The official journal of the American Medical Informatics Association. Publishes peer-reviewed research for biomedical and health informatics. Coverage includes

Personal information doesn't get much more personal than your medical history. Ensuring your medical records are secure remains a top priorty for the Federal Trade Commission as they settled their…

Mike Seay of Illinois was shocked to receive an envelope with 'Daughter Killed in Car Crash' under his name. Data experts say companies track such information.

The theft of a University of Minnesota professor’s laptop, portable scanner and external hard drive last February resulted in a data breach of the personal information of 119 victims and witness

the ACLU s version of ordering a pizza in the future.
scary !

Over the entire course of the Obama administration's terms in office, there's been something of a conflict.  While...

People's movements are highly predictable, researchers say, making it easy to identify most individuals from supposedly anonymized location datasets. As these datasets have valid uses, this is yet another reason why we need better regulation.

This page provides guidance about methods and approaches to achieve de-identification in accordance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule. The guidance explains and answers questions regarding the two methods that can be used to satisfy the Privacy Rule’s de-identification standard: Expert Determination and Safe Harbor . This guidance is intended to assist covered entities to understand what is de-identification, the general process by which de-identified information is created, and the options available for performing de-identification.

Background Privacy legislation in most jurisdictions allows the disclosure of health data for secondary purposes without patient consent if it is de-identified. Some recent articles in the medical, legal, and computer science literature have argued that de-identification methods do not provide sufficient protection because they are easy to reverse. Should this be the case, it would have significant and important implications on how health information is disclosed, including: (a) potentially limiting its availability for secondary purposes such as research, and (b) resulting in more identifiable health information being disclosed. Our objectives in this systematic review were to: (a) characterize known re-identification attacks on health data and contrast that to re-identification attacks on other kinds of data, (b) compute the overall proportion of records that have been correctly re-identified in these attacks, and (c) assess whether these demonstrate weaknesses in current de-identification methods.   Methods and Findings Searches were conducted in IEEE Xplore, ACM Digital Library, and PubMed. After screening, fourteen eligible articles representing distinct attacks were identified. On average, approximately a quarter of the records were re-identified across all studies (0.26 with 95% CI 0.046–0.478) and 0.34 for attacks on health data (95% CI 0–0.744). There was considerable uncertainty around the proportions as evidenced by the wide confidence intervals, and the mean proportion of records re-identified was sensitive to unpublished studies. Two of fourteen attacks were performed with data that was de-identified using existing standards. Only one of these attacks was on health data, which resulted in a success rate of 0.00013.   Conclusions The current evidence shows a high re-identification rate but is dominated by small-scale studies on data that was not de-identified according to existing standards. This evidence is insufficient to draw conclusions about the efficacy of de-identification methods.

What's being described as a massive hack in fact took advantage of an easily exploited loophole.

HORROR STORY WAITING TO HAPPEN. Zero consent! Where the hell was the IRB?

Yaniv Ehrlich’s lab at MIT has a new paper out in Science today, with a companion policy piece from the National Human Genome Research Institute at NIH. Apologies for icky paywalls but these are important papers.

The recent leak of a million UDIDs has users asking questions about privacy.