COMPUTER PRIVACY OF
INDIVIDUALLY IDENTIFIABLE
MEDICAL INFORMATION.
G. William Moore, MD, PhD.
Departments of Pathology,
Baltimore VA Maryland Health Care System;
University of Maryland School of Medicine;
The Johns Hopkins Medical Institutions,
Baltimore, MD.
Presented: December 6, 2000.
Baltimore City College High School, Baltimore, MD.
International Baccalaureate.
Information Technology in a Global Society.
Lecture posted at URL:
http://www.netautopsy.org
Scroll Down to: Student Lecture on
Computer Privacy of Individually Identifiable
Medical Information.
1. TABLE OF CONTENTS.
SCREEN 1: TABLE OF CONTENTS.
SCREEN 2: INTRODUCTION.
SCREEN 3: WHAT IS THE PROBLEM WITH COMPUTERS AND MEDICAL RECORDS?
SCREEN 4: WHY IS THIS A NEW PROBLEM?
SCREEN 5: WHAT IS A MEDICAL RECORD?
SCREEN 6: SAMPLE MEDICAL RECORD.
SCREEN 8: WHY DO WE NEED TO PUBLISH MEDICAL RECORDS?
SCREEN 9: WHAT'S WRONG WITH ANIMAL RESEARCH?
SCREEN 10: WHO ARE THE MEDICAL PRIVACY BAD GUYS?
SCREEN 11: WHAT IS PRIVACY?
SCREEN 12: PRIVACY VS. CONFIDENTIALITY.
SCREEN 13: HUMAN MEDICAL RESEARCH.
SCREEN 14: THREE LEVELS OF IDENTIFICATION REMOVAL.
SCREEN 15: WHAT IS 45CFR46, COMMON LAW?
SCREEN 16: WHAT ARE THE TWO PARTS OF MEDICAL PRIVACY?
SCREEN 18: WHAT IS CRYPTOGRAPHY?
SCREEN 19: WHAT ARE THE PRINCIPLES OF ENCRYPTION?
SCREEN 20: WHAT IS SCRUBBING?
SCREEN 21: WHAT IS A DOPPELGANGER?
SCREEN 22: WHAT ARE THE RIGHTS OF THE DECEASED?
SCREEN 23: WHAT IS A TORT?
SCREEN 24: WHO OWNS HUMAN MEDICAL RECORDS?
SCREEN 25: WHAT IS HIPAA?
SCREEN 26: WHAT IS THE HIPAA-SUPPLEMENT?
SCREEN 27: WHEN WILL HIPAA BE LAW?
SCREEN 28: CONCEALMENT OF INDIVIDUAL PATIENT IDENTITY.
SCREEN 29: MEDICINE IS MORE SCIENTIFIC THAN EVER.
SCREEN 30: MEDICINE HAS MORE ETHICAL PROBLEMS THAN EVER.
SCREEN 31: PROPOSED PRINCIPLE OF PRIVACY.
SCREEN 32: THE JOHNS HOPKINS AUTOPSY RESOURCE.
SCREEN 33: SUMMARY.
SCREEN 34: GLOSSARY.
SCREEN 35: EXAMINATION QUESTIONS.
SCREEN 36: REFERENCES.
2. INTRODUCTION.
NEXT PAGE
PREVIOUS PAGE
RETURN TO TABLE OF CONTENTS
Issues of medical privacy have become
more insistent in recent years,
with the vast increase in medical records
that are collected and maintained in
computerized form on individual patients.
In surveys of the U. S. population,
disclosure of private medical information
is a leading fear that patients
have when they interact with the medical care system.
One-third of psychiatric patients in Maryland
pay for their outpatient therapy IN CASH,
even though they have insurance coverage.
The likely reason for this: they don't
want insurers to maintain computer records
on their psychiatric illnesses.
There is value in publishing individual records,
for decentralized tissue banks and for epidemiology.
Animal research is inadequate for many medical research questions.
De-identification of medical records is required
to protect patient confidentiality.
Confidentiality rules are dictated by 45CFR46, HIPAA, and TORT actions.
Methods of encryption include: one-time pad; public/private.
The issues surrounding medical privacy
are medical, technical, legal, ethical, and social.
3. WHAT IS THE PROBLEM WITH COMPUTERS AND MEDICAL RECORDS?
NEXT PAGE
PREVIOUS PAGE
RETURN TO TABLE OF CONTENTS
1.
It is easy to make copies of computer records.
2.
Computer records are more detailed than most paper records.
3.
Many computer records are archived essentially forever.
4. WHY IS THIS A NEW PROBLEM?
NEXT PAGE
PREVIOUS PAGE
RETURN TO TABLE OF CONTENTS
INTERNET.
Explosive growth in the past decade.
Easy exchange of all computerized information.
COMPUTERIZED MEDICAL RECORDS.
Easy to make, easy to copy, easy to transmit.
TISSUE BANKS.
Preserved human tissue is stored in hospitals and medical schools.
These tissue-blocks are often computer-indexed,
and thus serve as de-facto, decentralized human tissue banks.
Researchers who want to use these tissues
need to know what tissue is available on an Internet index,
before the researchers apply to study the tissue.
HUMAN GENOME PROJECT, CANCER GENOME ANATOMY PROJECT.
These are federally sponsored projects
that require detailed human medical records,
as well as tissue samples, for genetic research.
These projects promise to cure or alleviate cancer
and other major human diseases.
5. WHAT IS A MEDICAL RECORD?
NEXT PAGE
PREVIOUS PAGE
RETURN TO TABLE OF CONTENTS
A MEDICAL RECORD, or MEDICAL CHART,
is all the medical information on a patient.
