1 Privacy, Confidentiality and Data Security (PCDS) in HSR: Best Practices Alan M. Zaslavsky Department of Health Care Policy Harvard Medical School.

1

Privacy, Confidentiality and Data Security (PCDS) in

HSR: Best PracticesAlan M. Zaslavsky

Department of Health Care Policy

Harvard Medical School

2

Privacy, Confidentiality and Data Security (PCDS)

• Importance and sensitivity of PCDS

• Basic concepts of disclosure risk– Deidentification and reidentification– Disclosure control

• Institutional and regulatory frameworks– Common Rule, HIPAA, Data use agreements

• File organization, data flow and computer security

3

• This presentation offered in our department at least annually– Required attendance by all programmers,

students, fellow, project managers with data responsibilities

– Presented to faculty at meetings– Shortened version for lower-level staff– Tracking of attendance by personnel manager– Sanction is loss of computer account

• Seek to fully involve project management in PCDS issues

4

Definitions• Privacy: the right of an individual to keep

information about herself or himself from others.

• Confidentiality: safeguarding, by a recipient, of information about another individual

• Disclosure: release (direct or indirect) of information about an identifiable individual

5

Definitions (continued)

• Data security: protections on data to prevent unauthorized access or destruction

• Informed consent: a person's agreement to allow person data to be provided for research and statistical purposes

• Research: study producing generalizable knowledge– excludes internal operations, quality assurance

6

Importance of PCDS

Nexus for balance between

• benefits of information to society

• possible harms of information use to individuals

in conducting the research enterprise.One person’s “invasion of privacy” is

another’s “essential use of information.”

7

Inherent conflicts

• Law enforcement / legal process

• General access to research data– Freedom of Information Act (FOIA)

• Commercial use / beneficial products & services?

• Prevention of harm

• Need to save data for verification, revision

8

Costs of violations of PCDS

• Damage to subjects– Material– Psychological/social

• Damage to the research enterprise

• Exposure to legal/administrative sanctions for researchers and data providers and their institutions

9

Direct and indirect identifiers

Key: variable or combination of variables, the value for which results in a record being unique in the target and population data

Direct identifier: Information that is uniquely associated with a person.

Indirect identifier: Data which, in combination are uniquely associated with a person. Information which facilitates such associations.

10

Direct Identifiers (keys)

.•Name•Telephone number•Street /e-mail address•Unique features (SSN, Medicare ID, Health plan, Medical record #, Certificate/License, voice-finger prints, photos)

11

Re-identification by Matching

De-identification

Original target file Name abcdefghijklAnonymized target file abcdefghijkl

Re-identification key

Anonymized target file abcdefghijklPopulation file abcdefmnop

Name

12

Data in Combination

Variables might be identifying in combination that are not identifying by themselves

• Month, day and year of birth • Gender• Zip code

13

Example of reidentification using three variables

Variables % Unique in Maine state voter

registration listBirthdate alone 12Birthdate + gender 29Birthdate + Zip (5) 69Birthdate + Zip (9) 97

Sweeney, 1997

14

Population (External) Data Bases

• Voter Registration Lists

• Research files

• State & Federal Files– Survey files with added administrative data

• Information Vendor Files

• The unknown: what might an “intruder” know about some or all members of your population?

15

Identifiable population groups (entire data set highly

identifiable)• Rare diseases

•Sample drawn from a particular area

16

Unique/unusual cases: rare values

•110 year-old woman

•Man who weighs 350 pounds

•Income > $100 million

•Verbatim text containing identifying details

17

Unique/unusual cases: rare combinations of values

•16 year-old widow•20 year-old Ph.D.•Asian race in rural mid-west •Female/Asian Executive•60-year old male married to 30 year-old

female•Cause of death = prostate cancer for 30

year-old male

18

Micro Data Protection 1

• Remove direct identifiers• Restrict geographical detail• Code to remove detail – larger categories,

top/bottom coding• Remove, code or edit verbatim comments• Case suppression• Variable suppression

19

Micro Data Protection 2

• Special handling (e.g. coding) of data from external sources (esp. area data)

• Statistical modification (“noise”)

• Sample/subsample

• Eliminate link between persons and establishments

20

Tabular data

• Information on individuals deduced from unique cases in tables

• Reidentification usually related to small groups, small cell counts

• Rounding, cell suppression, complementary suppression might be required

21

Disclosure of individual information from a table

Cancer typeIncome($’000) Colon Lung Kidney Breast<10 60 80 0 24

10-25 25 36 0 36

25-50 19 12 2 17

>50 22 14 0 35

22

Technical issues• Highly technical issues in both microdata

and tabular nondisclosure– Intersection of stats, math, computer science

• Software for detecting disclosure risk– RTI, -argus, etc.

