Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The NHS is selling your private data – here's the price list [pdf]

hscic.gov.uk

Post reply on HN
Print view View original

61–70 of 122 posts

Re: The NHS is selling your private data – here's the price list [pdf]

#61

Post by notahacker »

mortov wrote: post #17
joshavant wrote: post #7

Would this enable the private industry to create services and analyses based off this cheaply available data? Yes, it seems heinous at first, but are there legitimate, palatable Big Data opportunities here, assuming the data is properly anonymized?

Did you look at the price list ? Standard extract – no personal confidential data £9,565 Alternatively for just under £1,000 more : Standard extract – containing personal confidential data £10,453 They're specifically enticing people to purchase the confidental data version since it is only 10% extra to get all the juicy information. Trouble connecting people to their parents, siblings, children, (ex)partners ? Simpl…

They're charging a nominal additional fee for the additional paperwork involved in ensuring the necessary approvals have been met. You can see the types of organizations that get their "personally identifiable" data requests approved by a separate body here: http://www.hra.nhs.uk/about-the-hra/our-committees/section-2...

A quick glance at some of the approvals suggests that yes, the information is very personally-identifying indeed but the cohorts are pretty small and not obviously commercially valuable, and the types of organisations getting the data sound no more likely to resell it than my GP (and even less likely to make a profit on it). And my GP and his admin staff and various other NHS employees have had access to it for some years now.

Re: The NHS is selling your private data – here's the price list [pdf]

#62

Post by ajb »

What would be interesting would be to write up this 'opt out' procedure, slightly disguised, as part of a research proposal and submit it to the UK ethics committees. I'd be shocked if they don't all reject it. Any UK academics - with enough tenure that it won't bork their career - up for that?

Re: The NHS is selling your private data – here's the price list [pdf]

#63

Post by notlol »

mcphilip wrote: post #53
optimiz3 wrote: post #4

This would be straight up illegal in the US due to HIPAA, which guarantees a patient's right to privacy. HIPAA = http://en.wikipedia.org/wiki/Health_Insurance_Portability_an...

There was an interesting Businessweek article[1] on the sale of pseudoanonymised data to private companies in the US. One Harvard researcher acquired one such database and was able to identify some individuals: >Latanya Sweeney, the director of Harvard University’s Data Privacy Lab, identified 35 patients from a Washington database by buying state medical data and creating a simple software program to cross-reference…

Police and researchers have provisions to request access to the database under HIPAA

The Harvard researcher probably fell under research for public health. I'd hope private researchers can access public health data. The goal for "ICD" global standardized diagnoses codes is to help research.

There are rules for distribution and compliance that should carry over to each handler of the data sets.

Given all that, I still have anxiety of bad actors handling the private information.

Re: The NHS is selling your private data – here's the price list [pdf]

#64

Post by eyko »

gohrt wrote: post #55
tomelders wrote: post #46

Earlier quoted context omitted.

Bespoke extract – containing personal confidential data Annual Service Charge: £300 Per data set per year £262 Per additional year (per data set) £64 Either that's an incredibly bad title for that particular service, or they're selling data containing 'personal confidential data'. I'd like to know a little bit more about what that actually is.

This coversion is muddied by a failure to distinguish confidential information ("I have disease X"), from identifying information (my name/address)

If you read the PDF: "Bespoke extract – containing personal confidential data: A one-off extract tailored to the customer’s requirements of specified data fields containing patient identifiable data, sensitive data items or both."

Re: The NHS is selling your private data – here's the price list [pdf]

#65

Post by pbhjpbhj »

vilhelm_s wrote: post #39
tansey wrote: post #30

Earlier quoted context omitted.

But this data is not de-identified. They explicitly list prices for data with confidential, patient-identifying information.

The main page, http://www.hscic.gov.uk/dles , states > The data we supply is normally pseudonymised. We only provide identifiable data when there is a lawful basis to do so i.e. with patient consent, approval under section 251 of the NHS Act 2006 which enables The Health Service (Control of Patient Information) Regulations 2002, or where appropriate statutory regulation is in place. This "About Section 251" page, htt…

>"and where seeking consent was not practicable," //

As they have your contact details and next of kin details then seeking consent must be quite practicable.

I expect them mean "commercially financially viable". Those people the NHS can't simply look up a phone number for (from doctor's surgery records) and ask (or ask their guardian/parent) must be in the few hundreds [of those they have sufficient medical information for to be used in a scientific study].

Re: The NHS is selling your private data – here's the price list [pdf]

#66

Post by pbhjpbhj »

ed_blackburn wrote: post #19

I await the shit storm when a public figures medical records are mined by the media divulging something controversial.

People with rare diseases, especially multiples, must be reasonably easy to deanonymise. Also joining the data with newspaper reports of crimes (perhaps only ones that are pertinent are mentioned, eg harassment of hospital staff) or hospitalisations would seem likely to deanonymise quite a few records.

Re: The NHS is selling your private data – here's the price list [pdf]

#67

Post by anigbrowl »

optimiz3 wrote: post #4

This would be straight up illegal in the US due to HIPAA, which guarantees a patient's right to privacy. HIPAA = http://en.wikipedia.org/wiki/Health_Insurance_Portability_an...

You're assuming that NHS is selling it without the consent of patients. More likely this is for things like patients on drug trials etc. who sign a waiver to allow sharing of their health information. The UK takes confidentiality of public records pretty seriously and has done for years - I seriously doubt you can just just pull any given person's health records without their agreement.

Re: The NHS is selling your private data – here's the price list [pdf]

#68

Post by vilhelm_s »

pbhjpbhj wrote: post #65
vilhelm_s wrote: post #39

Earlier quoted context omitted.

The main page, http://www.hscic.gov.uk/dles , states > The data we supply is normally pseudonymised. We only provide identifiable data when there is a lawful basis to do so i.e. with patient consent, approval under section 251 of the NHS Act 2006 which enables The Health Service (Control of Patient Information) Regulations 2002, or where appropriate statutory regulation is in place. This "About Section 251" page, htt…

>" and where seeking consent was not practicable, " // As they have your contact details and next of kin details then seeking consent must be quite practicable. I expect them mean "commercially financially viable". Those people the NHS can't simply look up a phone number for (from doctor's surgery records) and ask (or ask their guardian/parent) must be in the few hundreds [of those they have sufficient medical inform…

I guess that's what it says, practicable with regard to cost.

To look at one random example, the first study on the list of approvals in 2013 was the "ETPOS: European Transfusion Practice and Outcome Survey". Apparently they took data from 10,000 patients who had blood transfusions and tried to see if there was any correlations between practices such as "ratio of red blood cells to other blood component therapy, such as plasma and platelets" and health outcomes. I guess it was deemed that phoning each of the patients was impractical.

Re: The NHS is selling your private data – here's the price list [pdf]

#70

Post by lrei »

I would just like to point out that even if they "anonymize" the records it's generally not that hard to de-anonymize data.

During the Netflix prize, randomly generated IDs were eventually matched to people based simply on movie ratings and matching public information in other public sources:

http://www.wired.com/politics/security/commentary/securityma...

With medical data, it will probably be trivial (maybe easier or more appealing to insurance companies?).

We're a lot more unique than we think. Reminds me of this EFF project:

https://panopticlick.eff.org/

Some companies will probably resell this information to potential employers, banks (there goes your loan), etc.

Well, that's going to suck for people in the UK.

Post reply on HN