Privacy vs. Public Health

343 views

Published on

Susan Little, MD and Sanjay Mehta, MD of the UC San Diego AntiViral Research Center present, "Privacy vs. Public Health"

Published in: Health & Medicine
0 Comments
1 Like
Statistics
Notes
  • Be the first to comment

No Downloads
Views
Total views
343
On SlideShare
0
From Embeds
0
Number of Embeds
1
Actions
Shares
0
Downloads
5
Comments
0
Likes
1
Embeds 0
No embeds

No notes for slide

Privacy vs. Public Health

  1. 1. AIDS CLINICAL ROUNDS The UC San Diego AntiViral Research Center sponsors weekly presentations by infectious disease clinicians, physicians and researchers. The goal of these presentations is to provide the most current research, clinical practices and trends in HIV, HBV, HCV, TB and other infectious diseases of global significance. The slides from the AIDS Clinical Rounds presentation that you are about to view are intended for the educational purposes of our audience. They may not be used for other purposes without the presenter’s express permission.
  2. 2. Privacy vs. Public Health November 15,2013 Sanjay Mehta MD Susan Little MD
  3. 3. Molecular Epidemiology to Prevent HIV Infections Vs. www.dailytech.com and www.fanpop.com
  4. 4. Question #1 What can be learned from a single pol HIV sequence (ie drug resistance test) added to a database of locally sampled HIV sequences? A. B. Genotypic Drug Resistance Possible Transmission linkage (ie from who or to who HIV may have been transmitted) C. Direction of an identified transmission D. Genotypic and Demographic Information about the individual E. Who may be at Increased Risk for HIV Acquisition F. A&B G. All of the Above
  5. 5. Question #2 How well does HIPAA protect patient privacy if guidelines are followed? A. Extremely Well- privacy will remain unequivocally protected B. Very Well –privacy remains protected nearly all of the time C. Well – privacy remains protected most of the time, and is usually adequate. D. Fair – privacy is somewhat protected, but better options do not exist E. Poor – privacy is somewhat protected but better options do exist
  6. 6. Question #3 Is an HIV sequence a HIPAA identifier? 1) Yes – all genetic data is explicitly designated as a HIPAA identifier 2) Yes – since HIV sequence data is nearly unique to an individual, it is an identifier 3) No – it is not listed as one of the 18 HIPAA identifiers.
  7. 7. Question #4 Protected Health Information (PHI) can be released/used without authorization for the following purpose(s): A. B. C. D. E. F. G. H. I. Treatment Billing Other Healthcare issues Public Health Research A&B A,B,&C A,B,C,&D All of the Above
  8. 8. Question #5 How worried are you that your personal health information would be unintentionally released during normal public health investigations? Eg. 1) Partner notification 2) Epidemic Outbreak Investigations 3) Year End Summary Reports A) I think this is a real risk B) This would only happen with a breach in security C) I have no concerns
  9. 9. Question #6 What do you feel is the appropriate threshold to disclose PHI for public health benefit? A. Only a raging epidemic of a deadly disease with thousands affected. (eg TB,HIV, malaria) B. An epidemic of a deadly disease with 100s of individuals affected (Ebola, polio) C. Any raging epidemic of infectious origin (eg influenza, west nile virus) D. Prevention of any infectious disease (eg norwalk virus, MRSA)
  10. 10. Question #7 If you could predict which individuals were at risk for transmitting or acquiring HIV using viral sequence data, would it be reasonable to act on this information (i.e., prioritize prevention and treatment services to these individuals)? A. Yes B. No
  11. 11. Case #1 On 2-11-2005 the NYC Dept of Health reported that a 46 yo MSM using crystal methamphetamine and regularly having unprotected sex was found to have acquired multidrug resistant HIV that rapidly progressed to AIDS (Patient X) MMWR July 28, 2006
  12. 12. Case #1 Timeline showing total lymphocyte count and serologic testing results (arrows). Infection is presumed to have occurred ~October 2004 (double line) Markowitz et al, Lancet 2005
  13. 13. Case #1 • Host and viral genotyping results **Virus was 36% more fit than wild type HIV (i.e., potential for increased virulence) Markowitz et al, Lancet 2005
  14. 14. Case #1 “Rare strain of multi-drug resistant HIV that rapidly progresses to AIDS.” Tom Freiden The potential for transmission of a highly virulent virus was deemed an emergency by the NYC Dept of Health! NewYorkTimes.com
  15. 15. Case #1 CDC and NYCDOH requested that Patient X’s pol sequence be compared to sequences from 1) Sequence databases of the 28 laboratories conducting HIV genotyping in NYC 2) CDC sequence database 3) New York State Department of Health Wadsworth Center sequence database 4) Databases from 3 large US commercial laboratories 5) Databases from 2 laboratories in Canada 6) Database from a commercial lab in Europe
