Patient Privacy in the Era of Big Data

Abstract

Privacy was defined as a fundamental human right inthe Universal Declaration of Human Rights at the 1948United Nations General Assembly. However, there is stillno consensus on what constitutes privacy. In this review,we look at the evolution of privacy as a concept from theera of Hippocrates to the era of social media and big data.To appreciate the modern measures of patient privacyprotection and correctly interpret the current regulatoryframework in the United States, we need to analyze andunderstand the concepts of individually identifiableinformation, individually identifiable health information,protected health information, and de-identification. ThePrivacy Rule of the Health Insurance Portability andAccountability Act defines the regulatory framework andcasts a balance between protective measures and accessto health information for secondary (scientific) use. Therule defines the conditions when health information isprotected by law and how protected health informationcan be de-identified for secondary use. With the adventsof artificial intelligence and computational linguistics,computational text de-identification algorithms producede-identified results nearly as well as those produced byhuman experts, but much faster, more consistently andbasically for free. Modern clinical text de-identificationsystems now pave the road to big data and enablescientists to access de-identified clinical informationwhile firmly protecting patient privacy. However, clinicaltext de-identification is not a perfect process. In order tomaximize the protection of patient privacy and to freeclinical and scientific information from the confinesof electronic healthcare systems, all stakeholders,including patients, health institutions and institutionalreview boards, scientists and the scientific communities,as well as regulatory and law enforcement agencies mustcollaborate closely. On the one hand, public health lawsand privacy regulations define rules and responsibilitiessuch as requesting and granting only the amount ofhealth information that is necessary for the scientificstudy. On the other hand, developers of de-identificationsystems provide guidelines to use different modes ofoperations to maximize the effectiveness of their toolsand the success of de-identification. Institutions withclinical repositories need to follow these rules andguidelines closely to successfully protect patient privacy.To open the gates of big data to scientific communities,healthcare institutions need to be supported in their deidentificationand data sharing efforts by the public,scientific communities, and local, state, and federallegislators and government agencies.