It includes patient discussions with the doctor,
patient physical findings, laboratory tests,
and doctor's interpretations of all this information.
6. SAMPLE MEDICAL RECORD.
NEXT PAGE
PREVIOUS PAGE
RETURN TO TABLE OF CONTENTS
Surgical Pathology Sample Report.
U. S. Government Standard Form 515
MEDICAL RECORD | SURGICAL PATHOLOGY
PATHOLOGY REPORT
Laboratory: BALTIMORE VAMHCS Accession No. BSP 99 8888
Submitted by: J SURGEON MD Date obtained: Jan 14, 1999
Specimen (Received Jan 15, 1999 10:32):
1. LARYNGECTOMY.
2. LEFT RADICAL NECK DISSECTION.
Brief Clinical History:
SQUAMOUS CARCINOMA, LEFT TRUE CORD.
Preoperative Diagnosis:
SQUAMOUS CARCINOMA, LEFT TRUE CORD.
Operative Findings:
SAME.
Postoperative Diagnosis:
SAME.
Surgeon/physician: J SURGEON MD
Gross description:
PATIENT IDENTIFICATION AGREES WITH REQUISITON AND TWO CONTAINERS.
1. THE SPECIMEN IS RECEIVED FRESH, LABELED WITH THE PATIENT'S NAME,
AND ADDITIONALLY LABELED "LARYNGECTOMY".
THE SPECIMEN CONSISTS OF A LARYNGECTOMY RESECTION, MEASURING
10.5 X 5.5 X 3.5 CM. THE LARYNX IS EDEMATOUS. THE LARYNX IS OPENED
POSTERIORLY, TO REVEAL AN IRREGULARITY OF APPARENT TUMOR, ON THE SURFACE
OF THE LEFT TRUE VOCAL CORD, MEASURING 3.0 X 1.5 CM. THE TUMOR DOES NOT
APPEAR TO INVOLVE THE SUBGLOTTIS, NOR THE ANTERIOR COMMISSURE. THE SUPERIOR,
INFERIOR, ANTERIOR, AND POSTERIOR MARGINS ARE GROSSLY UNINVOLVED BY TUMOR
REPRESENTATIVE SECTIONS OF TUMOR ARE SUBMITTED, AS WELL AS THE SURGICAL
MARGINS, AS FOLLOWS:
SUMMARY OF SECTIONS:
1-1, 1 PIECE. TRACHEAL MARGIN.
1-2, 1 PIECE. BASE OF TONGUE MARGIN.
1-3, 1 PIECE. RIGHT PYRIFORM SINUS MARGIN.
1-4, 1 PIECE. LEFT PYRIFORM SINUS MARGIN.
1-5, 1 PIECE. ANTERIOR SOFT TISSUE MARGIN.
1-6, 1 PIECE. POSTERIOR SOFT TISSUE MARGIN.
1-7, 1 PIECE. LESION OF THE LEFT TRUE CORD.
1-8, 1 PIECE. LESION OF THE LEFT TRUE CORD.
1-9, 1 PIECE. LESION OF THE LEFT TRUE CORD.
1-10, 1 PIECE. EPIGLOTTIS.
2. THE SPECIMEN IS RECEIVED FRESH, LABELED WITH THE PATIENT'S NAME,
AND ADDITIONALLY LABELED "LEFT RADICAL NECK DISSECTION". THE SPECIMEN
CONSISTS OF A LEFT RADICAL NECK DISSECTION, MEASURING 25.0 X 15.0 X 5.0 CM.
THE SPECIMEN IS DIVIDED INTO LEVELS 1, 2, 3, 4, AND 5. IN LEVEL 1,
THE SALIVARY GLAND AND ONE PROBABLE LYMPH NODE ARE SUBMITTED.
IN LEVEL 2, SIX PROBABLE LYMPH NODES ARE SUBMITTED.
IN LEVEL 3, TWO PROBABLE LYMPH NODES ARE SUBMITTED.
IN LEVEL 4, ELEVEN PROBABLE LYMPH NODES SUBMITTED.
IN LEVEL 5, FIVE PROBABLE LYMPH NODES ARE SUBMITTED.
REPRESENTATIVE SECTIONS ARE SUBMITTED, AS FOLLOWS:
SUMMARY OF SECTIONS:
1-1, 1 PIECE. LEVEL 1.
2-1, 5 PIECES. LEVEL 2.
3-1, 5 PIECES. LEVEL 2.
4-1, 4 PIECES. LEVEL 3.
5-1, 3 PIECES. LEVEL 3.
6-1, 6 PIECES. LEVEL 3.
7-1, 5 PIECES. LEVEL 4.
8-1, 5 PIECES. LEVEL 4.
9-1, 4 PIECES. LEVEL 5.
Microscopic exam/diagnosis:
1. SQUAMOUS CELL CARCINOMA OF LEFT TRUE CORD, WELL-DIFFERENTIATED, INVASIVE.
SURGICAL MARGINS OF RESECTION ARE FREE OF TUMOR.
2. RADICAL NECK DISSECTION. SALIVARY GLAND WITH NOEVIDENCE OF MALIGNANCY.
ELEVEN OF TWENTY-THREE LYMPH NODES WITH METASTATIC SQUAMOUS CELL CARCINOMA,
AS FOLLOWS.
LEVEL I: SALIVARY GLAND AND ONE LYMPH NODE WITH NO EVIDENCE OF MALIGNANCY.
LEVEL II: THREE OF FIVE LYMPH NODES WITH METASTATIC SQUAMOUS CELL CARCINOMA.
