You Might Not Like What's Happening with Your Medical Data

One of the first forms you are asked to sign when you see a new doctor is a HIPAA form -- a form that tells you your privacy rights under the Health Insurance Portability and Accountability Act of 1996. The idea is that your medical records are "protected health information" that stays private. Yet your health information can be "de-identified" -- your name, address, social security number, and other identifiers removed -- and then sold as data to other companies. The collection and sale of prescription information by pharmacies to third parties has been going on since the 1940s. Back then, pharmacies weren't required to de-identify the data, although they often did. The rise of digitally stored information created more opportunity for data collection and sales. The HIPAA law now requires that information to be de-identified, but it can still be sold. And advances in analytics are now enabling data collection clearinghouses to re-identify medical data to specific consumers. So if you are a patient and your doctor prescribed an antidepressant to you, your pharmacy has sold that information and removed your name and identifying information. But a data clearinghouse company that purchased that information may very well be able to use analytics to figure out who you are. The technology has made it possible. Join us on All Analytics radio February 21 at 2 pm ET/11 am PT as we explore the history and current practices around medical record data in the wake of privacy laws and evolving analytics tools. Our guest is an expert on the medical record de-identification and re-identification. Adam Tanner investigated the topic and is author of the new book Our Bodies, Our Data: How Companies Make Billions Selling Our Medical Records. He is also the writer in residence at Harvard University's Institute for Quantitative Social Science.