Big Data and Public Health: Navigating Privacy Laws to Maximize Potential

This installment of Law and the Public's Health examines the constellation of laws governing health information privacy and their application to big data in public health. Big data holds great promise for public health, given the nature of services such as monitoring population health status, evaluating population-based health service quality, and conducting research for innovative solutions.¹ These activities require the ability to collect volumes of information, rapidly interpret data, and monitor data for long periods of time—all functions that are the hallmark of big data solutions. Despite misconceptions about health information privacy laws, the legal framework is quite permissive and need not operate as a barrier.

This article defines big data, provides an overview of how laws related to health information privacy apply to big data, and discusses the implications of this framework for public health policy and practice.

BACKGROUND

“Big data” is characterized by three Vs—volume, velocity, and variety—and cannot be managed with standard database processing methods.² Big data's value is in its use—combining large amounts of information from multiple sources into a single dataset permits identification of correlations and patterns that would be hidden in siloed datasets.³ Access to a single big dataset allows users to fill in information gaps and check for consistency, capturing a more accurate picture of the population being evaluated.⁴ Big data technologies also permit the storage of volumes of information indefinitely so that data can be used in the future for a purpose other than that for which they were originally collected (i.e., a secondary use).⁵ The University of Pittsburgh is demonstrating the value of secondary uses through Project Tycho, which put 88 million disease reports published since 1888 in the Centers for Disease Control and Prevention's (CDC's) Morbidity and Mortality Weekly Report into an open-access database.⁶ The team used the database to demonstrate the effect of vaccinations on diseases such as polio, and other uses neither considered nor possible when the information was first collected.

Solutions for data collection, storage, processing, and analysis have become abundant and affordable, permitting users across industries to manage the size, speed, and complexity of big data.¹ These technological advancements have ushered in what some herald as the “big data revolution,”⁷ although its full potential in the health-care sector has not been realized due to financing, interoperability issues, and legal concerns related to information privacy and security.

HEALTH INFORMATION PRIVACY AND THE LEGAL FRAMEWORK FOR BIG DATA

The health information privacy framework is a patchwork of often-overlapping federal and state laws that regulate specific types of information, individuals, and organizations.⁸ Confusion related to the scope and application of this framework, as well as the complexity of the laws, has made the framework a perceived barrier to big data use. However, the framework permits many big data uses that are beneficial to public health.

Federal laws and regulations

The Health Information Portability and Accountability Act of 1996 (HIPAA).

The HIPAA Privacy Rule governs “protected health information” (PHI), which is individually identifiable information about an individual's care, health condition, or payment for care.⁹ The Privacy Rule does not govern “de-identified information,”¹⁰ information from which 18 identifiers are removed or that an expert determines carries a minimal risk of being able to identify an individual if used.¹¹ The Privacy Rule applies to “covered entities” (i.e., health plans, health-care clearinghouses, and most health-care providers¹²) and their “business associates” (i.e., entities having access to or using PHI when performing specified functions or services for the covered entity¹³), collectively referred to herein as “regulated entities.”

Regulated entities are required to disclose PHI to the individual subject of the information or his/her designated representative and to the Secretary of the U.S. Department of Health and Human Services for purposes of investigations or enforcement. Regulated entities may disclose most PHI to anyone else with the individual's authorization, and are permitted (but not required) to disclose PHI without authorization in accordance with one of many permissive disclosure exceptions.¹⁴

Treatment, payment, and operations.

Generally, regulated entities may disclose PHI without authorization for treatment purposes (e.g., patient care delivery), payment activities (e.g., payment for services), and health-care operations (e.g., quality improvement efforts).¹⁵

Public health activities.

Regulated entities may disclose PHI without authorization to legally authorized public health entities for purposes related to preventing or controlling disease, injury, or disability (e.g., disease reporting, surveillance, and interventions).¹⁶ Subject to limitations, the Privacy Rule identifies six other public health activities for which disclosure is permissible, including disclosure to a person exposed to a communicable disease and immunization reporting to a school.¹⁷

Other exceptions.