LEVEL III: ONE OF TWO LYMPH NODES WITH METASTATIC SQUAMOUS CELL CARCINOMA.
LEVEL IV: SEVEN OF TEN LYMPH NODES WITH METASTATIC SQUAMOUS CELL CARCINOMA.
LEVEL V: FIVE LYMPH NODES WITH WITH NO EVIDENCE OF MALIGNANCY.
JOHN Q PATHOLOGIST MD xyz| Date Jan 16, 1999
VETERAN,JOHN Q. STANDARD FORM 515
ID:123-45-6789 SEX:M DOB:12/01/1940 AGE:58 LOC:ENT J SURGEON
8. WHY DO WE NEED TO PUBLISH MEDICAL RECORDS?
NEXT PAGE
PREVIOUS PAGE
RETURN TO TABLE OF CONTENTS
TISSUE BANKS.
For research projects that require detailed human medical records,
as well as tissue samples, for genetic research.
They promise to cure or alleviate cancer
and other major human diseases.
It is important to publish indexes to the tissue-banks,
so that potential researchers can determine what resources
are available. Records MUST BE PUBLIC, or else
they will not reach all potential researchers.
EPIDEMIOLOGY.
The study of diseases that spread throughout human populations.
These diseases could be tracked much more easily
if there were publicly available medical records on patients,
available on the Internet.
9. WHAT'S WRONG WITH ANIMAL RESEARCH?
NEXT PAGE
PREVIOUS PAGE
RETURN TO TABLE OF CONTENTS
ANIMAL RESEARCH RESULTS ARE
NOT ALWAYS APPLICABLE TO HUMANS.
ANIMALS ARE EXPENSIVE TO MAINTAIN.
(HUMANS MAINTAIN THEMSELVES).
EXPERIMENTAL SIZE FOR ANIMALS IS SMALL.
COMPUTERIZED MEDICAL RECORDS ON HUMANS
ARE KEPT ON A BILLION PEOPLE.
INABILITY TO REPORT FEELINGS, SENSATIONS, ETC.
10. WHO ARE THE MEDICAL PRIVACY BAD GUYS?
NEXT PAGE
PREVIOUS PAGE
RETURN TO TABLE OF CONTENTS
LOTS OF PEOPLE would like to have access to your
medical records. They include:
Your health insurer, who would like to discontinue
your medical plan, if you have a serious (i.e., expensive) illness;
Your life insurer,
who would like not to sell you insurance,
if you have a serious (i.e., life-threatening) illness;
Your employer, who would like to fire you.
Your ex-spouse, your angry neighbor, etc.
11. WHAT IS PRIVACY?
NEXT PAGE
PREVIOUS PAGE
RETURN TO TABLE OF CONTENTS
PRIVACY
is the right to be left alone.
According to U. S. Supreme Court decisions from the 1940s,
the right of privacy derives from the
Fourth Amendment to the Constitution:
The right of the people to be secure in their persons,
houses, papers, and effects, against unreasonable searches and seizures,
shall not be violated, and no Warrants shall issue, but upon probable cause,
supported by oath or affirmation, and particularly describing
the place to be searched, and the persons or things to be seized.
The fourth amendment (Bill of Rights)
was championed by Patrick Henry, an American patriot
among our founding fathers. It is one of the unique
features of American life. Many European countries (France, Germany)
have a much weaker version of this right, and in
countries like Russia and China, there is no such right at all.
The fourth amendment derives from the English Common Law
concept that every citizen has the right of privacy
in his own home.
The cold wind may blow through the
peasant's thatched straw house,
but the king's mighty army
must stop at the peasant's front door,
without a warrant from a judge.
The controversial Roe vs. Wade decision
on abortions derives from the PRIVACY INTERPRETATION
of the fourth amendment.
12. PRIVACY VS. CONFIDENTIALITY.
NEXT PAGE
PREVIOUS PAGE
RETURN TO TABLE OF CONTENTS
PRIVACY is the right not to be intruded upon.
CONFIDENTIALITY
is the right to keep certain information secret.
For example, suppose that
you give somebody your unlisted telephone number,
and tell him to keep it secret.
If this person gives away your unlisted number,
then this is a
BREACH OF CONFIDENTIALITY.
If this person uses his secret knowledge your unlisted number
to call annoy you at three o'clock in the morning,
then this is a
BREACH OF PRIVACY.
Privacy is the right to be left alone,
not the right to have secrets.
13. HUMAN MEDICAL RESEARCH.
NEXT PAGE
PREVIOUS PAGE
RETURN TO TABLE OF CONTENTS
1. One well-established method of medical research
is to study ANIMAL MODELS OF HUMAN DISEASE.
However, animal diseases aren't always
the same as human diseases;
you can't ask animals questions about
discomfort, pain, hallucinations, etc.;
and animals are expensive to maintain.
2. In HUMAN MEDICAL RESEARCH,
the researcher studies individual human cases
with certain diseases or findings.
As long as the physician does not give or withhold
treatment from the patient
as part of the research project,
then it is OK to use the information
for research projects.
3. Legally and ethically,
the only risk to the patient is the
BREACH OF CONFIDENTIALITY.
4. In the past, this research has been carried out
by individual medical scientists
working at a single medical school or medical center,
and who would ordinarily have access to patient information.
5. With the growth of computers and the Internet,
it is technically much easier
to share medical information between
researchers and institutions.
14. THREE LEVELS OF IDENTIFICATION REMOVAL.
NEXT PAGE
PREVIOUS PAGE
RETURN TO TABLE OF CONTENTS
1. ANONYMOUS INFORMATION.
This is information in which the sample
is NEVER associated with the patient's identification.
For example, a tube of blood with no identifiers on the tube.
