Science, Art, Policy, and the Importance of Good Science Communication

Posted on May 31, 2013 by Meyer Michelle

Although I promised that I was done commenting on the artist-cum-policy wonk who claims to make 3-D “masks” of unknown individuals from their discarded DNA, Matthew Herper of Forbes has taken the criticisms of her (and the media covering her project) articulated by me and others directly to the artist. I confess that her response does not make me feel any better. Even if you’re “only” engaging in art, it seems to me that when that art has an obvious science policy message — indeed, one that you invite — you have some obligation to be clear about how “speculative,” as she puts it, your art is. But when you decide to move from the world of art into the world of science, and to start leading policy discussions based on your speculative art and working with forensic examiners? Then you really have a strong duty to be very clear about what your work can and cannot do. That means, among other things, taking care when talking with the media, and correcting the media if they get it wrong.

Yesterday, the Social Science Genetic Association Consortium, an international consortium that pools and conducts social science research on existing genome-wide association study (GWAS) data, and on whose Advisory Board I sit, published (online ahead of print) the results of its first study in Science. That paper — “GWAS of 126,559 Individuals Identifies Genetic Variants Associated with Educational Attainment” (plus supplemental data) — like much human genetics research, has the potential to be misinterpreted in the lay, policy, and even science worlds. That’s why, in addition to taking care to accurately describe the results in the paper itself, including announcing the small effect sizes of the replicated SNPs in the abstract, being willing to talk to the media (many scientists are not), and engaging in increasingly important “post-publication peer review” conversations on Twitter (yes, really) and elsewhere — we put together this FAQ of what the study does — and, just as important, does not — show. So far, our efforts have been rewarded with responsible journalism that helps keep the study’s limits in the foreground. Perhaps the DNA artist should consider issuing a similar FAQ with her speculative art.

Public Policy Considerations for Recent Re-Identification Demonstration Attacks on Genomic Data Sets: Part 1 (Re-Identification Symposium)

Posted on May 29, 2013 by Meyer Michelle

This post is part of Bill of Health‘s symposium on the Law, Ethics, and Science and Re-Identification Demonstrations. We’ll have more contributions throughout the week. Background on the symposium is here. You can call up all of the symposium contributions by clicking here. —MM

Daniel C. Barth-Jones, M.P.H., Ph.D., is a HIV and Infectious Disease Epidemiologist. His work in the area of statistical disclosure control and implementation under the HIPAA Privacy Rule provisions for de-identification is focused on the importance of properly balancing competing goals of protecting patient privacy and preserving the accuracy of scientific research and statistical analyses conducted with de-identified data. You can follow him on Twitter at @dbarthjones.

Re-identification Rain-makers

The media’s “re-identification rain-makers” have been hard at work in 2013 ceremoniously drumming up the latest anxiety-inducing media storms. In January, a new re-identification attack providing “surname inferences” from genomic data was unveiled and the popular press and bloggers thundered, rattled and raged with headlines ranging from the more staid and trusted voices of major newspapers (like the Wall Street Journal’s: “A Little Digging Unmasks DNA Donor Names. Experts Identify People by Matching Y-Chromosome Markers to Genealogy Sites, Obits; Researchers’ Privacy Promises ‘Empty’”) to near “the-sky-is-falling” hysteria in the blogosphere where headlines screamed: “Your Biggest Genetic Secrets Can Now Be Hacked, Stolen, and Used for Target Marketing” and “DNA hack could make medical privacy impossible”. (Now, we all know that editors will sometimes write sensational headlines in order to draw in readers, but I have to just say “Please, Editors… Take a deep breath and maybe a Xanax”.)

The more complicated reality is that, while this recent re-identification demonstration provided some important warning signals for future potential health privacy concerns, it was not likely to have been implemented by anyone other than an academic re-identification scientist; nor would it have been nearly so successful if it had not carefully selected targets who were particularly susceptible for re-identification.

As I’ve written elsewhere, from a public policy standpoint, it is essential that the re-identification scientists and the media accurately communicate re-identification risk research; because public opinion should, and does, play an important role in setting priorities for policy-makers. There is no “free lunch”. Considerable costs come with incorrectly evaluating the true risks of re-identification, because de-identification practice importantly impacts the scientific accuracy and quality of the healthcare decisions made based on research using de-identified data. Properly balancing disclosure risks and statistical accuracy is crucial because some popular de-identification methods can unnecessarily, and often undetectably, degrade the accuracy of de-identified data for multivariate statistical analyses. Poorly conducted de-identification may fail to protect privacy, and the overuse of de-identification methods in cases where they do not produce meaningful privacy protections can quickly lead to undetected and life threatening distortions in research and produce damaging health policy decisions.