The Privacy Rule identifies 11 other purposes for which disclosure may be made without authorization.¹⁸ These exceptions are limited to specific activities that are beneficial to the public, including for national security purposes, certain law enforcement activities, and research, if a privacy or an institutional review board (IRB) has waived or altered the authorization requirement, or if the PHI will only be used for certain limited purposes.

Limited datasets.

Regulated entities may disclose a limited dataset without authorization for research, public health, or health-care operations.¹⁹ A limited dataset is PHI devoid of 16 specified identifiers, but may include city, state, and ZIP code; dates; and characters or codes that are not direct identifiers. The parties exchanging the dataset must enter into a data use agreement governing the use of the limited dataset(s).

The Common Rule.

The Common Rule protects most human subjects involved in federally funded research²⁰ as well as individually identifiable private information obtained from a subject,²¹ and generally requires either IRB approval and patient consent or IRB waiver of the consent requirement.²² The Common Rule does not govern studies conducted using existing patient information, observation of public behavior, or survey or interview procedures. The Common Rule also exempts studies using existing data, records, or bio-specimens if the results do not reveal the subject's identity or if the data sources are publicly available.²⁰

The Genetic Information Nondisclosure Act of 2008 (GINA).

GINA generally prohibits health plans from using genetic information to make coverage-related decisions and requesting that beneficiaries undergo genetic testing or provide genetic information.²³ GINA also generally prohibits employers from discriminating against employees or applicants based on genetic information and from using genetic information in employment decisions, subject to exceptions.²⁴ Employers may disclose genetic information in certain circumstances, including to an occupational or health researcher and to a public health organization if the information relates to a contagious disease presenting an imminent threat of serious harm or death.²⁵

42 C.F.R. Part 2 (Part 2).

Part 2 applies to substance abuse programs that are federally assisted,²⁶ which includes providers who participate in Medicare, have a U.S. Drug Enforcement Administration number, or are federally tax exempt.²⁷ Providers must obtain written patient consent to disclose information that could identify that individual as a substance abuser,²⁸ with limited exceptions, including identifying disclosures for purposes of a state-mandated inquiry into a patient's cause of death,²⁷ child abuse reporting,²⁹ and certain research activities.³⁰

State laws and regulations

States define their own privacy framework, which typically includes laws governing the same entities, activities, and/or types of information as the all federal laws.³¹ Generally, providers must comply with all federal laws and any state requirements that are more protective.³² States often provide enhanced protections for certain sensitive information (e.g., human immunodeficiency virus/acquired immunodeficiency syndrome test results³³ and mental health information³⁴), and for some vulnerable populations (e.g., minors). State laws and regulations are relevant to the extent that they restrict disclosure of identifiable information more than federal laws, and entities that disclose or use identifiable information must be aware of how their state regulates sensitive information. Additionally, states often require reporting of certain information related to communicable diseases, and generally maintain and mandate reporting to condition-specific (e.g., cancer) registries that support public health surveillance and research activities.

IMPLICATIONS FOR PUBLIC HEALTH PRACTICE AND POLICY

Understanding the federal framework for privacy is critical for big data use. While every law permits disclosure of health information with patient consent, obtaining consent may be impracticable, particularly for population-based activities. A number of exceptions permit disclosure of health information without consent, enabling public health functions. Unregulated domains outside the framework also present opportunities to make robust use of big data solutions.

Public health exceptions

Each federal law has carved out exceptions for basic public health services. HIPAA's exception is the broadest, permitting regulated entities to disclose PHI without authorization for activities related to preventing or controlling disease, injury, or disability.¹⁶ Traditional public health activities such as tracking disease outbreaks, monitoring use of certain drugs, and targeting preventive screenings are all exempted. One recent example is a New York database created by public health officials, which tracks prescription drug disbursement so that providers can determine if an individual has an existing prescription.³⁵ In its first year, the database received seven million queries from 66,000 providers, reducing doctor shopping by 75%.