2. ANONYMIZED INFORMATION.
This is information in which the sample
is INITIALLY associated with the patient's identification,
but the information is irrevocably removed.
For example, a tube of blood with identifiers on the tube,
which are removed.
By definition, there is NO WAY
that you can ever figure out who the patient is.
3. DE-IDENTIFIED INFORMATION.
This is information in which the sample
is initially associated with the patient's identification,
and the information is ENCRYPTED.
For example, a tube of blood with identifiers on the tube,
which are encrypted with a code number,
that can be decrypted if necessary.
De-identification is the scientifically
preferred method of studying medical records,
because you can, if necessary, return to the original
patient records, to check for (1) errors; (2) accidental duplications.
15. 45CFR46 = COMMON RULE. EXEMPTION E4.
NEXT PAGE
PREVIOUS PAGE
RETURN TO TABLE OF CONTENTS
45CFR46, also known as COMMON RULE.
Volume 45, U. S. Code of Federal Regulations, Chapter 46.
This is the bible of medical research protections
for patients. The main thrust of these rules
is to protect patients from physical injury,
in case they participate in research that might injure them.
HIPAA is a supplement, added to protect patients
from breach of confidentiality of their medical information.
45CFR46 requires an administrative review of any
U. S. federally funded research project,
or project carried out in an academic institution
that receives federal funds. That provision
covers just about all research except that
carried out by profit-making institutions
(e.g., the pharmaceutical industry, the cosmetic industry).
45CFR46 requires review by an INSTITUTIONAL REVIEW BOARD (IRB).
45CFR46 only covers live patients.
So far, it is legal to use data on deceased
patients without IRB review.
EXEMPTION E4 bypasses IRB review if the data or specimens
have been ANONYMIZED.
Even if your research project passes 45CFR46 regulations,
you may still be subject to TORT (malpractice action),
if you damage a patient by disclosing confidential medical records.
16. COMPONENTS OF MEDICAL PRIVACY.
NEXT PAGE
PREVIOUS PAGE
RETURN TO TABLE OF CONTENTS
1. SECURITY AND PATIENT CONFIDENTIALITY.
A. Computer security: prevention of breakins into patient database.
B. Confidentiality: concealing the identity of the individual patient.
2. TWO LEVELS OF PATIENT DE-IDENTIFICATION.
A. Concealment of individual patient identifiers.
B. Concealment of private facts about a public person.
18. WHAT IS CRYPTOGRAPHY?
NEXT PAGE
PREVIOUS PAGE
RETURN TO TABLE OF CONTENTS
CRYPTOGRAPHY.
The study of how to conceal, or ENCRYPT, a secret message
between a sender and receiver,
over an insecure line. In the case of Internet medical records,
the insecure line is the Internet itself, i.e., the general public.
The message to be encrypted in the individual patient's identity.
CRYPTANALYSIS.
The study of how to reconstitute, or DECRYPT, a secret message
between a sender and receiver.
In the case of Internet medical records,
the insecure line is the Internet itself, i.e., the general public.
The message to be decrypted in the individual patient's identity.
The usual methods of cryptanalysis are statistical analyses
of the message traffic. Another way to intercept a message
is to threaten the sender, so-called RED RUBBER HOSE CRYPTANALYSIS.
SENDER.
Person or institutional entity that is trying to send a MESSAGE,
over an insecure line. In the case of Internet medical records,
the insecure line is the Internet itself, i.e., the general public.
RECEIVER.
Person or institutional entity that is trying to receive a MESSAGE,
over an insecure line. In the case of Internet medical records,
the insecure line is the Internet itself, i.e., the general public.
ATTACKER.
Person or institutional entity that is trying to intercept a MESSAGE,
without authorization from the sender.
INTERMEDIARY.
Trusted person or institutional entity that
passes either a message or encryption/decryption keys
between sender and receiver.
19. WHAT ARE THE PRINCIPLES OF ENCRYPTION?
NEXT PAGE
PREVIOUS PAGE
RETURN TO TABLE OF CONTENTS
1. ENCRYPTION OF INDIVIDUAL PATIENT IDENTITY.
ONE-TIME PAD METHOD: quick-and-dirty, difficult to maintain, unbreakable.
PUBLIC/PRIVATE ENCRYPTION: sender, receiver, attacker.
PUBLIC-KEY, distributed to everybody, for ENCRYPTION.
PRIVATE-KEY, known only to the receiver, for DECRYPTION.
2. MATHEMATICAL PRINCIPLE:
It is FASTER TO MULTIPLY two prime numbers
THAN TO FACTOR the product of two prime numbers.
Public-key: product of two prime numbers, generated by software.
Private-key: two individual prime numbers.
3. PUBLIC/PRIVATE ENCRYPTION:
Unaffected by increases in computer-speed: faster computers, bigger primes.
There are MANY LARGE PRIME NUMBERS, and methods to discover them.
The multiply/factorize paradigm is a CONJECTURE, NOT A THEOREM.
Some future mathematician might develop a fast factorization algorithm.
If so, then the world banking system would totter.
20. WHAT IS SCRUBBING?
NEXT PAGE
PREVIOUS PAGE
RETURN TO TABLE OF CONTENTS
SCRUBBING is the process of obliterating identifying or near-identifying
information in a medical record, including names of persons,
doctors, hospitals, dates, or highly-specific diseases.
Concept introduced by Dr. L. Sweeney
at Massachusetts Institute of Technology (MIT).
21. WHAT IS A DOPPELGANGER?
NEXT PAGE
PREVIOUS PAGE
RETURN TO TABLE OF CONTENTS
For the German Purists: DOPPELGÄNGER.
