ICO Broadens Data Privacy Investigation To 30 Organizations
Ingelore Clason
The New York Times/CBS News/YouGov collaboration was the most visible, but other organizations were quietly testing similar approaches. One other trend was the increase in the number of pollsters using registered voter lists, rather than the traditional random digit dialing, to obtain their samples. Although voter list sampling has been around for a long time, the quality of the voter databases has improved in the past few years, making them more attractive as sample sources. Nevertheless, regardless of methodology, many polls underestimated the size of the Republican victory this year, in contrast to 2012 when polls had the opposite problem: they tended to underestimate the performance of Democratic candidates.
Open science also expands access to knowledge and to the research process itself. One important justification for expanded access is the public support for a large portion of the research activity that leads to reported results. The federal government invested $121 billion in research and development (R&D) spending in fiscal year 2015. About $34 billion of the total is allocated to university R&D, resulting in datasets, publications, and other outputs (Rosenbloom et al., 2015; Edwards, 2017; NSB, 2018). Federal spending on intramural research totaled about $36 billion in 2015 (NSB, 2018). Over the past several decades, the belief that knowledge whose creation has been supported by the public should be accessible to the public has gained considerable ground. For example, disease advocacy organizations and consumer groups played an important role in support of NIH's policy of requiring that publications based on NIH-funded work be made available to the public following an embargo period (Albert, 2006). As will be explored in more detail below, support for open science is growing among researchers, although attitudes are ambiguous (Odell et al., 2017). In 1997, the National Research Council recommended that:
Full and open access to scientific data should be adopted as the international norm for the exchange of scientific data derived from publicly funded research. The public-good interests in the full and open access to and use of scientific data need to be balanced against legitimate concerns for the protection of national security, individual privacy, and intellectual property (NRC, 1997).
As described above, open science is critical for addressing the reproducibility challenge in scientific research while facilitating future research that validates or builds on previous results. An unintended and potentially harmful consequence of publicly sharing research data, however, is the possible effect on privacy. Researchers have long recognized the privacy implications of publicly sharing research data, especially when such data involve human subjects, such as patients in a clinical trial. The tension between privacy protection and scientific openness is longstanding. For example, many studies in the area of public health pertain to health care records and medical history, which makes it extremely difficult, if not impossible, to maintain patient privacy while openly sharing all the information necessary to reproduce or replicate a published study (O'Neill et al., 2016).
Recent advances in data privacy aim to address this issue by developing techniques that are agnostic to adversarial background knowledge. A notable example is the concept of differential privacy (Dwork, 2008), which is a uniform privacy guarantee no matter what background knowledge an adversary possesses. A wide variety of techniques has been developed to achieve differential privacy, mostly by inserting random noise into the data being released or to the query answers being generated from the dataset. In spite of these advances, there are still significant challenges facing the wide adoption of differential privacy in the research community. A notable one is how to validate previous research results or establish new findings from data that have already been perturbed with random noise. While one might be tempted to simply rerun the original research workflow over the perturbed data, research has shown that doing so may lead to statistically invalid results that require complex, task-specific procedures to correct (Gaboardi et al., 2016; Rogers et al., 2016). As such, the proper balance between open data and privacy protection of human subjects is still a major ongoing challenge. Several repositories have been developed as emerging solutions to these issues, including Genotypes and Phenotypes (dbGAP) for genotype-phenotype relationships (Mailman et al., 2007; dbGap, 2018), the Yale University Open Data Access (YODA) project for clinical trials (The YODA Project, 2018), and the forthcoming Vivli platform for clinical research (Vivli, 2018). However, these repositories are expensive to set up and manage, and should be part of the infrastructure that is developed to support open science.
Exterro empowers legal teams to proactively and defensibly manage their Legal Governance, Risk, and Compliance (Legal GRC) requirements. Our Legal GRC software is the only comprehensive platform that automates the complex interconnections of privacy, legal operations, digital investigations, cybersecurity response, compliance, and information governance. Thousands of legal teams around the world in corporations, law firms, and government and law enforcement agencies trust our integrated Legal GRC platform to manage their risks and drive successful outcomes at a lower cost. For more information, visit exterro.com.
The Executive Order bolsters an already rigorous array of privacy and civil liberties safeguards for U.S. signals intelligence activities. It also creates an independent and binding mechanism enabling individuals in qualifying states and regional economic integration organizations, as designated under the E.O., to seek redress if they believe their personal data was collected through U.S. signals intelligence in a manner that violated applicable U.S. law.
U.S. and EU companies large and small across all sectors of the economy rely upon cross-border data flows to participate in the digital economy and expand economic opportunities. The EU-U.S. DPF represents the culmination of a joint effort by the United States and the European Commission to restore trust and stability to transatlantic data flows and reflects the strength of the enduring EU-U.S. relationship based on our shared values.
