This document discusses several data breaches that have exposed the personal information of millions of individuals. It also discusses how over 12 million Americans have shared their DNA data with companies like 23andMe and AncestryDNA. While this can help medical research, it also raises privacy concerns about potential genetic discrimination and challenges with informed consent. The document provides recommendations for patients, practitioners, and stakeholders to help address these privacy challenges through practices like informing patients, limiting data use, ensuring accountability, and identifying risks.
3. Communities
Connected for Kids
501 individuals
University of
Chicago Medicine
1.68 million records
People Inc.
1,000 individuals
American Medical
Collections Agency
20 million victims
Inmediata
1,565,338 individuals
Quest Diagnostics
Optum360
11.9 million records
LabCorp
7.7 million records
BioReference
Laboratories
422,600 customers
[Source: https://www.hipaajournal.com/]
10. More than 12 million Americans have sent in their DNA for
analysis to companies like 23andMe and AncestryDNA
[23andme]
11. Genetic Information
• When signing up to share the DNA with Ancestry,
users opt-in for informed consent research
– Genetic data is sold to third parties, like pharmaceutical
companies
• difficult to delete data once user have consented to it being
used for research
– Users can opt out when agreeing to the service
• Young children can’t give informed consent
• 23andMe and Ancestry do not share genetic
information freely, without a court order
– users can share their information online to find lost
relatives or biological parents
[Sources: www.forbes.com, www.washingtonpost.com]
12. + Scientists use the data to
learn more about genetics,
medical conditions and
diseases to find cures and
treatments
+ To resolve criminal cases
- Genetic discrimination by
employers, insurance
companies, banks, etc.
- People could pay an access
to see the leaked data
13. Addressing key privacy challenges
• Take a holistic approach
• Consider carefully the patient’s benefit
– Individual vs. collective
• Identify potential threats
– What are the misuse case scenarios?
• Cover end to end communication
– From data collection through processing, storage,
sharing and disposal
14.
15. Action - Patient
• Inform about privacy
• Avoid public posts
– Social media, online forums, mobile app reviews
and sharing
• Avoid public devices, networks
• Use trusted communication services
• Best security practices
– Firewalls, passwords, authentication mechanisms
16.
17. Action - Practitioners
• What is the patient’s best interest?
– Always ask their consent
• What are the individual and collective
benefits?
– Short term and long term
• Follow legal and ethical standards
• Training and education on best practices
– Authentication, encryption, trusted channels of
communication
18.
19. Action - Stakeholders
• Inform patients about privacy practices
– Authorization and consent
• Limit use and disclosure
– Mind the entire workflow
– Least privilege principle
• Ensure auditing and accountability
– Account all disclosure, in detail
– Provide access
• Take proactive actions
– Risk analysis
Thanks to the digitalization of medical records, today more patients have access to healthcare services.
Information sharing across practitioners has become easier, as well as the analysis of medical data across healthcare facilities.
The access, analysis and processing of medical data has become more efficient thanks to more powerful computational tools.
For patients, the widespread availability of technology ensured more accurate diagnosis, prompt access to results from exams and lab tests, and the ability to take more informed decisions.
Personal tools available to facilitate health management also emerged, including fitness trackers, and mobile apps that can improve medication adherence and encourage healthier lifestyles.
Having access to more information facilitates analysis, correlations and aggregation, aiding to advance standard care practices and enhancing the understanding of medical conditions.
By retrieving aggregated data healthcare practitioners, patients and caregivers can also take more informed decisions.
Collectively, the benefits include better management of epidemics with more informed policies and campaigns, and more efficient matching between organ donors and patients needing a transplant.
Individually, more information is known about rare diseases, efficacy of treatments and therapies per individual profile facilitating precision medicine.
Digital technologies aid in data collection, analysis, and sharing, however they also increase the risks for privacy breaches.
Creating and implementing access controls became more challenging, especially because:
more data has been collected,
more stakeholders are involved in the care services,
more devices and equipment are used to collect, store and process data, and
more systems are in use to analyze and share medical information.
Although policies exist, enforcing them has been challenging.
Also their enactment is oftentimes expensive and complex to implement
As a consequence a number of breaches of patients’ records have been reported.
According to HIPAA journal, millions of patients have been affected in the past months by data breaches.
Those breaches disclose personal information about the patients (including social security numbers) as well as their medical records (including diagnosis, treatment, and medications).
Because the health data is integrated, the breaches not always affect a single provider, but can impact several institutions and organizations working in collaboration.
Mandatory disclosure of data breaches is beneficial to understand the dimensions of the problem.
But their frequency and impacts show that substantial efforts are needed to ensure better privacy and security protections in practice.
Such breaches have several causes, incidental, accidental, negligence, or malicious, they range from phishing attacks to stolen equipment, usage of untrusted communication channels, and misconfiguration of web servers.
The consequences to the organizations and institutions involved are financial losses, fines, and reputation damage.