A doppelganger is a phony, duplicate patient,
which is added to the database as a distractor.
A doppelganger is like a wrong choice on a multiple-choice examination.
Another name for doppelganger: shill.
22. WHAT ARE THE RIGHTS OF THE DECEASED?
NEXT PAGE
PREVIOUS PAGE
RETURN TO TABLE OF CONTENTS
45CFR46 only covers live patients.
So far, it is legal to use data on deceased
patients without IRB review.
However, some information on deceased patients
(socially unacceptable diseases;
genetic diseases) could be damaging
to the living kin of a deceased patient.
HIPAA regulations suggest a two-year window
after a person's death, before information can be released publicly.
Next-of-kin who suffer damage from release of information
can sue through a TORT.
23. WHAT IS A TORT?
NEXT PAGE
PREVIOUS PAGE
RETURN TO TABLE OF CONTENTS
Even if your research project passes 45CFR46 regulations,
you may still be subject to TORT (malpractice action),
if you damage a patient, or his next-of-kin,
by disclosing confidential medical records.
MALPRACTICE LEGAL ACTION.
ANYBODY CAN START A TORT.
TV LAWYERS ENTICE INJURED PATIENTS TO SUE DOCTORS ON CONTINGENCY.
TORT WAS INTRODUCED INTO WESTERN JURISPRUDENCE BY NAPOLEON.
PARTS OF A TORT: PLAINTIFF. DEFENDANT. DAMAGE. PROXIMAL CAUSE.
24. WHO OWNS HUMAN MEDICAL RECORDS?
NEXT PAGE
PREVIOUS PAGE
RETURN TO TABLE OF CONTENTS
THE PATIENT?
THE DOCTOR?
THE PAYER (I.E., INSURER).
IN LEGAL THEORY, OWNERSHIP IS THE RIGHT TO SELL.
IN WESTERN JURISPRUDENCE, IT IS CONSIDERED
UNSEEMLY TO SELL HUMAN TISSUES OR HUMAN RECORDS.
25. HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT.
NEXT PAGE
PREVIOUS PAGE
RETURN TO TABLE OF CONTENTS
The Health Insurance Portability and Accountability Act of 1966,
sponsored by U. S. Senators Ted Kennedy (D, Mass) and
Nancy Kassebaum (R, Kansas). Purpose of the act is to
allow persons to transfer health insurance plans to different
insurers, without being penalized for "pre-existing conditions".
Also known as: Kennedy-Kassebaum Act.
26. WHAT IS THE HIPAA-SUPPLEMENT?
NEXT PAGE
PREVIOUS PAGE
RETURN TO TABLE OF CONTENTS
1. The HIPAA-Supplement
was added to protect patient confidentiality in the face
of increasing use of computerized medical records.
1. FROM HIPAA GUIDELINES:
name; address, including street address, city, county, zip code,
or equivalent geocodes; names of relatives and employers; birth date;
voice telephone and fax numbers; email addresses; social security number;
medical record number; health plan beneficiary number; account number;
certificate/license number; any vehicle or other device serial number;
web URL; Internet Protocol (IP) address; finger or voice prints;
photographic images; and any other unique identifying number,
characteristic, or code (whether generally available in the public realm
or not) that the one has reason to believe may be available
to an anticipated recipient of the information.
2. HIPAA DOUBLE-STANDARD FOR ENCRYPTION.
A. The old country-doctor's fax machine.
B. Quaternary-care university-based medical center.
27. WHEN WILL HIPAA BE LAW?
NEXT PAGE
PREVIOUS PAGE
RETURN TO TABLE OF CONTENTS
Summer, 2001.
The do-nothing U. S. Congress had four years
to pass HIPAA, but couldn't get its act together.
Now, passage defaults to the U. S. Health and Human Services Department.
28. CONCEALMENT OF INDIVIDUAL PATIENT IDENTITY.
NEXT PAGE
PREVIOUS PAGE
RETURN TO TABLE OF CONTENTS
1.
1. CONCEALMENT OF PRIVATE FACTS ABOUT A PUBLIC PERSON.
Every person has certain public attributes
(gender, age, height, etc.).
Some persons have numerous public attributes
(political, entertainment figures).
Even public persons have some right/expectation of privacy.
Example: the hypothetical presidential autopsy report.
2.
2. HYPOTHETICAL PRESIDENTIAL AUTOPSY REPORT.
Male. Caucasian. 1.91 m. 95.5 kg.
born 1908, died 1973.
Occupations: U. S. Congressman, U. S. Senator, U. S. President.
Status post: Appendectomy. (C0003611)
Status post: Cholecystectomy. (C0008320)
History of: Renal Calculi. (C0022650)
Myocardial Infarct. (C0027051)
Marked Generalized Atherosclerosis. (C0205082, C0205046, C0205246)
29. MEDICINE IS MORE SCIENTIFIC THAN EVER.
NEXT PAGE
PREVIOUS PAGE
RETURN TO TABLE OF CONTENTS
GENETICS.
STATISTICS.
BIOCHEMISTRY.
CRYPTOGRAPHY.
COMPUTERIZED TOMOGRAPHY.
TELEMEDICINE, TELEPATHOLOGY.
THE FAX MACHINE!
30. MEDICINE HAS MORE ETHICAL PROBLEMS THAN EVER.
NEXT PAGE
PREVIOUS PAGE
RETURN TO TABLE OF CONTENTS
1. PRIVACY.
The right not to be disturbed.
2. SOCIAL RIGHTS VS. INDIVIDUAL RIGHTS.
What if public medical records lead to medical discoveries
that are good for some patients but bad for a subgroup of patients
(e.g., alcoholics, HIV-patients, etc.)?
