Module 10 Topic discussion

[Saranath]

Data such as name, date of birth, citizenID, Hospital ID, phone number are considered as identifiable data. However, sometimes even there is no identifiable data provided. With a combination of non-identifiable data such as age, sex, occupation…., people can probably identify you.
Let’s try thinking about the combination of non-identifiable data that actually makes people know that this would be you.
Example: for myself, only the combination of these information would be able to identify me.
Sex: female
Education: MD, PhD.
Occupation: Associated Professor
Workplace: Department of Tropical Hygiene, Faculty of Tropical Medicine

[Zarni Lynn Kyaw]

With the advancement of AI and big-data, there are numerous methods now to identify each person from using only online traits. E.g.,
1) Computer Model
2) Browser Name
3) MAC address
4) Unique advertisement ID
5) Shopping habits (time, via an app, through browser)
6) IP address
7) Social media activity and behavior
8) Search engine queries
9) Location data
10) Device fingerprints
11) Biometric data (fingerprint, facial recognition, voice recognition)
12) Email and online account activity
13) Connected devices (smartphone, smartwatch, etc.)
14) Online purchase history and credit card information
15) Gaming and app usage history.

That’s why I used privacy focus browser and app tracking protection like DuckDuckGo but in the age of IT, privacy is increasing becoming a myth. Cambridge Analytica expose was an eye opener for me.

Bringing myself back to the realm of health informatics, to follow Arjan example,

Sex: Male
Education: MD
Occupation: Senior health financing consultant
Workplace: Community Partners International

Those would be very easy to identify me, someone can easily go to my organization website to look for my other identifiable data.

If someone have access to some survey’s raw data like national NCD survey (which I participate in), by combining the data (sex,education, occupation, workplace, and name), they could have access to my disease history and all sort of data.

Additionally, there are advances in profiling where some of the following non-identifiable data can be used.
1) Geographic location
2) Income level
3) Marital status
4) Ethnicity
5) Religion
6) Language spoken
7) Education level
8) Employment status
9) Health conditions
10) Hobbies and interests
11) Internet usage patterns
12) Social media activity

So, from ethical standpoint, I believe researchers have to code the identifiable data as well as encrypt the RAW data, so even if unauthorized person had access to the data there could be barrier from the unauthorized person to access the data.

[ABDILLAH FARKHAN]

My non-identifiable data are listed below:
1. Sex: Male
2. Nationality: Indonesian
3. Current location: Jakarta
4. Blood Type: O
5. Ethnicity: Java
6. Education: SKM (Bachelor of Public Health)
7. Occupation: Epidemiologist
8. Workplace: Directorate General of Disease Prevention and Control, Ministry of Health Indonesia
9. Year of enrolment in the workplace: 2018
10. Previous Education Institution: Universitas Diponegoro
11. Place of Birth: Tegal City, Central Java
12. Current Education Institution: Mahidol University

If that information is being filtered, data from numbers 1-10 will still show many people with the same characteristics. But starting from 11-12 is definitely me.

[Boonyarat Kanjanapongporn]

Identifiable data such as name, telephone number and email address are often protected and removed. However, indirect identification could happen from the combination of non-identify data (such as Age, Ethnicity, Job titles, City) which could lead others to identify the participants.
People would probably identify me from job related identifications because there are only a few people doing the same role. For example, if there is a survey conducted in my organization, people will know that the data below belongs to me.

Province: ChiangMai
Job titles: Pharmacist, part time
Organization: Chain Drugstore

[PREUT ASSAWAWORRARIT]

I would like to provide my non-identifiable data that could identify me if they are combined.
Job titles: internist, intensivist
Workplace: Department of Medicine, Faculty of Medicine, Chulalongkorn University

This topic discussion emphasizes that every record from containing patient information must be kept under security despite of de-identification or removal of identifiable data.