For an individual patient, when his/her data is disclosed, family members and relatives can also be affected…
1 minute: High-level explanation of what chapter is about and why it’s important to practice/industry
My book chapter addresses healthcare privacy.
More specifically I focus on how diverse stakeholders can protect patients and their data while delivering high quality care.
I describe privacy concerns, threats and risks that emerge with the digitization of healthcare services, the increasing availability of Internet-of-care-things and the usage of online health services for storing and sharing medical data. To ensure patients’ right to privacy, collaborative efforts from multiple stakeholders are necessary. Not only patients, practitioners, and family members are affected, but also medical organizations, including health insurance companies, laboratories, clinics, and hospitals. Privacy preserving mechanisms go beyond the protection of patients’ data, impacting the infrastructure of medical devices, equipment, networks, and systems entirely. The data lifecycle, cutting across collection, storage, sharing and disposal must be taken into account when implementing privacy protections. Although principles, policies, and regulations exist to address privacy issues, such solutions are limited and also costly to implement. They often fail to cover the capabilities of novel technologies that collect and transmit medical data.
Healthcare privacy can only be ensured through collective efforts that take into account not only the patient, but all stakeholders involved, including physicians, nurses, dentist, therapists, and so on.
As healthcare IT became more pervasive, not only the physician computer should be protected, but the entire ecosystem of devices.
From the patients side, wearable trackers, mobile apps, and personal laptops should be protected.
From the physician side, the electronic health records as well as its underlying infrastructure should be protected.
Besides patients and health practitioners, third party services, including financial institutions, laboratories, clinics and health insurance providers are also involved.
To protect health data, privacy solutions should employ a patient-centric approach considering also the ecosystem of devices and data sources, as well as the multiple stakeholders involved in the process of data collection, storage and sharing.
Privacy considerations cut across different dimensions of equipment, and phases in the data life cycle.
Including personal devices that the patient carries around, such as fitness trackers and smartphones, to larger equipment in a hospital setting dedicated for imaging exams.
Physical artifacts, such as printed records, as well as devices are involved in the privacy control process, including hardware and software systems, as well as the underlying infrastructure for data storage and sharing.
The web also provides valuable information about patients, who oftentimes are unaware about the risks and implications involved when using a mobile app, posting in an online forum, or asking for advice in social media.
The challenges involved escalate when online services are considered.
A patient can reveal information explicitly, in a web search, or mobile app review.
Public posts from instagram, facebook, and other social media channels help to inform diagnosis and medical conditions, unintentionally or not
Mobile app reviews and discussion forum can also disclose sensitive information about a patient.
Inferences can be drawn from the interaction patterns, search history, and social media posts.
Such analysis can provide a lot of medical information about a patient, revealing medical information that not even the patient, or his/her family members, may be aware of
In such cases, when hereditary conditions, genetic information, or transmissible diseases are concerned, the privacy breach not only affects the patients, but their relatives too
Aggregated data from various sources can pose additional privacy risks.
Even when the information published is de-identified or anonymized, combining various sources helps to find unhidden patterns in the data
To address those issues, a number of privacy policies exist
They vary per country
Although they are largely employed, they not always are updated to cover novel technologies
it doesn’t apply to the vast majority of DNA kits
Neither covers social media, wearable devices, fitness trackers
New services, such as 23andme and ancestry, for genetic profiling unveiled a large number of ethical questions for which regulation do not cover.
For each technology piece and process of data management there are best practices involved.
The same applies for stakeholders, since every single individual has its role, responsibilities and duties to protect the patient privacy and his/her personal data.
New services, such as 23andme and ancestry, for genetic profiling unveiled a large number of ethical questions for which regulation do not cover.
For each technology piece and process of data management there are best practices involved.
The same applies for stakeholders, since every single individual has its role, responsibilities and duties to protect the patient privacy and his/her personal data.
https://www.forbes.com/sites/nicolemartin1/2018/12/05/how-dna-companies-like-ancestry-and-23andme-are-using-your-genetic-data/#155fad0a6189
https://www.forbes.com/sites/nicolemartin1/2018/12/05/how-dna-companies-like-ancestry-and-23andme-are-using-your-genetic-data/#155fad0a6189
Since there is no real established precedent for DNA data, there are many issues that could come if your data is leaked and no laws to truly protect you at the moment.
23andme received FDA approval
https://www.washingtonpost.com/lifestyle/2018/12/19/should-you-send-your-kids-dna-andme/?utm_term=.5049e326af5c
Find and convict the rapist and murderer
People find out a lot of surprising information about their families that I think might be more disturbing to kids than finding out about a disease risk that might happen much later in life,” she says.
For instance, paternity revealed by a genetic test can radically change the dynamics of a family and have lasting impacts on children. In a recent case, a man discovered he wasn’t the biological father of his 15-year-old daughter after buying her an AncestryDNA test. A few weeks after getting the results, he filed for divorce from his wife.