Do the adversely-affected patients have the right, as a group,
to withhold their specimens from the public database?
Is it possible that potentially adversely-affected patients,
who choose to withhold their specimens from the public database,
might be given less-than-optimal care?
Is there a danger of "patient profiling"?
3. INSURANCE IN A SETTING OF PUBLIC MEDICAL KNOWLEDGE.
If you know more about a patient,
can you deny care to that patient?
If you know more about a GROUP OF PATIENTS,
can you deny care to that group of patients?
If this denial of care is possible,
should everybody be forced to buy medical insurance?
Is that the same as socialized medicine?
Why is the USA the only advanced country without
some form of universal health insurance?
31. PROPOSED PRINCIPLE OF PRIVACY.
NEXT PAGE
PREVIOUS PAGE
RETURN TO TABLE OF CONTENTS
THE PATIENT CANNOT KNOW WHETHER A PARTICULAR PUBLIC REPORT IS HIS/HERS.
32. THE JOHNS HOPKINS AUTOPSY RESOURCE.
NEXT PAGE
PREVIOUS PAGE
RETURN TO TABLE OF CONTENTS
1. AUTOPSY FACESHEET:
Summary of final diagnoses, typically first page of autopsy report.
Over 50,000 autopsy abstracts in JHAR.
Patients born over a span of two centuries.
Over one million tissue blocks.
May be obtained for collaborative research investigations.
Over 1300 publications in scholarly journals, many with PubMed hyperlinks.
Patient confidentiality: each autopsy abstract has demographic line, followed by diagnoses.
2. CONFIDENTIALITY MEASURES:
Only public demographic information is: age in decades, race, sex, decade of autopsy.
Key-number used to decrypt the patient identification, with IRB approval.
Double-brokered encryption of patient identifiers.
Requires participation of JHAR administrator
and officials of Department of Pathology
of The Johns Hopkins Medical Institutions
to re-identify individual patients.
As an additional security measure, key-number may correspond to multiple patients, with the number-of-patients for a given key-number known only to the JHAR administration.
Diagnoses stripped of names of persons, locations, and institutions.
Diagnoses autocoded into generic medical language and UMLS codes in XML format.
33. SUMMARY.
NEXT PAGE
PREVIOUS PAGE
RETURN TO TABLE OF CONTENTS
1.
There is increasing interest in medical privacy,
due to easy copying and distribution of medical records.
2.
There is value in publishing individual records,
for decentralized tissue banks and for epidemiology.
3.
Animal research is inadequate for many medical research questions.
4.
De-identification of medical records is required
to protect patient confidentiality.
5.
Confidentiality rules are dictated by 45CFR46, HIPAA, and TORT actions.
6.
Methods of encryption: one-time pad; public/private.
7.
Records may be SCRUBBED or DOPPELGANGERs may be introduced.
8.
Limited protection of confidentiality in deceased patients.
9.
Johns Hopkins Autopsy Resource is an example of a public database.
10.
The new world of medicine impacts many other fields:
law, ethics, mathematics, cryptography.
34. GLOSSARY.
NEXT PAGE
PREVIOUS PAGE
RETURN TO TABLE OF CONTENTS
45CFR46, also known as COMMON RULE.
Volume 45, U. S. Code of Federal Regulations, Chapter 46,
covers medical research protections
for patients. The main thrust of these rules
is to protect patients from physical injury,
in case they participate in research that might injure them.
HIPAA is a supplement, added to protect patients
from breach of confidentiality of their medical information.
ANONYMIZED MEDICAL INFORMATION.
Medical information in which the sample
is INITIALLY associated with the patient's identification,
but the information is irrevocably removed.
ANONYMOUS MEDICAL INFORMATION.
Medical information in which the sample
is NEVER associated with the patient's identification.
ATTACKER.
Person or institutional entity that is trying to intercept a MESSAGE,
without authorization from the sender.
COMMON RULE.
Volume 45, U. S. Code of Federal Regulations, Chapter 46 (45CFR46)
covers medical research protections for patients.
The main thrust of these rules
is to protect patients from physical injury,
in case they participate in research that might injure them.
HIPAA is a supplement, added to protect patients
from breach of confidentiality of their medical information.
CONFIDENTIALITY.
The right to keep certain information secret.
CRYPTANALYSIS.
The study of how to reconstitute, or DECRYPT, a secret message
between a sender and receiver.
CRYPTOGRAPHY.
The study of how to conceal, or ENCRYPT, a secret message
between a sender and receiver,
over an insecure line.
DAMAGE. The injury suffered by the
plaintiff in a malpractice action (TORT).
Expressed as a monetary amount.
DE-IDENTIFIED MEDICAL INFORMATION.
Medical information in which the sample
is initially associated with the patient's identification,
and the information is ENCRYPTED.
DEFENDANT.
The person alleged to have caused an injury
in a malpractice action (TORT).
EXEMPTION E4 OF 45CFR46.
45CFR46 requires review by an INSTITUTIONAL REVIEW BOARD (IRB).
EXEMPTION E4 bypasses IRB review if the data or specimens
have been ANONYMIZED.
Anonymized medical information is information in which the sample
is initially associated with the patient's identification,
but the information is irrevocably removed.
FACTORIZATION.
Breaking any whole number into its component prime numbers.
For example, the PRIME FACTORS of 90 are: 2, 3, 3, 5.
The usual factorization method is a variant of the
Sieve of Eratosthenes, known to ancient Greek mathematicians.
The mathematical fact that EVERY whole number is
uniquely represented by prime factors was proven by Euclid.
Factorization is much more time-consuming than multiplication.
