Matching Known Patients to Health Records in Washington State Data

Abstract

The state of washington sells patient-level health data for $50. This publicly available data-set has virtually all hospitalizations occurring in the state in a given year, including patient demographics, diagnoses, procedures, attending physician, hospital, a summary of charges, and how the bill was paid. It does not contain patient names or addresses (only ZIPs). Newspaper stories printed in the state for the same year that contain the word "hospitalized” often include a patient’s name and residential information and explain why the person was hospitalized, such as vehicle accident or assault. News information uniquely and exactly matched medical records in the state database for 35 of the 81 cases (or 43 percent) found in 2011, thereby putting names to patient records. A news reporter verified matches by contacting patients. Employers, financial organizations and others know the same kind of information as reported in news stories making it just as easy for them to identify the medical records of employees, debtors, and others.

Keywords: data privacy, re-identification, demographics, discharge data, inpatient data, health privacy, state databases, health policy, HIPAA

JEL Classification: I18, I11, I10, K00, K32