Is Deidentification Sufficient to Protect Health Privacy in Research?

Abstract

The revolution in health information technology has enabled the compilation and use of large data sets of health records for genomic and other research. Extensive collections of health records, especially those linked with biological specimens, are also extremely valuable for outcomes research, quality assurance, public health surveillance, and other beneficial purposes. The manipulation of large quantities of health information, however, creates substantial challenges for protecting the privacy of patients and research subjects. The strategy of choice for many health care providers and research institutions in dealing with this challenge has been to de-identify individual health information.

Keywords: Privacy, Electronic Health Records, EHRs, Deidentification, Research, HIPAA Privacy Rule, Common Rule, Group Harms, Autonomy, Biobanks

JEL Classification: K31, K32