So, what is the realistic magnitude of re-identification risk posed by the “Y-STR” surname inference re-identification attack methods developed by Yaniv Erlich’s lab? Should *everyone* really be fearful that this “DNA Hack” has now made their “medical privacy impossible”? Continue reading →

An Open Letter From a Genomic Altruist to a Genomic Extrovert (Re-Identification Symposium)

Posted on May 29, 2013 by Meyer Michelle

This post is part of Bill of Health‘s symposium on the Law, Ethics, and Science of Re-Identification Demonstrations. You can call up all of the symposium contributions here. We’ll continue to post contributions throughout the week. —MM

Dear Misha:

In your open letter to me, you write:

No one is asking you to be silent, blasé or happy about being cloned (your clone, however, tells me she is “totally psyched”).

First things first: I have an ever-growing list of things I wish I had done differently in life, so let me know when my clone has learned how to read, and I’ll send it on over; perhaps her path in life will be sufficiently similar to mine that she’ll benefit from at least a few items on the list.

Moving on to substance, here’s the thing: some people did say that PGP participants have no right to complain about being re-identified (and, by logical extension, about any of the other risks we assumed, including the risk of being cloned). It was my intention, in that post, to articulate and respond to three arguments that I’ve encountered, each of which suggests that re-identification demonstrations raise few or no ethical issues, at least in certain cases. To review, those arguments are:

Participants who are warned by data holders of the risk of re-identification thereby consent to be re-identified by third parties.
Participants who agree to provide data in an open access format for anyone to do with it whatever they like thereby gave blanket consent that necessarily included consent to using their data (combined with other data) to re-identify them.
Re-identification is benign in the hands of scholars, as opposed to commercial or criminal actors.

I feel confident in rejecting the first and third arguments. (As you’ll see from the comments I left on your post, however, I struggled, and continue to struggle, with how to respond to the second argument; Madeleine also has some great thoughts.) Note, however, two things. First, none of my responses to these arguments was meant to suggest that I or anyone else had been “sold a bill of goods” by the PGP. I’m sorry that I must have written my post in such a way that it leant itself to that interpretation. All I intended to say was that, in acknowledging the PGP’s warning that re-identification by third parties is possible, participants did not give third parties permission to re-identify them. I was addressing the relationship between re-identification researchers and data providers more than that between data providers and data holders.

Second, even as to re-identification researchers, it doesn’t follow from my rejection of these three arguments that re-identification demonstrations are necessarily unethical, even when conducted without participant consent. Exploring that question is the aim, in part, of my next post. What I tried to do in the first post was clear some brush and push back against the idea that under the PGP model — a model that I think we both would like to see expand — participants have given permission to be re-identified, “end of [ethical] story.” Continue reading →

DNA Art

Posted on May 27, 2013 by Katharine Van Tassel

According to an article in the NYT, an artist has collected DNA samples from litter on sidewalks, such as chewing gum and cigarette butts, and used those samples to extract and sequence DNA that she then used to make computer models of their owners’ faces. She then printed 3-D masks that she is showing at her upcoming exhibit called Stranger Visions. The artist hopes her exhibit will spark a dialogue over genetic surveillance.

The NYT article explains that

[w]hile staring at the wall of her therapist’s office, the artist Heather Dewey-Hagborg noticed a strand of hair stuck in a hanging print. Walking home, she noticed that the subways and sidewalks were littered with genetic material on things like chewing gum and cigarette butts, some still moist with saliva. Curious about what she could learn, Ms. Dewey-Hagborg began to extract and sequence DNA from these discarded materials. Then — and here it gets a little eerie — she began to make computer models of their owners’ faces, using genetic clues to print 3-D masks that she concedes “might look more like a possible cousin than a spitting image.” Hanging these portraits along with the original samples, she says, is “a provocation designed to spur a cultural dialogue about genetic surveillance.” After the June exhibitions, Ms. Dewey-Hagborg will show her work early next year at the New York Public Library. She has also collaborated on a tongue-in-cheek project called DNA spoofing, which purports to offer ordinary people some techniques to avoid detection by scrambling their genetic material.

Talk and exhibition at Genspace in Brooklyn on June 13. Exhibition at QF Gallery in East Hampton, N.Y., opens June 29.

[Cross-posted from HealthLawProf Blog]

Reidentification as Basic Science (Re-Identification Symposium)

Posted on May 26, 2013 by Meyer Michelle

Arvind Narayanan (Ph.D. 2009) is an Assistant Professor of Computer Science at Princeton. He studies information privacy and security and has a side-interest in technology policy. His research has shown that data anonymization is broken in fundamental ways, for which he jointly received the 2008 Privacy Enhancing Technologies Award. Narayanan is one of the researchers behind the “Do Not Track” proposal. His most recent research direction is the use of Web measurement to uncover how companies are using our personal information.

Narayanan is an affiliated faculty member at the Center for Information Technology Policy at Princeton and an affiliate scholar at Stanford Law School’s Center for Internet and Society. You can follow him on Twitter at @random_walker.

By Arvind Narayanan

What really drives reidentification researchers? Do we publish these demonstrations to alert individuals to privacy risks? To shame companies? For personal glory? If our goal is to improve privacy, are we doing it in the best way possible?

