Healthcare organizations spend hundreds of millions of dollars every year struggling to secure and protect patient records. Patients have traditionally demanded that their information be secured and inaccessible by the public. Regulations require due diligence to ensure that patient records are protected. In addition to this, healthcare organizations may also consider medical data as their intellectual property that can lead to further business intelligence.
But what happens when patients volunteer their private medical records into the public domain? In this article, I'd like to present my thoughts on this topic.
Consider the PatientsLikeMe website, which is a social networking platform for individuals to publicly share their medical data, including fine details of their diagnosis, physical conditions, locations, medications, mood, and other information. The benefits of PatientsLikeMe is clear: it is a wonderful platform for individuals and medical researchers to find useful statistical information about diseases, and for patients to connect with and share experiences with others who may be suffering similar conditions.
From a security and privacy lens, here are some of my observations:
False sense of anonymity. The PatientsLikeMe website does a fantastic job of declaring its openness policy by warning users that information shared on the platform can be collected and cached by search engines.
I spent some time studying profiles of individuals affected with conditions that, unfortunately, have a social stigma attached to them. A lot of these individuals chose to use a nick-name, or handle, instead of their real name in their profile. However, by using mere link and network analysis techniques (as presented in my Psychotronica series of talks), I was quickly able to uncloak the real identities of many of these individuals.
The issue here is that, despite the awareness efforts of PatientsLikeMe, many individuals using the service have a false sense of privacy: they may feel they are truly anonymous, yet their identities can be easily uncloaked.
Stunning intelligence potential for the adversary. It is clear that information collected from patient records can be useful to an adversary. However, a sophisticated adversary is likely to correlate the information found in the patent record online with additional sources of social data (Facebook profiles, Twitter messages, blogs, etc). This combined dashboard of intelligence, collected from piecing together additional sources of publicly available information, puts the adversary at a significant advantage. Not only can an external entity ascertain pure medical data, but also make judgment-calls on the lifestyle of the particular individual that may have led to his or her condition. In addition, the potential abuse for social engineering and manipulation tactics is also clear.
Business conflict. Many healthcare organizations are struggling to enforce security controls on traditional issues such as internal access management of medical data. Hundreds of millions of dollars are being spent by private healthcare organizations to promote internal security efforts. In the near future, as additional individuals share their medical information on social media platforms, the value of return from access controls to secure patient data will reduce. I realize the regulatory complications and influences here - it will be interesting to see how this plays out.
In summary, the medical benefits of services like PatientsLikeMe is clear. However, I do wish that individuals who utilize these services are more cognizant of the privacy and security implications. I also wish that healthcare organizations quickly rethink their stance on the security and privacy implications of social media (which seems to be limited in scope to monitoring their own employees) to better align the reality of the upcoming social age with their business.
[Note: I was interviewed by Kelly Jackson Higgins (DarkReading) on this topic, you can read some of my additional comments here: Social Networks For Patients Stir Privacy, Security Worries]