Patient Confidentiality in the Research Use of Clinical Medical Databases

Abstract

Electronic medical record keeping has led to increased interest in analyzing historical patient data to improve care delivery. Such research use of patient data, however, raises concerns about confidentiality and institutional liability. Institutional review boards must balance patient data security with a researcher's ability to explore potentially important clinical relationships. We considered the issues involved when patient records from health care institutions are used in medical research. We also explored current regulations on patient confidentiality, the need for identifying information in research, and the effectiveness of deidentification and data security. We will present an algorithm for researchers to use to think about the data security needs of their research, and we will introduce a vocabulary for documenting these techniques in proposals and publications.

Machine Learning in Radiation Oncology

“…Consequently, the American Cancer Society (ACS) recommends that an individual who is at average risk for developing colorectal cancer, beginning at age 50, should have colorectal cancer screening with examinations including optical colonoscopy and CTC. CTC (or virtual colonoscopy) is a technique for detecting colorectal neoplasms by the use of CT scans of the colon [78]. The diagnostic performance of CTC in detecting polyps, however, varies by experience of radiologists, hospitals, and protocols [33].…”

“…In addition, information related to medical identifiers and any code lists could be removed completely from the dataset after a certain period say 10 years or so. Moreover, it has been argued that current measures by the Health Insurance Portability and Accountability Act (HIPPA) of 18 data elements are not sufficient and techniques based on research in privacy-preserving data mining, disclosure risk assessment data de-identification, obfuscation, and protection may need to be adopted to achieve better protection of confidentiality [78].…”

Building the Informatics Infrastructure for Comparative Effectiveness Research (CER)

“…CER based on ECD presents unique data governance concerns related to the transfer and storage, 43,92,93,[95][96][97] deidentification, [98][99][100][101][102] and access of ECD. [103][104][105] At present, the literature focuses on 2 primary issues: the need to ensure the security of transfer and storage of data; and the tension between preserving privacy (often by deidentifying research data) and enabling research data access.…”

“…103,104 Five of the articles addressed the vulnerabilities of current deidentification efforts. [98][99][100][101][102] Informed consent is also discussed as an issue impacting the availability of ECD for research. Goldstein 105 discusses ways informed consent may be adapted in a changing climate of health care delivery, particularly with the ability for EHRs to strengthen security protocols and ensure patients are informed of various uses of their data.…”

Threat analysis of online health information system

“…HIPAA only includes limited safeguards for maintaining health information privacy [16]. Hoffman et al [17,18] argue that several defects and deficiencies exist in the HIPAA rules, such as having static regulations for rapidly changing computer and communication technologies.…”