvnick on Wednesday May 18, 2016 @10:51PM (#11727622)
I'm not sure what the problem is though. In all likelihood the doctor has been trained on HIPAA procedures.
Re:Theranos Voids Two Years of Edison Blood-Test Results by dragonwriter on Thursday May 19, 2016 @12:15AM (#11727922)
And yet seems to have violated them (I've cited the specific section of regs elsewhere in the thread). But deidentification is one of those things people who don't freak with it often, even trained in the rules, always seem to think is easier than it is.
Re:Theranos Voids Two Years of Edison Blood-Test Results by dekhn on Thursday May 19, 2016 @09:27AM (#11729992)
I never said the doctor violated a law. I think what the doctor said (in speaking about a specific patient): "The doctor said one corrected report is for a patient she sent to the emergency room after receiving abnormally elevated test results from Theranos in late 2014." was ethically dubious.

Most of the people who are replying negatively to my comments are misinterpreting my position: either suggesting that I implied there was a HIPAA violation, or that I think medical research data should be suppressed. Neither of those is true.

Re:Theranos Voids Two Years of Edison Blood-Test Results by CamperBob2 on Wednesday May 18, 2016 @11:03PM (#11727664)
I'm quite aware of what is acceptable to release in a medical context; this was not that.

I'm sure you'll be able to cite the regulation that was broken, then.

Re:Theranos Voids Two Years of Edison Blood-Test Results by BinaryIdiot on Wednesday May 18, 2016 @10:37PM (#11727568)
That's not quite how HIPPA works. I don't see anything wrong with the amount of information given here. How else could they talk about stuff like this, anyway? It's important to get out there for people to be aware of.
Re:Theranos Voids Two Years of Edison Blood-Test Results by kosmic_k on Wednesday May 18, 2016 @11:31PM (#11727761)
As long as HIPAA rules are followed I don't see an issue. Further more I would argue that the doctors in this case have a moral imperative to inform the public just how harmful these faulty test results have been. It is becoming clear that Theranos has harmed patients and public knowledge of this is crucial to discover more cases and inform those whom may have had medical decisions made on faulty testing.
Re:Theranos Voids Two Years of Edison Blood-Test Results by dragonwriter on Thursday May 19, 2016 @12:06AM (#11727886)
Unless specifically cleared by a deidentification expert as provided in 45 CFR 164.514(b)(1), this doesn't meet the requirements of HIPAA for deidentification of information derived from PHI, since it does not remove "All elements of dates (except year) for dates directly related to an individual, including birth date, admission date, discharge date, date of death" [0], in that it includes the specific month of the test.

[0] 45 CFR 164.514(b)(2)(i)(C)

Re:Theranos Voids Two Years of Edison Blood-Test Results by aub3bhat on Thursday May 19, 2016 @01:50AM (#11728281)
No your interpretation is wrong. Date does not means month. Date contains Day/Month/Year. Here are 2.5 Million raw inpatient visits released by New York State meeting criteria for HIPAA Limited data, as you can see not only do they contain month and year but also day of the week. [1,2]

[1] http://www.hopkinsmedicine.org/institutional_review_board/hi... [2] https://health.data.ny.gov/Health/Hospital-Inpatient-Dischar...

Re:Theranos Voids Two Years of Edison Blood-Test Results by dragonwriter on Thursday May 19, 2016 @09:06AM (#11729824)
Date consists of day/month/year, yes.

Elements of date other year, what must be removed to meet the blanket, by element test, means both month and date must be removed.

The alternate standard, which is typically used by large scale releases, is review by a professional expert (the specific expertise and determination is in the reg I cited) to validate that they aren't reidentifiable.

Your first link is not what you describe, it's a description of the definition of a limited data set under HIPAA, which can be disclosed for research, public health, and health care operations purposes. It notes that it can include full dates, and also explicitly notes that it is explicitly not considered deidentified, but is still PHI under HIPAA.

Your second link is unrelated to the first, and does contain day of week and year, but I don't see month. In any case, it's the kind of release from the kind of organization that is likely to have professional on staff and not rely on the blanket, by-element deidentification standard. That's not true of most practices and practitioners.

Re:Theranos Voids Two Years of Edison Blood-Test Results by aub3bhat on Thursday May 19, 2016 @09:15AM (#11729897)
Actually individual physicians who have treated patients have far far lower requirements, otherwise they would not be able to discuss cases with their colleagues and would have a chilling effect on practice of medicine. What the links show is that its considered acceptable even at level of millions of patients.
Re:Theranos Voids Two Years of Edison Blood-Test Results by ramchip on Thursday May 19, 2016 @02:21AM (#11728390)
I might be missing the obvious, but I don't see any months in the de-identified dataset you linked?

Your second link also says a limited dataset is considered PHI and can only be shared with third party under certain conditions and with a data use agreement.

Re:Theranos Voids Two Years of Edison Blood-Test Results by ldehaan on Thursday May 19, 2016 @06:54AM (#11729251)
that's the kind of thinking that is the reason we have such bad medicine.

medicine and all its research needs to be open, people have no privacy anywhere else, and to keep insisting on it for medical data is only allowing governments and huge corporations to take advantage of our lack of knowledge about drug affects etc..

the major reason there is even a debate about vaccines is because of this weird belief that we need to keep medical records siloed from researchers and the public when this information is probably of the highest value to us as a society.

but instead we just post everything else about ourselves on the Internet and those things can actually be used to hurt or segregate us from knowledge that will help us overall.

one of those weird things I've never understood about society's ability to be completely distracted from its own self interest.

Re:Theranos Voids Two Years of Edison Blood-Test Results by zodiac on Thursday May 19, 2016 @03:56PM (#11733250)
Are you suggesting all health records should be available to the public?
Re:Theranos Voids Two Years of Edison Blood-Test Results by intopieces on Thursday May 19, 2016 @09:59PM (#11735171)
Yes, they should. And they should make it easier to do so. Privacy in medicine is holding us back.