In this post I’d like to discuss my own motivations as a reidentification researcher, without speaking for anyone else. Certainly I care about improving privacy outcomes, in the sense of making sure that companies, governments and others don’t get away with mathematically unsound promises about the privacy of consumers’ data. But there is a quite different goal I care about at least as much: reidentification algorithms. These algorithms are my primary object of study, and so I see reidentification research partly as basic science.

Continue reading →

I Never Promised You a Walled Garden (Re-Identification Symposium)

Posted on May 25, 2013 by Meyer Michelle

By Misha Angrist

Dear Michelle:

You know I respect your work immensely: your paper on the heterogeneity problem will be required reading in my classes for a long time to come.

But as far as this forum goes, I feel like I need both to push back and seek clarity. I’m missing something.

As you know, the PGP consent form includes a litany of risks that accompany the decision to make one’s genome and medical information public with no promises of privacy and confidentiality. These risks range from the well documented (discovery of non-paternity) to the arguably more whimsical (“relatedness to criminals or other notorious figures.”), including the prospect of being cloned. You write:

Surely the fact that I acknowledge that it is possible that someone will use my DNA sequence to clone me (not currently illegal under federal law, by the way) does not mean that I have given permission to be cloned, that I have waived my right to object to being cloned, or that I should be expected to be blasé or even happy if and when I am cloned.

Of course not. No one is asking you to be silent, blasé or happy about being cloned (your clone, however, tells me she is “totally psyched”).

But I don’t think it’s unfair to ask that you not be surprised that PGP participants were re-identified, given the very raison d’être of the PGP.

I would argue that the PGP consent process is an iterative, evolving one that still manages to crush HapMap and 1000 Genomes, et al., w/r/t truth in advertising (as far as I know, no other large-scale human “subjects” research study includes an exam). That said, the PGP approach to consent is far from perfect and, given the inherent limitations of informed consent, never will be perfect.

But setting that aside, do you really feel like you’ve been sold a bill of goods? Your deep–and maybe sui generis–understanding of the history of de-identification demonstrations makes me wonder how you could have been shocked or even surprised by the findings of the Sweeney PGP paper.

And yet you were. As your friend and as a member of the PersonalGenomes.org Board of Directors, this troubles and saddens me. In the iterative and collaborative spirit that the Project tries to live by, I look forward to hearing about how the PGP might do better in the future.

In the meantime, I can’t help but wonder: Knowing what you know and having done your own personal cost-benefit analysis, why not quit the PGP? Why incur the risk?

Warm regards,

Misha

Reflections of a Re-Identification Target, Part I: Some Information Doesn’t Want To Be Free (Re-Identification Symposium)

Posted on May 24, 2013 by Meyer Michelle

This post is part of Bill of Health‘s symposium on the Law, Ethics, and Science of Re-Identification Demonstrations. You can call up all of the symposium contributions here. Please note that Bill of Health continues to have problems receiving some comments. If you post a comment to any symposium piece and do not see it within half an hour or so, please email your comment to me at mmeyer @ law.harvard.edu and I will post it. —MM

By Michelle N. Meyer

I wear several hats for purposes of this symposium, in addition to organizer. First, I’m trained as a lawyer and an ethicist, and one of my areas of scholarly focus is research regulation and ethics, so I see re-identification demonstrations through that lens. Second, as a member of the advisory board of the Social Science Genetics Association Consortium (SSGAC), I advise data holders about ethical and regulatory aspects of their research, including issues of re-identification. I may have occasion to reflect on this role later in the symposium. For now, however, I want to put on my third hat: that of data provider to (a.k.a. research participant in) the Personal Genome Project (PGP), the most recent target of a pair of re-identification “attacks,” as even re-identification researchers themselves seem to call them.

In this first post, I’ll briefly discuss my experience as a target of a re-identification attack. In my discussions elsewhere about the PGP demonstrations, some have suggested that re-identification requires little or no ethical justification where (1) participants have been warned about the risk of re-identification; (2) participants have given blanket consent to all research uses of the data they make publicly available; and/or (3) the re-identification researchers are scholars rather than commercial or criminal actors.

In explaining below why I think each of these arguments is mistaken, I focus on the PGP re-identification demonstrations. I choose the PGP demonstrations not to single them out, but rather for several other reasons. First, the PGP attacks are the case studies with which, for obvious reasons, I’m most familiar, and I’m fortunate to have convinced so many other stakeholders involved in those demonstrations to participate in the symposium and help me fill out the picture with their perspectives. I also focus on the PGP because some view it as an “easy” case for re-identification work, given the features I just described. Therefore, if nonconsensual re-identification attacks on PGP participants are ethically problematic, then much other nonconsensual re-identification work is likely to be as well. Finally, although today the PGP may be somewhat unusual in being so frank with participants about the risk of re-identification and in engaging in such open access data sharing, both of these features, and especially the first, shouldn’t be unusual in research. To the extent that we move towards greater frankness about re-identification risk and broader data sharing, trying to achieve clarity about what these features of a research project do — and do not — mean for the appropriateness of re-identification demonstrations will be important.

