From emrandhippa.com:
De-identified Healthcare Data ? Is It Really Unidentifiable
Written by: John Lynn
There?s always been some really interesting discussion about EHR vendors selling the data from their EHR software. Turns out that many EHR vendors and other healthcare entities are selling de-identified healthcare data now, but I haven?t heard much public outcry from them doing it. Is it because the public just doesn?t realize it?s happening or because the public is ok with de-identified data being sold. I?ve heard many argue that they?re happy to have their de-identified data sold if it improves public health or if it gives them a better service at a cheaper cost.
However, a study coming out of Canada has some interesting results when it comes to uniquely identifying people from de-identified data. The only data they used was date of birth, gender, and full postal code data. ?When the full date of birth is used together with the full postal code, then approximately 97% of the population are unique with only one year of data.?
One thing that concerns me a little about this study is that postal code is a pretty unique identifier. Take out postal code and you?ll find much different results. Why? Cause a lot of people share the same birthday and gender. However, the article does offer a reasonable suggestion based on the results of the study:
?Most people tend to think twice before reporting their year of birth [to protect their privacy] but this report forces us all to think about the combination or the totality of data we share,? said Dr. El Emam. ?It calls out the urgency for more precise and quantitative approaches to measure the different ways in which individuals can be re-identified in databases ? and for the general population to think about all of the pieces of personal information which in combination can erode their anonymity.?
To me, this is the key point. It?s not about creating fear and uncertainty that has no foundation, but to consider more fully the effect on patient privacy of multiple pieces of personal information in de-identified patient data.