Health-care operations

HIPAA's exception for health-care operations is quite permissive, encompassing many population health activities. For example, the National Drug Early Warning System, created by the University of Maryland's Center for Substance Abuse Research,³⁶ monitors social media and traditional data sources. Using big data analytics, it detects emerging drug trends so that public health officials can launch community interventions to prevent the spread of illicit drug use.

Quality improvement.

PHI may be disclosed for quality improvement activities, such as those facilitated by Minnesota's Reducing Avoidable Readmissions Effectively (RARE) project.³⁷ RARE uses hospital claims data to flag potentially preventable readmissions. Hospitals use this information to develop quality improvement interventions and redesign care processes. The RARE project has prevented nearly 8,000 readmissions.

Patient safety.

Following a U.S. Food and Drug Administration (FDA) codeine prescribing alert, Navy and Marine Corps Public Health Center health analysis staff used health system repository data and big data solutions to analyze prescription rates and determine the prevalence of codeine prescribing practices.³⁸ The staff determined that providers had not modified their prescribing practices, and subsequently launched an outreach program to share information about the risks identified in the FDA alert, reducing codeine prescriptions in the relevant population by 99% in two months. This intervention is a patient safety activity, permissible under the HIPAA health-care operations exception.

Improving population health.

PHI can be disclosed for population-based activities related to improving health or reducing costs. Population health management requires patient stratification, or identifying patients who will benefit from targeted interventions.³⁹ In 2001, Kaiser Permanente Northern California (KPNC) implemented a program to improve a 43.6% hypertension control rate. The program uses data from a central registry to stratify patients, automatically scan that list for gaps in care, and alert local practices when a patient's hypertension is not controlled. By 2009, hypertension control within KNPC reached 80.4%.⁴⁰

Successful population health management relies on combining demographic, behavioral, and clinical data to develop more effective interventions. At Duke University, researchers integrated census data, county tax-parcel information, crime and housing statistics, and environmental data to support public health projects.⁴¹ One county health department used the database to identify homes at high risk for childhood lead exposure, enabling the targeting of neighborhoods for interventions.

Outside the framework: unregulated domains

The legal framework for information privacy does not govern information that is de-identified, patient-generated, or in a nonregulated entity (e.g., a pharmaceutical company)'s possession. The following data sources are examples of data not subject to the health information privacy laws.

De-identified data.

De-identified information can support health-related activities such as population-based investigations and research, the findings from which can be used to improve health-care quality and delivery. For example, IBM and Belgian pharmaceutical firm UCB collaborated in 2012 to improve epilepsy care.⁴² The team is processing 1.5 million epilepsy patients' de-identified data, which it will use to develop predictive analytics for use by a physician at the point of care to make treatment recommendations to the patient.

Patient-generated data.

Individuals generate health information in myriad ways outside traditional health-care settings. Search engine queries about symptoms, over-the-counter drug purchases made with a pharmacy loyalty card, and social media data are all rich sources of information about an individual's health that can be used to perform public health functions. Recent examples include a Johns Hopkins program that can accurately predict where and when a flu outbreak will occur based only on tweets.⁴³ At Boston Children's Hospital, researchers can predict, track, and map obesity rates at the neighborhood level using only Facebook “likes.”⁴⁴

Non-regulated entities.

Websites such as PatientsLikeMe.com collect and aggregate health information about individuals for sale and certain uses, such as medical research. When collecting information owned by non-regulated entities, users should be aware that general privacy laws and regulations may apply depending on the state.

CONCLUSION

As illustrated, the legal framework governing health information does not impede or prohibit many big data uses that support improvements in public health. Big data technologies can collect, store, and process population data, so that they can be analyzed and shared with stakeholders or de-identified for research and other purposes. Analytics solutions can evaluate population data in real time to stratify patient cohorts, identify high-risk individuals and populations, and alert authorities of potential outbreaks. Using big data solutions, public health authorities can work faster and more efficiently to develop and share knowledge that will improve the public's health. The legal framework for information privacy does not limit these possibilities, but rather facilitates them.