Most patients want to support healthcare research and are not opposed to their health information being used for this reason, but they do retain an expectation of privacy even in these situations.
Like most privacy laws around the world, HIPAA is consent-based. As such, a patient’s PHI can be disclosed for use in health research or other secondary purposes provided that he or she has granted authorization for that use. While it may seem reasonable to try to obtain patient consent when their data is collected, it would be impossible to inform them of all of the possible future uses of their data. Thus, there is difficulty when it comes to obtaining informed consent.
The alternative is to get consent after the fact, once a specific research problem or use for the data has been identified. This also introduces problems of practicality. Contacting the millions of individuals who have data held in the SEER-Medicare database, as an example, would be an expensive and time-consuming process. It would involve countless hours of phone and direct contact with individuals in order to obtain their opt-in. Ultimately, it would prove to be a futile activity since some patients will have moved, changed their contact information or have passed away.
It’s not just about patient consent
Even if all of these hurdles can be dealt with, obtaining consent can result in bias in the data which has negative consequences for data quality. It has been shown that consent requirements lead to an ascertainment bias. Individuals who consent to the use of their data tend to have different characteristics than those who do not consent. By reducing participation in research on the part of some groups of individuals, the research sample is non-random and, therefore, does not reflect the entire population of the health condition in question.
Thus, even if patient consent could be obtained, it is still advisable to de-identify the data. By stripping the PHI from a dataset, it is possible to share data while avoiding consent bias and providing assurance to patients that appropriate steps have been taken to protect their privacy.
Organizations are already de-identifying their health data assets, but often using approaches that put individuals at risk of re-identification. When using de-identification to make patient data available for secondary use, privacy should be a key focus area. We outline strategies for Privacy Officers to use when facing the prospect of sharing PHI. Download your copy of What’s the Risk – Sharing Data for Secondary Use: Six Ways Privacy Officers Can Limit Risk Exposure When Sharing or Monetizing Data Assets today.
The post Patient Consent and De-identification appeared first on Privacy Analytics.