• Nontechnical variables– Resources and intentions of “intruder”

23

Disclosure control in released data• Affect us as producers and consumers of

data

• Masking– Affects analyses if performed on data we

receive– Complex to implement on our releases

• Limited access data centers

24

Restricted access data centers

• Alternative to fully-deidentified public-use microdata files

• Data are held at restricted center– Limited set of researchers submit analyses

through intermediaries– Output reviewed for nondisclosure

• Only feasible for organizations with substantial, persistent resources– e.g. NCHS, Census

25

Institutional and regulatory frameworks for PCDS

• Common Rule / IRB

• HIPAA

• Data Use Agreements

• State regulations

26

Common Rule

• Governs protection of research subjects in all Federally-funded research– IRB evaluates adherence by researcher– Institutional sanctions for violations– Many institutions extend to all research

• Objective: protection of subject from harm– In HSR, often there is no intervention– Typically, commitment to minimal risk of

disclosure

27

Common Rule (continued)• Informed consent

– generally required in primary data-collection– appropriate information about use of data– might be waived where impractical to obtain (e.g.

intrusive), if risks minimal & rights not injured

• Exemption from (full) review– No intervention that could harm subject– Secondary data with no identifiable data– Requires determination by IRB (but less tedious)

28

Implications for researchers

• Commitments are made – To subjects: consent language– To IRB: safeguards promised in IRB

application– To funding agencies: in grant application

• May involve– Protection of data while used– Limits on duration of use

29

HIPAAHealth Insurance Portability and

Accountability Act

• Specific rules for electronic transmission of health data – Primarily for efficiency but includes Privacy Rule

• Obligations imposed on health care providers– Includes direct providers, health plans and insurers– Research data distinguished from health plan /

provider operational functions

• Researchers must respect these obligations

30

Who is Covered by HIPAA?

• A health care provider who transmits health information in electronic transactionsExample: a physician or hospital who

electronically bills for services

• A health plan

• A health care clearinghouse

31

HIPAA implications for research• Practical implications of HIPAA

– What data providers will be looking for– Need to work around restrictions on content– More elaborate paths for data control

• HIPAA provisions for releasing data for research – fully deidentified– limited use dataset– waiver

32

Option 1: De-identified Health Information

• Completely de-identified information (18 elements removed) and no knowledge that remaining information can identify the individual. OR

• Statistically “de-identified” information where a qualified statistician determines that there is a “very small risk ” that the information could be used to identify the individual and documents the methods and analysis.

33

– Names– Geographic info (including city and

ZIP)– Elements of dates (except year)– Telephone #s– Fax #s – E-mail address– Social Security #– Medical record, prescription #s– Health plan beneficiary #s– Account #s

– Certificate/license #s– VIN and Serial #s, license

plate #s– Device identifiers, serial #s– Web URLs– IP address #s– Biometric identifiers (finger

prints)– Full face, comparable photo

images– Unique identifying #s

If the covered entity has actual knowledge that remaining information can be used to identify the individual, the information is considered individually identifiable, and therefore, generally is PHI.

Removal of These Identifiers Makes Information De-identified

34

Option 2: Limited Data Set with Data Use Agreement

• The Privacy Rule permits limited types of identifiers to be released for research with health information (referred to as a Limited Data Set).

• Limited Data Sets can only be used and released in accordance with a Data Use Agreement between the covered entity and the recipient.

35

• The Limited Data Set CAN contain – Elements of Dates– City and ZIP – Other unique identifiers, characteristics and

codes not previously listed as direct identifiers (previous slide)

• CANNOT contain other direct identifiers (among the 18)

Limited Data Set w/ Data Use Agreement

36

Option 3: Waiver of Authorization

May use or disclose personal inforamtion for research if IRB or Privacy Board determines that :– research involves no more than minimal risk– research does not adversely affect the “ rights and

welfare” of subjects– the research could not be done without a waiver

37

Data Use Agreements (DUA)

• Between data provider and data user

• Restrictions:– access by specific personnel– use for a specific reason– defined duration of retention

• Implements commitments made by data provider

38

State regulations

• Variable from state to state

• Some are relatively restrictive– requires negotiation with data provider

39

Iron-clad protection?

• Certificate of Confidentiality– Issued by DHHS– Protects data against legal process– Typically for sensitive topics, e.g. illicit drugs

• O, Canada!

40

Data security in complex projects

• Multisite projects: special needs

• Careful mapping of data flow and access

• Minimal identifying information at each stage

• Particular care in technical aspects of security

41

Example of a data flow plan (with security provisions)

42

File management for PCDS• General practices of good management

– Practices necessary to maintain project continuity

• Well-structured directory organization and naming

• Include documentation with files• Separate project data from personal directories• Separate datasets from programs• Separate raw data from analytic datasets

43

• We typically follow this presentation with a 15-minute tutorial on good practices for data and file management

44

Backups

• Conflict of privacy/confidentiality (restrict) and data security (maintain)

• Basic backup schedule (undeletable)– All Unix files: 4 month retention– PC files: 2 month retention

• Project-specific backup: by request– Only possible if material is properly organized– Permanent media, physical security

45

• The backup policy described here was adopted after several months of faculty discussion– Computer system managers wanted longer

retention– Faculty concerned about unexpected discovery

of material intended to be deleted– Conflicts of DUA requirements with rules

regarding retention of data for verification, revision of manuscripts, etc.

46

General computer security• Proper use of computer accounts, only by

authorized individuals• Secure connections for outside access

– Remote users

– Home or “on road” access via Internet

– Applications can be “tunneled” securely

• Good practices with passwords• Maintain file permissions to restrict access to

authorized users

47

• We follow this up with a training on mechanics of computer security– Permissions, file organization, etc.

• More or less fine-grained tools for protection of various files

• IT staff included in training– Responsible for implementing security and data

retention policies for various project datasets

• Teach methods for both Unix and Windows sides of our system

48

Conclusions

• Know your data

• Be prepared to accommodate restrictions required by data providers

• Maintain general security

• Seek guidance for tough situations!