Having argued here about how not to think about the ethics of re-identification studies, in a later post, I plan to provide some affirmative thoughts about an ethical framework for how we should think about this work.

Continue reading →

Data Sharing vs. Privacy: Cutting the Gordian Knot (Re-Identification Symposium)

Posted on May 23, 2013 by Meyer Michelle

PGP participants and staff at the 2013 GET Conference. Photo credit: PersonalGenomes.org, license CC-BY

By Madeleine Ball

Scientists should share. Methods, samples, and data — sharing these is a foundational aspect of the scientific method. Sharing enables researchers to replicate, validate, and build upon the work of colleagues. As Isaac Newton famously wrote: “If I have seen further it is by standing on the shoulders of giants.”

When scientists study humans, however, this impulse to share runs into another motivating force — respect for individual privacy. Clinical research has traditionally been conducted using de-identified data, and participants have been assured privacy. As digital information and computational methods have increased the ability to re-identify participants, researchers have become correspondingly more restrictive with sharing. Solutions are proposed in an attempt to maximize research value while protecting privacy, but these can fail — and, as Gymrek et al. have recently confirmed, biological materials themselves contain highly identifying information through their genetic material alone.

When George Church proposed the Personal Genome Project in 2005, he recognized this inherent tension between privacy and data sharing. He proposed an extreme solution: cutting the Gordian knot by removing assurances of privacy:

If the study subjects are consented with the promise of permanent confidentiality of their records, then the exposure of their data could result in psychological trauma to the participants and loss of public trust in the project. On the other hand, if subjects are recruited and consented based on expectation of full public data release, then the above risks to the subjects and the project can be avoided.

—Church, GM “The Personal Genome Project” Molecular Systems Biology (2005)

Thus, the first ten PGP participants — the PGP-10 — identified themselves publicly.

Continue reading →

Breaking Good: A Short Ethical Manifesto for the Privacy Researcher

Posted on May 23, 2013 by Meyer Michelle

This post is part of Bill of Health‘s symposium on the Law, Ethics, and Science of Re-Identification Demonstrations. We’ll have more contributions throughout the week, and extending at least into early next week. Background on the symposium is here. You can call up all of the symposium contributions here (or by clicking on the “Re-Identification Symposium” category link at the bottom of any symposium post).

Please note that Bill of Health continues to have problems receiving some comments. If you post a comment to any symposium piece and do not see it within half an hour or so, please email your comment to me at mmeyer @ law.harvard.edu and I will post it. —MM

By Yaniv Erlich

1. Increase the general knowledge –Like any other scientific discipline, privacy research strives to increase our knowledge about the world. You are breaking bad if your actions are aimed to reveal intimate details of people, or worst to exploit these details for your own benefit. This is not science. This is just ugly behavior. Ethical privacy research aims to deduce technical commonalities about vulnerabilities in systems not about the individuals in these systems. This should be your internal compass.

This rule immediately asserts that your published findings should communicate only relevant information to deduce general rules. Any shocking/juicy/intimate detail that was revealed during your study is not relevant and should not be included in your publication.

Some people might gently (or aggressively) suggest that you should not publish your findings at all. Do not get too nervous by that. Simply remind them that the ethical ground of your actions is increasing the general knowledge. Therefore, communicating your algorithms, hacks, and recipes is an ethical obligation and without that your actions cannot be truly regarded as research. “There is no ignorabimus … whatever in natural science. We must know — we will know!”, the great Mathematician David Hilbert once said. His statement applies also to privacy research.

Continue reading →

Re-Identification Is Not the Problem. The Delusion of De-Identification Is. (Re-Identification Symposium)

Posted on May 22, 2013 by Meyer Michelle

This is the second post in Bill of Health‘s symposium on the Law, Ethics, and Science of Re-Identification Demonstrations. We’ll have more contributions throughout the week, and extending at least into early next week. Background on the symposium is here. You can call up all of the symposium contributions by clicking here (or by clicking on the “Re-Identification Symposium” category link at the bottom of any symposium post).

By Jen Wagner, J.D., Ph.D.

Before I actually discuss my thoughts on the re-identification demonstrations, I think it would be useful to provide a brief background on my perspective.

Identification≠identity

My genome is an identifier. It can be used in lieu of my name, my visible appearance, or my fingerprints to describe me sufficiently for legal purposes (e.g. a “Jane Doe” search or arrest warrant specifying my genomic sequence). Nevertheless, my genome is not me. It is not the gist of who I am –past, present or future. In other words, I do not believe in genetic essentialism.

My genome is not my identity, though it contributes to my identity in varying ways (directly and indirectly; consciously and subconsciously; discretely and continuously). Not every individual defines his/her self the way I do. There are genomophobes who may shape their identity in the absence of their genomic information and even in denial of and/or contradiction to their genomic information. Likewise, there are genomophiles who may shape their identity with considerable emphasis on their genomic information, in the absence of non-genetic information and even in denial of and/or contradiction to their non-genetic information (such as genealogies and origin beliefs).