The security center expands on advanced settings in the Google Admin console to surface your security data through insightful, customizable reports that you can share with colleagues in your organization. Administrators can also monitor the configuration of Google Admin console settings from the security health page. Additionally, admins can use the investigation tool to identify, triage, and take action on security and privacy issues in your domain.
About Laminar
Laminar, a Rubrik company, combines cloud-native design with deep security expertise to provide the visibility and control organizations need to protect their most sensitive data. The Laminar Data Security Platform continuously discovers and classifies cloud data, structured and unstructured, across managed and self-hosted data stores, including unknown shadow data, without the data ever leaving your environment. It analyzes access, usage patterns, and security posture, and provides actionable, guided remediation for data security risk. Together, Rubrik and Laminar enable organizations to be even more proactive in the fight against cyberattacks and provide businesses with a complete cyber resilience solution.
Business Associate Defined. In general, a business associate is a person or organization, other than a member of a covered entity's workforce, that performs certain functions or activities on behalf of, or provides certain services to, a covered entity that involve the use or disclosure of individually identifiable health information. Business associate functions or activities on behalf of a covered entity include claims processing, data analysis, utilization review, and billing.9 Business associate services to a covered entity are limited to legal, actuarial, accounting, consulting, data aggregation, management, administrative, accreditation, or financial services. However, persons or organizations are not considered business associates if their functions or services do not involve the use or disclosure of protected health information, and where any access to protected health information by such persons would be incidental, if at all. A covered entity can be the business associate of another covered entity.
Preemption. In general, State laws that are contrary to the Privacy Rule are preempted by the federal requirements, which means that the federal requirements will apply.85 "Contrary" means that it would be impossible for a covered entity to comply with both the State and federal requirements, or that the provision of State law is an obstacle to accomplishing the full purposes and objectives of the Administrative Simplification provisions of HIPAA.86 The Privacy Rule provides exceptions to the general rule of federal preemption for contrary State laws that (1) relate to the privacy of individually identifiable health information and provide greater privacy protections or privacy rights with respect to such information, (2) provide for the reporting of disease or injury, child abuse, birth, or death, or for public health surveillance, investigation, or intervention, or (3) require certain health plan reporting, such as for management or financial audits.
1 Pub. L. 104-191.
2 65 FR 82462.
3 67 FR 53182.
4 45 C.F.R. 160.102, 160.103.
5 Even if an entity, such as a community health center, does not meet the definition of a health plan, it may, nonetheless, meet the definition of a health care provider, and, if it transmits health information in electronic form in connection with the transactions for which the Secretary of HHS has adopted standards under HIPAA, may still be a covered entity.
6 45 C.F.R. 160.102, 160.103; see Social Security Act 1172(a)(3), 42 U.S.C. 1320d-1(a)(3).
The transaction standards are established by the HIPAA Transactions Rule at 45 C.F.R. Part 162.
7 45 C.F.R. 160.103.
8 45 C.F.R. 164.500(b).
9 45 C.F.R. 160.103.
10 45 C.F.R. 164.502(e), 164.504(e).
11 45 C.F.R. 164.532
12 45 C.F.R. 160.103.
13 45 C.F.R. 160.103
14 45 C.F.R. 164.502(d)(2), 164.514(a) and (b).
15 The following identifiers of the individual or of relatives, employers, or household members of the individual must be removed to achieve the "safe harbor" method of de-identification: (A) Names; (B) All geographic subdivisions smaller than a State, including street address, city, county, precinct, zip code, and their equivalent geocodes, except for the initial three digits of a zip code if, according to the current publicly available data from the Bureau of Census (1) the geographic units formed by combining all zip codes with the same three initial digits contains more than 20,000 people; and (2) the initial three digits of a zip code for all such geographic units containing 20,000 or fewer people is changed to 000; (C) All elements of dates (except year) for dates directly related to the individual, including birth date, admission date, discharge date, date of death; and all ages over 89 and all elements of dates (including year) indicative of such age, except that such ages and elements may be aggregated into a single category of age 90 or older; (D) Telephone numbers; (E) Fax numbers; (F) Electronic mail addresses: (G) Social security numbers; (H) Medical record numbers; (I) Health plan beneficiary numbers; (J) Account numbers; (K) Certificate/license numbers; (L) Vehicle identifiers and serial numbers, including license plate numbers; (M) Device identifiers and serial numbers; (N) Web Universal Resource Locators (URLs); (O) Internet Protocol (IP) address numbers; (P) Biometric identifiers, including finger and voice prints; (Q) Full face photographic images and any comparable images; and any other unique identifying number, characteristic, or code, except as permitted for re-identification purposes provided certain conditions are met. In addition to the removal of the above-stated identifiers, the covered entity may not have actual knowledge that the remaining information could be used alone or in combination with any other information to identify an individual who is subject of the information. 45 C.F.R. 164.514(b).
