番茄社区

By Sally Crocker

In publishing new studies, health care researchers take care to remove identifiable patient information when sharing their data.

But a UNT Health Science Center public health professor has found that despite such precautionary measures, often required by grant-funding organizations and research journals, online attackers can still identify individual patient health records through cross-referencing against publicly available databases.

Liam O鈥橬eill, PhD, Associate Professor of Health Management and Policy at the UNTHSC School of Public Health, published the report in the June 2016 issue of with colleagues from the University of Iowa and George Washington University.

The article was featured as the June cover story and was also highlighted in a recent . The journal鈥檚 editor-in-chief, Dr. Steven L. Shafer of Stanford University, said he believes the article 鈥渨ill have profound implications for digital sharing of patient data鈥� in the future.

鈥淧osting health information that has been properly 鈥榙e-identified鈥� for public use is assumed to pose no risks to patient privacy, yet computer scientists have demonstrated that this assumption is flawed,鈥� Dr. O鈥橬eill said.

鈥淜nowing a person鈥檚 date of birth is insufficient by itself, for example, to identify an individual,鈥� he said, 鈥測et, 87 percent of the specific combinations of date of birth, postal code and gender occur only once among the entire U.S. population.鈥�

鈥淭he first step is for an online attacker to link two or more open databases based on overlapping attributes,鈥� he said.

For their study, Dr. O鈥橬eill and colleagues used the State of Texas surgical database 鈥� containing public information on more than 2.8 million records – to show that there is a 42.8 percent chance that an online attacker could match an anesthesia record to a de-identified hospital database to uncover sensitive patient information.

The percentage is even greater, they reported, for patients undergoing multiple procedures or from smaller states.

鈥淔ew people today would think that the combination of hospital and surgical procedures could be enough to link to a single inpatient record out of a database of millions,鈥� Dr. O鈥橬eill said, 鈥渨hich is why the use or exchange of this type of data is largely unregulated. But methods of online attack are advancing rapidly, faster than methods of defense.鈥� Dr. O鈥橬eill said.

While supporting research transparency, the authors recommended a change in peer-reviewed editorial policy, where study data could be requested from a journal鈥檚 editor, rather than being publicly shared in de-identified format.

Funding for this study was provided by the .