My genome can tell you probabilistic information about me, such as my superficial appearance, health conditions, and ancestry. But it won’t tell you how my phenotypes have developed over my lifetime or how they may have been altered (e.g. the health benefits I noticed when I became vegetarian, the scar I earned when I was a kid, or the dyes used to hide the grey hairs that seem proportional to time spent on the academic job market). I do not believe in genetic determinism. My genomic data is of little research value without me (i.e. a willing, able, and honest participant), my phenotypic information (e.g. anthropometric data and health status), and my environmental information (e.g. data about my residence, community, life exposures, etc). Quite simply, I make my genomic data valuable.

As a PGP participant, I did not detach my name from the genetic data I uploaded into my profile. In many ways, I feel that the value of my data is maximized and the integrity of my data is better ensured when my data is humanized.

Continue reading →

Applying Information Privacy Norms to Re-Identification Demonstrations (Re-Identification Symposium)

Posted on May 21, 2013 by Meyer Michelle

This is the first post in Bill of Health‘s symposium on the Law, Ethics, and Science of Re-Identification Demonstrations. We’ll have more contributions throughout the week. Background on the symposium is here. You can call up all of the symposium contributions by clicking here (or by clicking on the “Re-Identification Symposium” category link at the bottom of any symposium post). —MM

By Stephen Wilson

I’m fascinated by the methodological intersections of technology and privacy – or rather the lack of intersection, for it appears that a great deal of technology development occurs in blissful ignorance of information privacy norms. By “norms” in the main I mean the widely legislated OECD Data Protection Principles (see Graham Greenleaf, Global data privacy laws: 89 countries, and accelerating, Privacy Laws & Business International Report, Issue 115, Special Supplement, February 2012).

Standard data protection and information privacy regulations world-wide are grounded by a reasonably common set of principles; these include, amongst other things, that personal information should not be collected if it is not needed for a core business function, and that personal information collected for one purpose should not be re-used for unrelated purposes without consent. These sorts of privacy formulations tend to be technology neutral; they don’t much care about the methods of collection but focus instead on the obligations of data custodians regardless of how personal information has come to be in their systems. That is, it does not matter if you collect personal information from the public domain, or from a third party, or if you synthesise it from other data sources, you are generally accountable under the Collection Limitation and Use Limitation principles in the same way as if you collect that personal information directly from the individuals concerned.

I am aware of two distinct re-identification demonstrations that have raised awareness of the issues recently. In the first, Yaniv Erlich used what I understand are new statistical techniques to re-identify a number of subjects that had donated genetic material anonymously to the 1000 Genomes project. He did this by correlating genes in the published anonymous samples with genes in named samples available from genealogical databases. The 1000 Genomes consent form reassured participants that re-identification would be “very hard”. In the second notable demo, Latanya Sweeney re-identified volunteers in the Personal Genome Project using her previously published method of using a few demographic values (such as date or birth, sex and postal code) extracted from the otherwise anonymous records.

A great deal of the debate around these cases has focused on the consent forms and the research subjects’ expectations of anonymity. These are important matters for sure, yet for me the ethical issue in re-anonymisation demonstrations is more about the obligations of third parties doing the identification who had nothing to do with the original informed consent arrangements. The act of recording a person’s name against erstwhile anonymous data represents a collection of personal information. The implications for genomic data re-identification are clear.

Continue reading →

HIPAA and the Medical Records of Deceased Nursing Home Patients

Posted on May 16, 2013 by francisl

[this is a cross post from HealthLawProf]

Warning: some of this post is HIPAA-wonky. But read on: the punch line is that HIPAA does not protect the living or the dead from blanket release of medical records to their personal representatives—unless state law provides otherwise or patients have thought to specify in advance that they do not want anyone to see the record or parts of it and state law gives them this opportunity. This means that the default position is that personal representatives may see highly sensitive health information, including mental health records or sexual or reproductive histories: veritable skeletons in family medical closets.

In an important recent decision, the 11th Circuit has held that the federal Health Insurance Portability and Accountability Act (HIPAA) preempts a Florida statute that gave spouses and other enumerated parties the right to request the medical records of deceased nursing home residents. Opis Management Resources v. Secretary, Florida Agency for Health Care Administration, 2013 U.S. App. LEXIS 7194 (April 9, 2013). The nursing homes had refused to respond to requests for records made by spouses and attorneys-in-fact, arguing that these requesters were not “personal representatives” under Florida law. The requesters filed complaints with HHS’s Office for Civil Rights, which determined that the refusals were consistent with HIPAA. The Florida Agency for Health Care Administration issued citations against the homes for violating Florida law, and the homes went to court seeking a declaratory judgment that the Florida statute was preempted by HIPAA.

