CASE SPECIFIC 58

MEDICAL RECORDS — COMMUNITARIAN SOLUTION OF CREATING REGIONAL DATA CODIFICATION CENTERS IS FAR BETTER THAN EMBRACING A RIGHT TO PRIVACY

COMMUNITARIANS BALANCE MEDICAL PRIVACY AND RESEARCH THROUGH THE USE OF REGIONAL HEALTH DATA CODIFICATION CENTERS

3. To better protect privacy AND medical research we suggest the creation of a small number (say five) of regional health data codification centers. These centers will be licensed to keep re-identifying information in order to be able to link numerous and important existing bodies of data--which contain personal identifiers --with new bodies of data that will not contain personal identifiers but instead use code numbers.

DATA CODIFICATION CENTERS WILL MAKE DISAGGREGATED DATA AVAILABLE TO ALL

Nothing in these suggested regulations is to stand in way of the public (including the researchers and the press) from gaining access to data from which personal identifiers have been removed. The purpose of the centers is to provide well protected and sealed spaces for personal data so that they can be triangulated with other data.

To make the suggested linking centers possible, we urge that the clause that requires the destruction of identifiers "at the earliest opportunity" be struck from the regulations.

ADMINISTRATIVE SET UP OF DATA CODIFICATION CENTERS CAN BE EFFECTIVELY IMPLEMENTED

The centers might be financed by public seed money and small user fees. While HHS has no authority to regulate researchers in the matters at hand, these centers may require their users--on a contractual basis--to abide by their privacy rules. These should include a prohibition on "reverse engineering," which is defined as the uncovering of the identity of those people provided with code numbers by the centers. It should be further noted that very few if any researchers would have a motivation to engage in such an activity.

The work of the centers will be reviewed (by an authority to be determined) to establish whether privacy violations have occurred and if found, how these might be avoided. If after five years of experimentation significant privacy violations still occur, the centers may be discontinued.

DATA CODIFICATION CENTERS WILL BE CONTROLLED BY THE COMMUNITY

Each center's board might include two privacy advocates (selected from among those with experience in quantitative research) and two health researchers, and a fifth person to be chosen by the four.