71–80 of 184 posts
Earlier quoted context omitted.
[deleted]
They didn't say they had approval from Google. That wouldn't make much sense, you don't really need approval from Google to use BigQuery, you just need to open a Google account and create a new BigQuery project on their Developers Console
Earlier quoted context omitted.
According to them, they got approval for doing that: > The alternative was to upload it to the cloud using tools such as Google Storage and use BigQuery to extract data from it. As PA has an existing relationship with Google, we pursued this route (with appropriate approval). This showed that it is possible to get even sensitive data in the cloud and apply proper safeguards.
So apparently they don't have money to spend on building a secure, state-owned cloud storage service for patient records right? I wonder, does the GCHQ use private cloud storage contractors or for spying material the government found money to create an appropriate database? :-)
Earlier quoted context omitted.
another update: "No individuals directly named records online. But a massive breach of the most basic information security policies to prevent jigsaw." https://twitter.com/bengoldacre/status/440488463008550912
We're going to need something longer than a tweet to explain what he's actually talking about.
This is the data in question: http://www.hscic.gov.uk/hes It is anonymised [1], publicly licensable data. Here are a list of users and uses. [2] [1] "We apply a strict statistical disclosure control in accordance with the HES protocol, to all published HES data. This suppresses small numbers to stop people identifying themselves and others, to ensure that patient confidentiality is maintained." [2] http://www.hscic.g…
I have begin collaborating in a rare diseases project. So imagine you have one or two people in the country with certain symptoms. How anonymous is that?
If so, you're probably one of the few people that IMO actually should have some access to that data.
Maybe you'll get lucky and the data will become a researcher free-for-all, like the Enron emails did. (Not likely, though.)
I shall be writing to my local MP about this, I'd encourage anyone else to do the same!
Earlier quoted context omitted.
We're going to need something longer than a tweet to explain what he's actually talking about.
I'd also assume the worst, even if there are no patient names out. There are too many examples of de-anonymization of purposefully anonymized data out there to warrant any belief that missing real world names alone should constitute much of a privacy blanket.
Why does the government repeatedly hire incompetent people?? They pay crazy amounts of money for it too. I hope there is a very public investigation into this. We are losing privacy every day now and this is one area of our lives that needs to remain private at all costs. There is very little I can see to gain and lots to lose from losing privacy in health. Especially in a public system like the NHS.
Good. Imo, the fearmongering here is actually quite irrational. Google have more credibility (and money) to lose from a high publicity hack than government contractors who already act with impunity . If they'd invested in their own own map-reduce deployment we'd only be hearing another story about government contractors wasted millions of £ in taxpayers money on Big Brother data analysis. > The extracted information…
>What specifically are people actually afraid of with regard to this data set? I just don't get the regular public outcry about NHS data. Well specifically it would be all the sensitive medial information which for some reason you omitted to mention in your comment. People are only talking about DOB and post codes because that information can be used to identify an individual and associate them with the medical recor…
The HES database contains attendence records. You only need a a single verified data point, such as a tabloid hack following you to the hospital one day, to remove pseudoanonymity. The debate over whether pseudoanonymised records or personalised records should be made available to organisations, in real terms, isn't distinct. You still only need one data point (an address, DOB etc) in the poorly pseudoanonymised set. Nothing really changes.
The implication seems to be the data is somehow less secure now its in Googles cloud, but that doesn't quite fit the reality of what we know about how data permeates through these incompetant organisations to begin with. The fact that PA had the data on DVD rather than disk is already an indication that they are a joke. Do you know of any prolific transparent encryption solutions for optical media? Most likely this data was in plaintext. If they carry the data around on unencrypted DVD what is the likelyhood that their own servers are secure, or at least more secure than Googles?
The bottom line is these records all exist and are necessary for the NHS to function, so a competant organisation may as well mine the data set. The issue, then, is that PA aren't competant, not that they use effective tools. Outrage is being misdirected.
I shall be writing to my local MP about this, I'd encourage anyone else to do the same!
I agree its the right thing to do, but I have very little faith in it making a difference.
The report in question (linked in the article) provides "exceptional" evidence for the performance of Cloud technology by comparing a Google BigQuery search against an on-premises SQL Server query. So, cloud is good because map-reduce performs better than relational databases...
Not even that - they say "We uploaded it into a traditional Microsoft SQL database on a 1TB drive". So it sounds like they were just using a single spindle. Purchasing an SSD for that SQL Server would probably have given comparable performance benefits.