Continue reading →

Online Symposium on the Law, Ethics & Science of Re-identification Demonstrations

Posted on May 13, 2013 by Meyer Michelle

Over the course of the last fifteen or so years, the belief that “de-identification” of personally identifiable information preserves the anonymity of those individuals has been repeatedly called up short by scholars and journalists. It would be difficult to overstate the importance, for privacy law and policy, of the early work of “re-identification scholars,” as I’ll call them. In the mid-1990s, the Massachusetts Group Insurance Commission (GIC) released data on individual hospital visits by state employees in order to aid important research. As Massachusetts Governor Bill Weld assured employees, their data had been “anonymized,” with all obvious identifiers, such as name, address, and Social Security number, removed. But Latanya Sweeney, then an MIT graduate student, wasn’t buying it. When, in 1996, Weld collapsed at a local event and was admitted to the hospital, she set out to show that she could re-identify his GIC entry. For twenty dollars, she purchased the full roll of Cambridge voter-registration records, and by linking the two data sets, which individually were innocuous enough, she was able to re-identify his GIC entry. As privacy law scholar Paul Ohm put it, “In a theatrical flourish, Dr. Sweeney sent the Governor’s health records (which included diagnoses and prescriptions) to his office.”

Sweeney’s demonstration led to important changes in privacy law, especially under HIPAA. But that demonstration was just the beginning. In 2006, the New York Times was able to re-identify one individual (and only one individual) in a publicly available research dataset of the three-month AOL search history of over 600,000 users. The Times demonstration led to a class-action lawsuit (which settled out of court), an FTC complaint, and soul-searching in Congress. That same year, Netflix began a three-year contest, offering a $1 million prize to whomever could most improve the algorithm by which the company predicts how much a particular user will enjoy a particular movie. To enable the contest, Netflix made publicly available a dataset of the movie ratings of 500,000 of its customers, whose names it replaced with numerical identifiers. In a 2008 paper, Arvind Narayanan, then a graduate student at UT-Austin, along with his advisor, showed that by linking the “anonymized” Netflix prize dataset to the Internet Movie Database (IMDb), in which viewers review movies, often under their own names, many Netflix users could be re-identified, revealing information that was suggestive of their political preferences and other potentially sensitive information. (Remarkably, notwithstanding the re-identification demonstration, after awarding the prize in 2009 to a team from AT&T, in 2010, Netflix announced plans for a second contest, which it cancelled only after tussling with a class-action lawsuit (again, settled out of court) and the FTC.) Earlier this year, Yaniv Erlich and colleagues, using a novel technique involving surnames and the Y chromosome, re-identified five men who had participated in the 1000 Genomes Project — an international consortium to place, in an open online database, the sequenced genomes of (as it turns out, 2500) “unidentified” people — who had also participated in a study of Mormon families in Utah.

Most recently, Sweeney and colleagues re-identified participants in Harvard’s Personal Genome Project (PGP), who are warned of this risk, using the same technique she used to re-identify Weld in 1997. As a scholar of research ethics and regulation — and also a PGP participant — this latest demonstration piqued my interest. Although much has been said about the appropriate legal and policy responses to these demonstrations (my own thoughts are here), there has been very little discussion about the legal and ethical aspects of the demonstrations themselves. As a modest step in filling that gap, I’m pleased to announce an online symposium, to take place here at the Bill of Health the week of May 20^th, that will address both the scientific and policy value of these demonstrations and the legal and ethical issues they raise. Participants fill diverse stakeholder roles (data holder, data provider — i.e., research participant, re-identification researcher, privacy scholar, research ethicist) and will, I expect, have a range of perspectives on these questions:

Misha Angrist
Madeleine Ball
Daniel Barth-Jones
Yaniv Erlich
Beau Gunderson
Stephen Wilson
Michelle Meyer
Arvind Narayanan
Paul Ohm
Latanya Sweeney
Jennifer Wagner

I hope readers will join us on May 20.

Privacy and Progress and the Deidentification of Whole Genome Sequence Data

Posted on May 10, 2013 by petrieflom

[Posted on behalf of Elizabeth Pike and Kayte Spector-Bagdady from the Presidential Commission for the Study of Bioethical Issues - and cross-posted here.]

In the most recent issue of the Hastings Center Report, Drs. Amy Gutmann and James Wagner of the Presidential Commission for the Study of Bioethical Issues (the Bioethics Commission), contributed to the lively debate surrounding the identifiability of genetic data. In Found Your DNA on the Web: Reconciling Privacy and Progress, Gutmann and Wagner, Chair and Vice-chair respectively, argue that the paradigm of identifiability has become less relevant to individual privacy protections than restrictions on access and use.

In their commentary, Gutmann and Wagner continue the public deliberation of the Bioethics Commission’s report, Privacy and Progress in Whole Genome Sequencing, in which the Bioethics Commission took a forward-looking approach to the privacy concerns raised by whole genome sequencing—issues that have come to the forefront of this important science.

Under current law, health information that is deidentified—information for which there is “no reasonable basis” to believe it can identify an individual or that has been stripped of traditional identifiers—is afforded different legal protections than identifiable health information. However, whole genome sequence data are unique to only one person, making them more vulnerable to reidentification.