16 45 C.F.R. 164.502(a).
17 45 C.F.R. 164.502(a)(2).
18 45 C.F.R. 164.502(a)(1).
19 45 C.F.R. 164.506(c).
20 45 C.F.R. 164.501.
21 45 C.F.R. 164.501.
22 45 C.F.R. 164.501.
23 45 C.F.R. 164.508(a)(2)
24 45 C.F.R. 164.506(b).
25 45 C.F.R. 164.510(a).
26 45 C.F.R. 164.510(b).
27 45 C.F.R. 164.502(a)(1)(iii).
28 See 45 C.F.R. 164.512.
29 45 C.F.R. 164.512(a).
30 45 C.F.R. 164.512(b).
31 45 C.F.R. 164.512(a), (c).
32 45 C.F.R. 164.512(d).
33 45 C.F.R. 164.512(e).
34 45 C.F.R. 164.512(f).
35 45 C.F.R. 164.512(g).
36 45 C.F.R. 164.512(h).
37 The Privacy Rule defines research as, "a systematic investigation, including research development, testing, and evaluation, designed to develop or contribute to generalizable knowledge." 45 C.F.R. 164.501.
38 45 C.F.R. 164.512(i).
39 45 CFR 164.514(e).
40 45 C.F.R. 164.512(j).
41 45 C.F.R. 164.512(k).
42 45 C.F.R. 164.512(l).
43 45 C.F.R. 164.514(e). A limited data set is protected health information that excludes the
following direct identifiers of the individual or of relatives, employers, or household members of
the individual: (i) Names; (ii) Postal address information, other than town or city, State and zip
code; (iii) Telephone numbers; (iv) Fax numbers; (v) Electronic mail addresses: (vi) Social
security numbers; (vii) Medical record numbers; (viii) Health plan beneficiary numbers; (ix)
Account numbers; (x) Certificate/license numbers; (xi) Vehicle identifiers and serial numbers,
including license plate numbers; (xii) Device identifiers and serial numbers; (xiii) Web Universal
Resource Locators (URLs); (xiv) Internet Protocol (IP) address numbers; (xv) Biometric
identifiers, including finger and voice prints; (xvi) Full face photographic images and any
comparable images. 45 C.F.R. 164.514(e)(2).
44 45 C.F.R. 164.508.
45 A covered entity may condition the provision of health care solely to generate protected health information for disclosure to a third party on the individual giving authorization to disclose the information to the third party. For example, a covered entity physician may condition the provision of a physical examination to be paid for by a life insurance issuer on an individual's authorization to disclose the results of that examination to the life insurance issuer. A health plan may condition enrollment or benefits eligibility on the individual giving authorization, requested before the individual's enrollment, to obtain protected health information (other than psychotherapy notes) to determine the individual's eligibility or enrollment or for underwriting or risk rating. A covered health care provider may condition treatment related to research (e.g., clinical trials) on the individual giving authorization to use or disclose the individual's protected health information for the research. 45 C.F.R. 508(b)(4).
46 45 CFR 164.532.
47 "Psychotherapy notes" means notes recorded (in any medium) by a health care provider who is a mental health professional documenting or analyzing the contents of conversation during a private counseling session or a group, joint, or family counseling session and that are separated from the rest of the of the individual's medical record. Psychotherapy notes excludes medication prescription and monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests, and any summary of the following items: diagnosis, functional status, the treatment plan, symptoms, prognosis, and progress to date.
45 C.F.R. 164.501.
48 45 C.F.R. 164.508(a)(2).
49 45 C.F.R. 164.501 and 164.508(a)(3).
50 45 C.F.R. 164.502(b) and 164.514 (d).
51 45 C.F.R. 164.520(a) and (b). A group health plan, or a health insurer or HMO with respect to the group health plan, that intends to disclose protected health information (including enrollment data or summary health information) to the plan sponsor, must state that fact in the notice. Special statements are also required in the notice if a covered entity intends to contact individuals about health-related benefits or services, treatment alternatives, or appointment reminders, or for the covered entity's own fundraising.
52 45 C.F.R. 164.520(c).
53 45 C.F.R. 164.520(d).
54 45 C.F.R. 164.520(c).
55 45 C.F.R. 164.524.
56 45 C.F.R. 164.501.
57 A covered entity may deny an individual access, provided that the individual is given a right to have such denials reviewed by a licensed health care professional (who is designated by the covered entity and who did not participate in the original decision to deny), when a licensed health care professional has determined, in the exercise of professional judgment, that: (a) the access requested is reasonably likely to endanger the life or physical safety of the individual or another person; (b) the protected health information makes reference to another person (unless such other person is a health care provider) and the access requested is reasonably likely to cause substantial harm to such other person; or (c) the request for access is made by the individual's personal representative and the provision of access to such personal representative is reasonably likely to cause substantial harm to the individual or another person.