Preserving Patient Confidentiality as Data Grow: Implications of the Ability to Reidentify Physical Activity Data

Abstract

Individual information has the potential to be individually identifying information.In their article, Na et al 1 demonstrate the potential for activity data collected by commercially available smart watches, smartphones, and fitness trackers to contribute to probabilistic reidentification of research participants.Activity tracker data join a long list of previously reported data types that can be reidentified (eg, those described by Erlich and Narayanan 2 and Sweeney 3 ).Given this history, the results of Na et al are not surprising; however, these findings are important because they speak to a core value of medicine-confidentiality-in a context of growing relevance: waveform data of the sort used by Na and colleagues are becoming more common with the widespread availability of sensors to generate these data and the potential for remote monitoring reimbursement to speed their clinical adoption.4 Confidentiality and privacy are foundational principles of both medical practice and research, as captured in the Hippocratic oath, Declaration of Geneva, American Medical Association Code of Medical Ethics, and Declaration of Helsinki.More than 30 years ago, Siegler 5 recognized the potential for emerging team-based high-technology medical care to substantially alter the foundational confidentiality patients could expect from medicine.Na et al 1 build on Siegler's work and the prior literature on reidentification as a reminder to researchers and physicians that the nature of confidentiality we provide to patients evolves with technology, which frequently changes faster than patient expectations.The issue is not merely what happens when higher-tech health care is delivered as expected.Health care providers and health plans (terms used in the US Health and Human Services database)often fall short of the goal of perfect confidentiality protections-recent evidence shows a large and growing number of protected health information disclosures.6 Those disclosures of identified health data are of particular concern in the context of the findings of Na and colleagues, as the identified records disclosed in medical record breaches serve as a beachhead of known identity from which to launch efforts at reidentification of other, theoretically deidentified, data.Any breaches of future health records that include remote monitoring and patient-generated activity data will increase the relevance of the study by Na et al. 1 Important work remains to be done.Those following Na and colleagues 1 will need to square this result with the existing literature on quasi-identifiers to establish the extent to which the reidentification accuracy seen in this article is attributable to the included quasi-identifying demographic microdata 7 as well as the literature on statistical disclosure controls to establish the potential to anonymize activity data.[8][9][10] At present, the result of the study by Na et al 1 is, to some extent, a worst-case scenario for reidentification of activity data: their study enforced homogeneity of devices and device carry positions and collected each participant's data within the same week so that the data were unaffected by long-term seasonal variability.Together, these factors may make reidentification of activity data less difficult.Including diverse devices and device carry positions makes activity recognition more difficult, 11 and we expect such diversity might make reidentifying participants more difficult too.Most importantly, if given a larger cohort of participants, the reidentification accuracy reported by Na et al 1 should decrease, not increase, because sparse categorical demographic characteristics, not the activity data itself, play the most significant role in overall reidentification accuracy.