Public/private encryption works by the principle that
the PRODUCT is distributed publicly, while the PRIME FACTORS
are known only to the receiver.
HIPAA.
The Health Insurance Portability and Accountability Act of 1966,
(Kennedy-Kassebaum Act)
allows persons to transfer health insurance plans to different
insurers, without being penalized for "pre-existing conditions".
INTERMEDIARY.
Trusted person or institutional entity that
passes either a message or encryption/decryption keys
between sender and receiver.
KENNEDY-KASSEBAUM.
The Health Insurance Portability and Accountability Act of 1966,
sponsored by U. S. Senators Ted Kennedy (D, Mass) and
Nancy Kassebaum (R, Kansas). Purpose of the act is to
allow persons to transfer health insurance plans to different
insurers, without being penalized for "pre-existing conditions".
MEDICAL RECORD.
All the medical information on a patient.
The medical record includes patient discussions with the doctor,
patient physical findings, laboratory tests,
and doctor's interpretations of all this information.
NAPOLEONIC CODE.
Legal code introduced by Emperor Napoleon, 19th century emperor
of France, which introduced the idea of a TORT, which is
the basis for malpractice suits.
ONE-TIME PAD ENCRYPTION.
A simple method of encryption, invented in France
around the time of World War I, in which the sender and receiver
both have a SECRET KEY, which is used to encrypt and decrypt the message.
The problem with this method is that the key must be delivered securely
between sender and receiver, and nobody else must know the key.
Keeping all this stuff straight, if a given sender has many receivers
and vice versa, is messy.
PLAINTIFF.
The person who has been injured
in a medical malpractice action (TORT).
PRIME NUMBER.
A whole number (integer greater than zero) which is
divisible only by one and itself. Small prime numbers are:
2, 3, 5, 7, 11, 13, 17, 19, 23, 29, 31, 37, 41, 43, 47, 53, ....
Mathematically, there are an infinite number of prime numbers,
which are distributed fairly uniformly among the integers.
There are robust methods for discovering prime numbers
of any size.
PRIVACY.
The right to be left alone.
The right of privacy derives from the
Fourth Amendment to the U. S. Constitution
("unreasonable search and seizure"),
which in turn derives from the English Common Law
concept, that every citizen has the right of privacy
in his own home.
PROXIMAL CAUSE.
The immediate cause of a damage in a TORT.
PUBLIC-PRIVATE ENCRYPTION.
A method of encryption in which a
PUBLIC-KEY is distributed to everybody, for ENCRYPTION; and a
PRIVATE-KEY, known only to the receiver, is used for DECRYPTION.
RECEIVER.
Person or institutional entity that is trying to receive a MESSAGE,
over an insecure line.
SCRUBBING.
The process of obliterating identifying or near-identifying
information in a medical record, including names of persons,
doctors, hospitals, dates, or highly-specific diseases.
Concept introduced by L. Sweeney at MIT.
SENDER.
Person or institutional entity that is trying to send a MESSAGE,
over an insecure line.
STATISTICS.
Methods for drawing conclusions from large quantities
of data. The traditional paradigm of statistics
is that of a repeatable experiment on animals.
Internet-based, public medical records will
make it possible to perform statistics
on large numbers of human medical records,
suitably encrypted.
TISSUE BANK.
A collection of human tissues, typically preserved,
that are used for medical research. Until now,
tissue banks have been located at a single institution.
The new, internet-based paradigm is that of a decentralized
tissue bank, where individual institutions keep the tissues,
but make them available to a larger clientele, outside the institution.
TORT.
A legal action, arising from the claim
that one person has been injuried by another.
The four parts of a tort are:
the plaintiff (injured person);
the defendant (the person causing the injury);
the damage (amount of money);
and the proximal cause.
If any of these parts are missing,
then there is no tort.
35. EXAMINATION QUESTIONS.
NEXT PAGE
PREVIOUS PAGE
RETURN TO TABLE OF CONTENTS
What is the problem with Computers and Medical Records?
Why is this a new problem?
What is a Medical Record?
Why do we need to publish medical records?
What's wrong with Animal Research?
Who are the bad guys who want to invade your medical privacy?
What is Privacy?
What is the difference between privacy and confidentiality?
What is Anonymization?
What is De-Identification?
What is 45CFR46, Common Rule?
What is 45CFR46, Exemption E4?
What are the two parts of medical privacy?
What is Cryptography?
What is Cryptanalysis?
What is Red-Rubber-Hose Cryptanalysis?
Who is the Sender?
Who is the Receiver?
Who is the Attacker?
What is Encryption?
What is Decryption?
What is Public/Private Encryption?
What is One-time-pad Encryption?
What is scrubbing?
What is a doppelganger?
What are the rights of the deceased?
What is a tort?
Who can start a tort?
Who is the plaintiff in a tort?
Who is the defendant in a tort?
What are the four parts of a tort?
Who owns human medical records?
Legally, what determines ownership?
What is HIPAA?
What is the HIPAA-supplement?
When will HIPAA be law?
36. REFERENCES.
PREVIOUS PAGE
RETURN TO TABLE OF CONTENTS
1.
The Johns Hopkins Autopsy Resource (JHAR).
http://www.netautopsy.org
2.
Bundy A (Ed).
Artificial Intelligence Techniques:
A Comprehensive Catalogue.
Fourth, Revised Edition.
Heidelberg: Springer Verlag. 1997.
ISBN: 3540593233.
3.
Moore GW, Boitnott JK, Miller RE, Eggleston JC, Hutchins GM.
Integrated anatomic pathology reporting system
using natural language diagnoses.
Modern Pathol 1988;1:44-50.
