National Patient Identifiers (from Precision Medicine and the Reinvention of Human Disease)

Readers from outside the United States are probably wondering why the United States agonizes over the problem of patient identification. In many other countries, individuals are given a unique national identifier, and all medical data associated with the individual is kept in a central data repository under the aegis of the government’s health service. A single, permanent identifier is used by a patient throughout life, in every encounter with a hospital, clinic, or private physician. As a resource for researchers, the national patient identifier ensures the completeness of data sets and eliminates many of the problems associated with poorly implemented local identifier systems.

In the United States, there has been fierce resistance to the idea of national patient identifiers. The call for a national patient identification system is raised from time to time. The benefits to patients and to society are many. Regardless, US citizens are reluctant to have an identifying number that is associated with a federally controlled electronic record of their private medical information. In part, this distrust results from the lack of any national insurance system in the United States. Most health insurance in the United States is private, and private insurers have wide discretion over the fees and services provided to enrollees. There is a fear that if there were a national patient identifier with centralized electronic medical records, insurers would withhold reimbursements or raise premiums or otherwise endanger the health of patients. Because the cost of US medical care is the highest in the world, medical bills for uninsured patients can quickly mount, impoverishing individuals and families.

Realistically, though, no data is safe. Medical records can be stolen, and governments can demand access to medical records, when necessary [See Lewin T. Texas orders health clinics to turn over patient data. The New York Times; October 23, 2015].

Life has its compromises. Everyone wants their privacy and we all get angry when we hear that our confidential information has been stolen. Data breaches today may involve hundreds of millions of confidential records. The majority of Americans have had social security numbers, credit card information, and private identifiers (e.g., birth dates, city of birth, names of relatives) misappropriated or stolen. It’s natural to object to anything that might jeopardize our privacy. Nonetheless, we must ask ourselves the following: “Is it rational to forfeit the very real opportunity of developing new safe and effective treatments for serious diseases, for the very small likelihood that someone will crack your deidentified research record and somehow leverage this information to your disadvantage?”

Suppose everyone in the United States were given a choice: you can be included in a national patient identifier system, or you can opt out. Most likely, there would be many millions of citizens who would opt out of the offer, seeing no particular advantage in having a national patient identifier, and sensing some potential harm. Now, suppose you were told that if you chose to opt out, you would not be permitted to use any of the therapeutic or preventive benefits that come from studies performed with data collected from the national patient identifier system. These lost benefits would include safe and effective drugs, warnings of emerging epidemics, information on side effects associated with your medications, biomarker tests for preventable illnesses, and so on. Those who made no effort to help the system would be barred from any of the benefits that the system provided. Would you reconsider your refusal to cooperate, if you knew the consequences? Of course, this is a fanciful scenario, but it makes a point.

- Jules Berman

key words: identification, confidentiality, privacy, medical identifier, NPI, national patient identifier, jules j berman, Ph.D., M.D.

REIDENTIFICATION UNDER HIPAA

Reidentification is a term casually applied to any instance whereby information can be linked to a specific person, after the links between the information and the person associated with the information have been removed. Used this way, the term reidentification connotes an insufficient deidentification process. In the health care industry, the term "reidentification" means something else entirely. In the U.S., regulations define "reidentification" under the "Standards for Privacy of Individually Identifiable Health Information.”(1) Therein, reidentification is a legally sanctioned process whereby deidentified records can be linked back to their human subjects, under circumstances deemed legitimate and compelling, by a privacy board. Reidentification is typically accomplished via the use of a confidential list of links between human subject names and deidentified records, held by a trusted party. In the healthcare realm, when a human subject is identified through fraud, trickery, or through the deliberate use of computational methods to break the confidentiality of insufficiently deidentified records (ie, hacking), the term "reidentification" would not apply.(2)

References

1. Department of Health and Human Services. 45 CFR (Code of Federal Regulations), parts 160 through 164. Standards for privacy of individually identifiable health information (final rule). Fed Regist 2000;65(250):82461–510.

2. Berman JJ. Principles of big data: preparing, sharing, and analyzing complex information. Morgan Kaufmann; 2013.

- Jules Berman (copyrighted material)

key words: identifier, deidentifier, identification, reidentification, privacy, HIPAA, confidentiality, medical records, jules j berman

Deidentification with one-way hash algorithms

A one-way hash is an algorithm that transforms a string into another string is such a way that the original string cannot be calculated by operations on the hash value (hence the term "one-way" hash). Examples of public domain one-way hash algorithms are MD5 and SHA (Standard Hash Algorithm) [1,2]. These differ from encryption protocols that produce an output that can be decrypted by a second computation on the encrypted string.

The resultant one-way hash values for text strings consist of near-random strings of characters, and the length of the strings (e.g. the strength of the one-way hash) can be made arbitrarily long. Therefore name spaces for one-way hashes can be so large that the chance of hash collisions (two different names or identifiers hashing to the same value) is negligible. For the fussy among us, protocols can be implemented guaranteeing a dataset free of hash-collisions, but such protocols may place restrictions upon the design of the dataset (e.g. precluding the accrual of records to the dataset after a certain moment)

In theory, one-way hashes can be used to anonymize patient records while still permitting researchers to accrue data over time to a specific patient' record. If a patient returns to the hospital and has an additional procedure performed, the record identifier, when hashed, will produce the same hash value held by the original dataset record. The investigator simply adds the data to the "anonymous" dataset record containing the same one-way hash value. Since no identifier in the experimental dataset record can be used to link back to the patient, the requirements for anonymization, as stipulated in the E4 exemption are satisfied (vida supra).

The use of one-way hashes to anonymize patient records has been employed and promoted in France. Quantin and Bouzelat have standardized a protocol for coding names using SHA one-way hashes [3]. There is no practical algorithm that can take an SHA hash and determine the name (or the social security number or the hospital identifier, or any combination of the above) that was used to produce the hash string. In France, the name-hashed files are merged with files from many different hospitals and used in epidemiologic research. They use the hash-codes to link patient-data across hospitals.

Implementation of one-way hashes carry certain practical problems. Attacks on one-way hash data may take the form of hashing a list of names and looking for matching hash values in the dataset. This can be solved by encrypting the hash or by hashing a secret combination of identifier elements or both or keeping the hash value private (hidden). Issues arise related to the multiple ways that a person may be identified within a hospital system (Tom Peterson on Monday, Thomas Peterson on Tuesday), all resulting on inconsistent hashes on a single person. Resolving these problems is an interesting area for further research.

1. R. Rivest, Request for Comments: 1321, The MD5 Message-Digest Algorithm
http://theory.lcs.mit.edu/~rivest/Rivest-MD5.txt

2. World Wide Web Consortium. SHA-1 Digest.
http://www.w3.org/TR/1998/REC-DSig-label/SHA1-1_0

3. H. Bouzelat, C. Quantin, L. Dusserre. Extraction and anonymity protocol of medical file. Proc AMIA Annu Fall Symp (1996) 323-327.

See also my article on one-way hash issues under HIPAA.

-Jules J. Berman

---

My book, Principles of Big Data: Preparing, Sharing, and Analyzing Complex Information was published in 2013 by Morgan Kaufmann.

I urge you to explore my book. Google books has prepared a generous preview of the book contents.

tags: big data, metadata, data preparation, data analytics, data repurposing, datamining, data mining, anonymization, authentication, confidentiality, medical records