Thread by @curtlanglotz

The @NYTimes article today describing the data sharing lawsuit against @UChicago has generated much discussion and also some confusion about patient data sharing for research. I thought it would be worth clarifying a few key issues 1/
nytimes.com/2019/06/26/tec…

I have no special knowledge of the @Google and @UChicago deal, but data sharing is typically covered by a data use agreement that restricts use of shared data for a specific project, by specific people, and for a limited time. For example: ico.sites.stanford.edu/sites/g/files/… (Word doc) /2

I believe one statement in the Times report is incorrect: “Hipaa, the federal regulation that protects patients’ confidential health data, allows medical providers are permitted to share medical records as long as the data is “de-identified.” 3/

In fact, the Health Insurance Portability and Accountability Act of 1996 (HIPAA) allows use of some identifiers as long as data is the “minimum necessary” to accomplish the task. 4/ hhs.gov/hipaa/for-prof…

Research data of this type is called a “limited data set” and is governed by an institutional review board (IRB), which assures experimental methods are appropriate and decides whether additional patient consent is required. 5/ google.com/amp/s/www.hipa…

These researchers were developing methods to predict important future patient events, using a past sequence of patient events. A strong case could be made that dates of service are necessary to create the past sequence of events. 6/ researchgate.net/publication/32…

Re: consent: Many healthcare organizations mention possible research use of data in the consent patients sign at the time of care. For a large historical data set like this one, IRBs typically decide that additional patient consent is not practical or required. 7/

In my experience, patients want to share their data if they believe it will be used securely and responsibly for the common good. @Google has attempted to patent algorithms like those developed in this research, which complicates that discussion. 8/ ehrintelligence.com/news/google-pa…

All of us working in health research, as well as the IRBs and privacy officials who help us interpret the rules, would welcome simplification of the privacy laws and clarification of what is permitted. 9/

We need to find better ways for patients to express their preferences for whether and how their data is used to develop the health innovations that benefit all of us. END/

@threadreaderapp unroll

Some have made the important point that dates of service could be randomly shifted per patient to preserve the order and reduce the risk of reidentification.