4.
Moore GW, Miller RE, Hutchins GM.
Indexing by MeSH titles of natural language pathology phrases
identified on first encounter using the Barrier Word Method.
In: Scherrer JR, Cote RA, Mandil SH, eds.
Computerized Natural Medical Language Processing
for Knowledge Representation. North-Holland. 1989;29-39.
5.
Moore GW, Berman JJ, Hanzlick RL, Buchino JJ, Hutchins GM.
A prototype internet autopsy database:
1625 consecutive fetal and neonatal autopsy facesheets
spanning twenty years.
Arch Pathol Lab Med. 1996;120:782-785.
6.
Moore GW, Berman JJ.
Anatomic Pathology Data Mining.
In: Cios KJ, ed. Medical Data Mining and Knowledge Discovery.
Heidelberg: Springer Verlag. 2000 (in press).
7.
U.S. National Library of Medicine.
Unified Medical Language System.
http://www.nlm.nih.gov/research/umls/
8.
Moore GW, Brown LA, Miller RE.
http://www.netautopsy.org/apep00st.htm
Set Theory Definition and Algorithm for Medical De-Identification.
Arch Pathol Lab Med. 2001;:in press.
9.
Miller RE, Boitnott JK, Moore GW.
http://www.netautopsy.org/apep00wb.htm
Web-based Free-Text Query System for Surgical Pathology Reports
with Automatic Case De-Identification.
Arch Pathol Lab Med. 2001;:in press.
10.
Moore GW, Miller RE.
Linguistic Inventory of the Johns Hopkins Surgical Pathology Database.
Arch Pathol Lab Med. 2001;:in press.
11.
U. S. Department of Health & Human Services:
http://aspe.hhs.gov/admnsimp/
Standards for Privacy of Individually Identifiable Health Information.
12.
Frankfurt Autopsy Resource:
http://www.klinik.uni-frankfurt.de/zinfo/
13.
U.S. Natl Cancer Institute Human Tissue Archive.
http://www-cdp.ims.nci.nih.gov/rdb.html
Prospective procurement of human tissues for research.
14.
U.S. Natl Cancer Institute Breast Cancer Tissue Resource.
http://www-cbctr.ims.nci.nih.gov/FAQ.html
Prospective procurement of human breast tissue for research.
15.
U.S. Natl Cancer Institute Human Tissue Resource.
http://www-chtn.ims.nci.nih.gov/
Prospective procurement of human tissue for research.
16.
Systematized Nomenclature of Human and Veterinary Medicine (SNOMED).
http://www.snomed.org
17.
Bibliography of Studies on JHAR Autopsies.
http://www.netautopsy.org/iadbpubl.htm
18.
U. S. Code of Federal Regulations,
45 CFR Subtitle A (10-1-95 Edition), part 46.101 (b) (4).
http://www.uaf.edu/oar/irb/45cfr46.html
http://ohrp.osophs.dhhs.gov/humansubjects/guidance/45cfr46.htm
Confidentiality brochure (summary):
http://www-cdp.ims.nci.nih.gov/policy.html
Multiple Project Assurance Document:
http://www.olemiss.edu/depts/research/irb/assurance.htm
19.
U. S. Department of Health and Human Services.
Standards for Privacy of Individually Identifiable Health Information.
Fed Regist. 1999 Nov 3;64(212):59917-59966.
http://aspe.hhs.gov/admnsimp/
20.
Office of Protection from Research Risks (OPRR).
http://ohrp.osophs.dhhs.gov/
21.
Berman JJ, Moore GW, Hutchins GM.
Maintaining patient confidentiality in the public domain Internet
Autopsy Database (IAD).
Proc AMIA Annu Fall Symp. 1996;:328-332.
PMID: 8947682; UI: 97103310.
22.
Berman JJ, Moore GW, Hutchins GM.
U. S. Senate Bill 422. The Genetic Confidentiality
and Nondiscrimination Act of 1997.
Diagn Mol Pathol. 1998 Aug;7(4):192-196.
PMID: 9917128; UI: 99114200.
23.
Sweeney L.
Three computational systems for disclosing medical data
in the year 1999.
Medinfo. 1998;9 Pt 2:1124-1129.
PMID: 10384634; UI: 99312628.
24.
Sweeney L.
Privacy and medical-records research.
N Engl J Med. 1998 Apr 9;338(15):1077; discussion 1077-1078.
PMID: 9537887; UI: 98181820.
25.
Sweeney L.
Guaranteeing anonymity when sharing medical data, the Datafly System.
Proc AMIA Annu Fall Symp. 1997;:51-55.
PMID: 9357587; UI: 98020458.
26.
Sweeney L.
Replacing personally-identifying information
in medical records, the Scrub system.
Proc AMIA Annu Fall Symp. 1996;:333-337.
PMID: 8947683; UI: 97103311.
27.
Schneier B.
Applied Cryptography, Second Edition.
Protocols, Algorithms, and Source Code in C.
New York: John Wiley & Sons, 1996.
28.
Shared Pathology Informatics Network:
Request for Applications.
http://grants.nih.gov/grants/guide/rfa-files/RFA-CA-01-006.html
The objective of this initiative for a
SHARED PATHOLOGY INFORMATICS NETWORK
is to create a model Web-based system to access data related to archived
human specimens at multiple institutions.
29.
Prof. R. L. Rivest's cryptography and security page.
http://theory.lcs.mit.edu/~rivest/crypto-security.html
Prof. Rivest is the R in the RSA public-private
cryptography algorithm, one of the intellectual
masterpieces of this century.
Last Updated: 12/7/2000, by G. William Moore, MD, PhD.