HIPAA and the Leak of “Deidentified” EHR Data

• Published in: The New England journal of medicine Vol. 385; no. 12; p. e38
• Main Authors: Gross, Marielle S, Hood, Amelia J, Rubin, Joshua C, Sim, Ida, Cassel, Christine, Mandl, Kenneth D, Perakslis, Eric D
• Format: Journal Article
• Language: English
• Published: United States Massachusetts Medical Society 16-09-2021
• Subjects: Computer Security; Conflicts of interest; Datasets; Electronic Health Records; Electronic medical records; Health Insurance Portability & Accountability Act 1996-US; Health Insurance Portability and Accountability Act; Humans; Information sharing; Patients; Privacy; Public good; Public health; United States; United States; United States > US; San Francisco California; California
• ISSN: 0028-4793; 1533-4406
• DOI: 10.1056/NEJMc2111490

To the Editor:
We share Mandl and Perakslis’ concerns regarding ungoverned commercial use of deidentified electronic health record (EHR) data outside the protected fiduciary relationships and institutions of origin (June 10 issue).
1
The validity of deidentification for privacy protection has been primarily challenged by the vastness of “omics” data and by modern computation, yet it remains the preeminent mechanism for learning from care at scale. The authors suggest implementing improvements to privacy practices and more robust prohibitions against reidentification. However, framing a “safe harbor” for deidentified data as a leak, rather than a deliberate feature, may divert attention from the . . .