[Kansiri Apinantanakul]

I agree with Aj. and other classmate that the combination of non-identifiable information could be led to to identification of people. Only combination of these character could distinguish me among my colleagues (even though I have up to 70 staffs in my department) and other people
Occupation: Clinical Research Associate (CRA)
Workplace: MSD (Thailand)
Age: 26
It’s interesting that only combination of these 3 characters could identify me. One motto that I heard about concept of personal identification for a while is that the less people of your interest, the less identifier(s) you need to use for identification of people.

[Kawin Wongthamarin]

It’s shocking that when I think about it, identifying someone based on non-identifiable information isn’t as difficult as I thought. In today’s world where information is abundant on the internet. Example for me
Education: MD from Phramongkutklao College of Medicine
Current education: MSc, BHI
Age: 28

Just these three pieces of information can be used to easily identify my name and surname. Just search on the internet to see who graduated from Phramongkutklao Medical College and match it with a list of those who are currently studying in this course.

[Siriphak Pongthai]

Thank you for raising this issue. I previously thought that non-identifiable data cannot be tracked back to identify person. However, persons have their own and specific information. Once those non-identifiable data are combined, one can be identified.

For me, I think non-identifiable data that could make people be able to identify me include sex, age, educational information (primary school, high school, universities), occupation, organization of work, geographic data e.g. city/location of living, or (sometimes) salary.

The person, that I think they could definitely define me, is ones who are in the same field of work. Sometimes, search engine, such as google website, could be able to identify one by putting that information on it.

[SIPPAPAS WANGSRI]

In the world of data-driven era, big data and advancement in technology makes analysing a large quantity of data happens at a glance.

The extent to which data is identifiable depends on the number of subjects with those identifiers. In health data, we have HIPAA act which mainly focused on privacy issues. Let’s have a look at this for an obvious example!

Imagine that we are talking about elderly with an age of 90. How many of people nowadays who live that long, a thousand around the world? Maybe. But if we specify the location, such as male, age 90, who lived in Amphor Mae Sa Riang Chiang Mai, you may have just one or two person.

Another example, a guy from Chiang Mai, graduated from Faculty of Medicine. Age 26. Currently study MSc at Mahidol University. Without the name of a faculty — if you asked one of my friends, they will instantly know that that was me 😂

FYI, for those who interested in HIPAA, you can look up about it more here
https://www.hipaajournal.com/considered-phi-hipaa/

What are the 18 HIPAA Identifiers?
The 18 HIPAA identifiers are the identifiers that must be removed from a record set before any remaining health information is considered to be de-identified (see §164.514). However, due to the age of this list, Covered Entities should ensure that no further identifiers remain in a record set before disclosing any health information to a third party (i.e., for research). The 18 HIPAA identifiers are:

Names
Dates, except year
Telephone numbers
Geographic data
FAX numbers
Social Security numbers
Email addresses
Medical record numbers
Account numbers
Health plan beneficiary numbers
Certificate/license numbers
Vehicle identifiers and serial numbers including license plates
Web URLs
Device identifiers and serial numbers
Internet protocol addresses
Full face photos and comparable images
Biometric identifiers (i.e., retinal scan, fingerprints)
Any unique identifying number or code

[Tanyawat Saisongcroh]

Interesting issue here. Thanks for sharing the HIPAA link.

[Tanyawat Saisongcroh]

For myself, with the combination of these non-identifiable data, people will know that this would be me;

Sex: female
Job: Pediatric Orthopedic
Workplace: Ramathibodi Hospital
Position: junior staff

[Tanatorn Tilkanont]

Just notice that non-identifiable data in combination could identify someone particularly.
Myself, the non-identifiable data of the following combination could identify me.

Previous graduate : Faculty of Pharmaceutical Sciences, Khon Kaen University
Current education : MSc, BHI, Mahidol University
Current job and workplace : related to Data Management, Clinical research organization, Clinixir, Thailand

[Anawat ratchatorn]

It is very sure that just several non-identification data can identify me.

Sex : Male
Education : MD from Khon Kaen University. Studying BHI.
Previous job : Chief Information Officer at Ratchaphruek Hospital PCL Khon Kaen.
Age : 30

[Author]

Posts