Recent articles have cast doubt on the extent to which whole genome sequence data can be deidentified. For example, in Identifying Personal Genomes by Surname Inference, published in Science in January, Melissa Gymrek, et. al. successfully uncovered full identities of 50 individuals.

Continue reading →

When Ethics Collide

Posted on April 21, 2013 by petrieflom

[Posted on behalf of Nancy Dubler and Art Caplan]

Surprising that for a week there was constant news from Boston. Minute by minute we heard details of carnage, searching, killing, lock down and capture. Now, pretty much, silence.

The suspect, captured in a boat in a backyard in Watertown, is now both a prisoner and a patient. That has proved, historically and most recently, to be a difficult dual status for physicians to address. It is hard for those who want to interrogate him. And hard for those who wish to initiate his arraignment and prosecution. But they along with the rest of us must wait.

Prison and jail health care present an anomaly for medical caregivers. The goals of medicine are to diagnose, cure and comfort. The goals of the justice and correctional systems are to confine, try, sentence and punish. These are not only mutually exclusive goals but, they make strange and strained bedfellows when the two must work together.

We know one can coopt the other. American doctors who agreed that torture could continue, without killing the prisoner, during recent years when water-boarding was a clear part of the anti-terror arsenal, violated their oaths as physicians to attend only to the medical, physical and emotional needs of the patient…to do no harm.

In the same vein, on July 17, 2008, the AMA articulated its policy about executions clearly and unambiguously — “requiring physicians to participate in executions violates their oath to protect lives and erodes public confidence in the medical profession. A physician is a member of a profession dedicated to preserving life when there is hope of doing so. The use of a physician’s clinical skill and judgment for purposes other than promoting an individual’s health and welfare undermines a basic ethical foundation of medicine — first, do no harm”. Yet physicians do participate in executions often using their respect for the criminal justice system as their rationale.

Continue reading →

This American Life and Stigma

Posted on April 18, 2013 by Meyer Michelle

Update: TAL has made a clarification. Please see this post for more.

Let me begin by saying how much I absolutely adore This American Life. I listen to it religiously. I particularly had been looking forward to the most recent pocast episode of TAL: Dr. Gilmer and Mr. Hyde. As the episode’s blurb teases, “Dr. Gilmer and Mr. Hyde” concerns a doctor — Benjamin Gilmer — who takes over the rural South Carolina practice of Vince Gilmer (no relation). Vince is no longer available to see patients because he is serving a prison sentence for killing his father. As Benjamin gets to know Vince’s — and now his — patients, he forms a picture of Vince that’s at odds with his status as a convicted father murderer. How could this doctor who was so devoted to his patients have so brutally murdered his own father?

This episode is right up my alley. True crime? Check. Forensic psychology? Check. The intersection of law and medicine? Yes, please. So when I awoke yesterday morning at 5 am and couldn’t go back to sleep, I eagerly cued up the podcast. The episode recounts, in TAL’s typically-riveting fashion, the story of Benjamin’s search for the truth behind Vince’s murder of his father. I enjoyed every minute of the episode until the last five minutes or so, when I became troubled by one critical omission.

Spoilers follow after the jump; listen to the episode first. Continue reading →

Introducing our Online Abortion and Reproductive Technology Symposium

Posted on April 9, 2013 by glenncohen

[Editor's Note: This is Glenn Cohen guest posting on behalf of Kim Mutcherson, what follows below is her post. I will be posting on behalf of several symposium contributors over the next few days.]

On Friday, April 5, a group of almost 30 (mostly legal) scholars gathered at Rutgers Law-Camden to have difficult conversations about abortion and assisted reproduction. The event, sponsored by Rutgers Law and the Law School Initiative of the Center for Reproductive Rights (http://reproductiverights.org/en/our-work/law-school-initiative) sought to initiate discussion about the seeming gulf between those working on issues related to abortion and those working on assisted reproduction and assisted reproductive technology (ART). Friday’s conversation was the first of at least three planned events with the other two to be sponsored at some future point by the Petrie-Flom Center for Health Law Policy, Biotechnology and Bioethics at Harvard Law School and the Program for the Study of Reproductive Justice in the Information Society Project at Yale Law School. If the nature of the conversation at this kick-off event is a harbinger of things to come, I am anticipating that top-notch and cutting edge scholarship related to reproductive rights and reproductive justice will emerge from workshop participants.

While it might seem intuitive that scholars of reproduction would talk often, much of the work in this arena exists in silos. Those writing about abortion have plenty of work to do in keeping up with the flurry of state laws seeking to destroy what remains of Roe v. Wade in a post-Planned Parenthood v. Casey world. And those working in the world of assisted reproduction have to keep abreast of emerging science that is always light years ahead of what the law has done or seems capable of doing. As a consequence, opportunities to study the intertwining and divergence between the right to end a pregnancy and a right to create one are sparse.