  16. 16. Case #1 NYC providers were asked to report any new HIV and recent MDR HIV to authorities NYCDOH then performed - Partner tracing on 14 identified partners - 10/14 previously known to be HIV positive - Genotypes different - Other 4 unavailable, HIV negative, or refused
  17. 17. Case #1 What did the molecular epidemiology show? -- 3 individuals identified with >95% sequence similarity to Patient X. All had attended similar venues or events as Patient X, but no direct contact. All 3 were stable on ARV Markowitz et al, Lancet 2005
  18. 18. Case #1 1) Did the molecular epidemiology analysis provide useful information?
  19. 19. Case #1 Many cases when Molecular Epidemiology has provided important information 1) Detection of Enterobacteriaceae Isolates Carrying Metallo-Beta-Lactamase --- United States, 2010 - MMWR Weekly June 25, 2010 / 59(24);750 2) Listeria Cantalope, Multistate Outbreak of Listeriosis Associated with Jensen Farms Cantaloupe --- United States, August--September 2011, - MMWR Weekly October 7, 2011/ 60(39);1357-1358 Personal.psu.edu Pritzkerlaw.com
  20. 20. Case #1 2) Was the Department of Public Health justified in using phylogenetic analysis to identify and investigate potential sourcepartner pairs involving this hypervirulent strain as a matter of public health concern? When looking back at epidemiologic data, 1/1000 HIV infected individuals have this type of rapid infection.
  21. 21. Case #2 In 2020 - Dept. of Public Health has access to everyone’s vaccination records. -The city launches a campaign to find individuals delinquent on their vaccinations in the name of public health. - Each time a person is identified that has missed at least one vaccine dose, the county van drives to his/her house.
  22. 22. Case #2 1) What is the public health benefit gained by getting everyone completely vaccinated (e.g. Mumps, Measles)
  23. 23. Case #2 • Marginal benefit depends upon R0, vaccination rate in the population, and severity of disease Cohen et al. Medical Decision Making 2013
  24. 24. Case #2 Cohen et al. Medical Decision Making 2013
  25. 25. Case #2 2) Was the benefit to the public outweighed by the privacy issues associated with notification? Depends upon 1) Disease --- variations in severity and R0 2) Vaccination rate in the population 3) The negative consequence of privacy loss
  26. 26. Case #3 A young woman in her mid to late 20s is called by the Department of Public Health. She is notified that she may be at risk for syphilis, and that she should come to the agency to get tested and treated.
  27. 27. Case #3 The woman has only been sexually active with one individual in the last 5 years. The information provided by the Department of Public Health was HIPAA compliant, yet personal identifying information was unintentionally released as a part of the partner notification program.
  28. 28. Case #3 Given this information by Public Health She knows that Brian, her partner 1) Has syphilis 2) Has not been in a monogamous relationship with her
  29. 29. Case #3 What is HIPAA? 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 Name Geographic subdivision smaller than State* All dates related to an individual (except year) and age if 89 or older** Phone number Fax number Electronic mail address Social Security number Medical record number Health plan beneficiary number Account numbers Certificate/License number Vehicle Identifiers and serial numbers Device identifiers and serial numbers Web Universal Resource Locators (URLs) Internet Protocol (IP) address numbers Biometric identifiers Facial photographs Any other unique identifier, characteristic or code *street address, city, county, precinct, zip code **birth date, admission date, discharge date, date of death
  30. 30. Case #3 What is wrong with HIPAA?
  31. 31. Case #3 1) Excess paperwork 2) Complicates patient care 3) But does it even work? -HIPAA was followed in this case, but disclosure resulted -Not only can actual data broach privacy… but the process in which data is released can as well
  32. 32. Case #3 Another Example Gymrek et al (Science, Jan 2013) deduced the identity of individuals from personal genome information
  33. 33. Case #3 • Subjects – individuals donating samples for genetic analysis, and signing releases that they understood privacy breach was a potential risk • Resources – Free Genealogy Databases (eg ysearch, SMGF) • Associate Y-chromosome tandem repeats (Y-STR) with surname – Genetic databases: include age, state of residence • Not HIPAA identifiers – Public record search engines • Can search for people by age, state and surname
  34. 34. Case #3 • With these resources were able to identify a median of 12 individuals associated with a genetic sample • Focusing on 3 individuals with published genomes Gymrek, 2013
  35. 35. Case #3 • Next – Evaluated the Utah Residents with Northern and Western European Ancestry (CEU) Database – 10 Y-STR haplotypes from Illumina seqs from 1000 genomes project – 8 of 10 were associated with Mormon Ancestry using ysearch, SMGF – In 5 cases – able to identify and link not only subject but paternal distant relatives