And so, in the year that we commemorate the 40^th anniversary of Roe, we engaged in a respectful, honest, and richly complex dialogue about the appropriate paradigm for understanding the right to abortion and the right to use assisted reproduction—liberty, equality or some new paradigm that we have yet to fully embrace or articulate.

Continue reading →

Big Data and Pharmacovigilance, Part I

Posted on April 8, 2013 by dovfox

By Dov Fox

So much new data are created every day that 90 percent of all data worldwide has emerged in just the last two years. This information revolution has the potential, argues Bill of Health guest blogger Ryan Abbott, to transform how we develop new drugs, set clinical practices, and finance health care. His interesting new article paints an alluring “vision of a drug regulatory system powered by big data”:

“When the Food and Drug Administration (FDA) approved the cholesterol-lowering drug simvastatin in 1991, it was based on pre-marketing controlled clinical studies that included a total of 2,423 patients. In 2011 alone, just in the United States, almost a hundred million prescriptions were written for the drug. Imagine the impact of being able to analyze data from every one of those patients to evaluate whether simvastatin is safe and effective.”

The surveillance of pharmaceuticals after they’ve gone to market will matter more and more, Abbott argues, as personalized medicines become more difficult – and perhaps less necessary – to regulate before they’re released. He proposes a new plan for the post-market regulatory system that relies on the health information exchanges (HIE) created by the HITECH and Affordable Care Acts. These exchanges are slated to amass a vast repository of data on individual patients. Their large size and inclusive nature will enable more accurate analyses in observational research, Abbott suggests, and in ways that minimize the bias and selectivity problems associated with current data sets.

There are at least three obstacles to the integration of these exchanges in drug regulation. First, HIEs will be expensive. While the federal government provided considerable funding to get these exchanges off the ground, Abbott recognizes that in order to remain viable, they will probably have to sustain themselves financially. Second, their meaningful impact on post-marketing surveillance will require consistent reporting standards and information-sharing mechanisms. Third are important patient concerns about the privacy of their personal health information. States are experimenting with different patient participation models to address privacy concerns. For example, Abbott notes that in some states HIEs are free to exchange information without patient consent, while in others patients can opt-out of information exchange altogether. Either is permitted by HIPAA, so long as the information is de-identified so it can’t be used to identify individual patients.

Abbott argues that it’s worth tackling such concerns that the adoption of HIEs pose for citizens, policy makers, health care providers, and the health care industry, so we don’t squander the opportunity to use health information exchanges to their full benefit. Public support for data collection isn’t enough. That data must be translated into a format that regulators can use—something I’ll address tomorrow in my next post on the subject.

REMINDER – Issues and Case Studies in Clinical Trial Data Sharing: Lessons and Solutions

Posted on March 14, 2013 by petrieflom

A reminder about our upcoming conference on Friday, May 17, co-sponsored by the Petrie-Flom Center and the Multi-Regional Clinical Trials Center at Harvard:

Issues and Case Studies in Clinical Trial Data Sharing: Lessons and Solutions

May 17, 2013, 8:00AM-5:00PM

Harvard Law School, Wasserstein Hall, Milstein West A (2nd Floor)

1585 Massachusetts Ave., Cambridge, MA

Our current agenda/objectives are below the fold, and will be updated with additional detail shortly. Please make sure to register as space is limited!

Continue reading →

Family, Privacy, Secrets & The Law

Posted on March 6, 2013 by mgoodwin

Join us for an important meeting:

Roundtable: Family, Privacy, Secrets & the Law March 7-8, 2013

March 7-8, 2013
University of Maryland
Francis King Carey School of Law
500 West Baltimore Street
Baltimore, MD 21201

March 7, 5 p.m. - Book Reading and signing by Jonathan Odell, author of The Healing

March 8, 9 a.m. – 4 p.m. – Roundtable discussions

Family, Privacy, Secrets & the Law roundtable engages the intersections of medicine, criminal law, family law, and constitutional law. The conference faculty will chart contemporary issues that span genetic privacy, disclosure of parental identity in assisted reproduction cases and DNA conscription to domestic violence and child sexual abuse.

There are times in which the law protects secrets, such as between a lawyer and client, doctor and patient, or clergy and congregant. Yet, there are times when the law demands that secret-keepers reveal their confidences such as the increasing demand on doctors to disclose confidential medical information on pregnant women to law enforcement. How should we understand the contours and boundaries of these dynamics within the law? On one hand, law tends to address secrets through the lens of legal duties to protect the vulnerable via its regulations governing abuse and neglect. On the other hand, this set of laws captures only a small percentage of secrets held by family members and other trusted “secret keepers” (doctors, clergy, extended family, neighbors) who, for a variety of reasons elect not to inform the state.

This roundtable interrogates states’ obligations to protect the vulnerable and at what cost. It considers the ways in which the law promises/owes protection and the success, failure or harms it brings about when endeavoring to intervene and offer protection. Against that backdrop, the law also has the obligation to honor individual and family autonomy and privacy.

Schedule

Continue reading →