  36. 36. Case #3 Genetic Information • Advances in technology have not kept pace with guidelines for use of genetic data that minimize privacy risks • Genetic Information Non-discrimination Act of 2008 (GINA) was written to prevent discrimination based on genetic information • GINA does not address: community level genetic information or non-host genetic information.
  37. 37. Case #3 Questions 1) Do alternatives to HIPAA exist? 2) Is there anyway to protect privacy when using partner notification?
  38. 38. Case #3 Public Health Perspective: “Good quality partner notification should not compromise rights to confidentiality but should give practical support to disclose in a safe way. Increasing our skills and practice in this area will go a long way to solving the problems associated with non-disclosure. Moralising about the responsibilities of individuals living with HIV will not.” -Sarah Radcliffe (senior policy officer) BMJ 2013;346:f2148
  39. 39. Case #3 How do you balance Risk to Privacy vs Public Health Benefit? Risk = Probability X Quality X Magnitude 1) Probability – Probability of Risk Occurring 2) Quality – How severe is the risk to the individual 3) Magnitude – How significant a breech will it be
  40. 40. Case #4 An individual who frequents prostitutes is diagnosed with HIV. - He becomes irate and wants to find the person that has given him the disease. - He finds out that he can figure this out using viral sequence data. - He gets his own virus sequenced and then gets access to the local resistance database -He finds a sequence that is very similar to his own, from a woman living in Encinitas.
  41. 41. Case #4 He remembers vaguely that he had slept with a prostitute from Encinitas in the last couple of weeks.
  42. 42. Case #4 Partner Tracing – If it is acceptable in the context of Public Health (with the associated risk of privacy breach), then should individuals be able to collect these same data.
  43. 43. Case #4 1) If our subject wanted to pursue charges against the prostitute, would this information be sufficient for a case?
  44. 44. Case #4 German Singer Arrested for Spreading HIV Singer arrested in 2009 for “inflicting grievous bodily harm” by sleeping with three men when she knew she was HIV+, infecting one of them. Received two-year suspended sentence and 300 hours of community service.
  45. 45. Questions again!
  46. 46. Question #1 What can be learned from a single pol HIV sequence (ie drug resistance test) added to a database of locally sampled HIV sequences? A. B. Genotypic Drug Resistance Possible Transmission linkage (ie from who or to who HIV may have been transmitted) C. Direction of an identified transmission D. Genotypic and Demographic Information about the individual E. Who may be at Increased Risk for HIV Acquisition F. A&B G. All of the Above
  47. 47. Question #2 How well does HIPAA protect patient privacy if guidelines are followed? A. Extremely Well- privacy will remain unequivocally protected B. Very Well –privacy remains protected nearly all of the time C. Well – privacy remains protected most of the time, and is usually adequate. D. Fair – privacy is somewhat protected, but better options do not exist E. Poor – privacy is somewhat protected but better options do exist
  48. 48. Question #3 Is an HIV sequence a HIPAA identifier? 1) Yes – all genetic data is explicitly designated as a HIPAA identifier 2) Yes – since HIV sequence data is nearly unique to an individual, it is an identifier 3) No – it is not listed as one of the 18 HIPAA identifiers.
  49. 49. Question #4 Protected Health Information (PHI) can be released/used without authorization for the following purpose(s): A. B. C. D. E. F. G. H. I. Treatment Billing Other Healthcare issues Public Health Research A&B A,B,&C A,B,C,&D All of the Above
  50. 50. Question #5 How worried are you that your personal health information would be unintentionally released during normal public health investigations? Eg. 1) Partner notification 2) Epidemic Outbreak Investigations 3) Year End Summary Reports A) I think this is a real risk B) This would only happen with a breach in security C) I have no concerns
  51. 51. Question #6 What do you feel is the appropriate threshold to disclose PHI for public health benefit? A. Only a raging epidemic of a deadly disease with thousands affected. (eg TB,HIV, malaria) B. An epidemic of a deadly disease with 100s of individuals affected (Ebola, polio) C. Any raging epidemic of infectious origin (eg influenza, west nile virus) D. Prevention of any infectious disease (eg norwalk virus, MRSA)
  52. 52. Question #7 If you could predict which individuals were at risk for transmitting or acquiring HIV using viral sequence data, would it be reasonable to act on this information (i.e., prioritize prevention and treatment services to these individuals)? A. Yes B. No
  53. 53. Acknowledgements Michael Kalichman Sergei Kosakovsky Pond Davey Smith Staal Vinterbo Joel Wertheim

×