Dataset Information

The inadvertent disclosure of personal health information through peer-to-peer file sharing programs.

ABSTRACT:

Objective

There has been a consistent concern about the inadvertent disclosure of personal information through peer-to-peer file sharing applications, such as Limewire and Morpheus. Examples of personal health and financial information being exposed have been published. We wanted to estimate the extent to which personal health information (PHI) is being disclosed in this way, and compare that to the extent of disclosure of personal financial information (PFI).

Design

After careful review and approval of our protocol by our institutional research ethics board, files were downloaded from peer-to-peer file sharing networks and manually analyzed for the presence of PHI and PFI. The geographic region of the IP addresses was determined, and classified as either USA or Canada.

Measurement

We estimated the proportion of files that contain personal health and financial information for each region. We also estimated the proportion of search terms that return files with personal health and financial information. We ascertained and discuss the ethical issues related to this study.

Results

Approximately 0.4% of Canadian IP addresses had PHI, as did 0.5% of US IP addresses. There was more disclosure of financial information, at 1.7% of Canadian IP addresses and 4.7% of US IP addresses. An analysis of search terms used in these file sharing networks showed that a small percentage of the terms would return PHI and PFI files (ie, there are people successfully searching for PFI and PHI on the peer-to-peer file sharing networks).

Conclusion

There is a real risk of inadvertent disclosure of PHI through peer-to-peer file sharing networks, although the risk is not as large as for PFI. Anyone keeping PHI on their computers should avoid installing file sharing applications on their computers, or if they have to use such tools, actively manage the risks of inadvertent disclosure of their, their family's, their clients', or patients' PHI.

SUBMITTER: El Emam K

PROVIDER: S-EPMC3000774 | biostudies-literature | 2010 Mar-Apr

REPOSITORIES: biostudies-literature

ACCESS DATA

Publications

The inadvertent disclosure of personal health information through peer-to-peer file sharing programs.

El Emam Khaled K Neri Emilio E Jonker Elizabeth E Sokolova Marina M Peyton Liam L Neisa Angelica A Scassa Teresa T

Journal of the American Medical Informatics Association : JAMIA 20100301 2

<h4>Objective</h4>There has been a consistent concern about the inadvertent disclosure of personal information through peer-to-peer file sharing applications, such as Limewire and Morpheus. Examples of personal health and financial information being exposed have been published. We wanted to estimate the extent to which personal health information (PHI) is being disclosed in this way, and compare that to the extent of disclosure of personal financial information (PFI).<h4>Design</h4>After careful ...[more]

PMID: 20190057

Similar Datasets

Project description:ImportanceDigital health information has many potential health applications, but privacy is a growing concern among consumers and policy makers. Consent alone is increasingly seen as inadequate to safeguard privacy.ObjectiveTo determine whether different privacy protections are associated with consumers' willingness to share their digital health information for research, marketing, or clinical uses.Design, setting, and participantsThis 2020 national survey with an embedded conjoint experiment recruited US adults from a nationally representative sample with oversampling of Black and Hispanic individuals. Willingness to share digital information across 192 different scenarios reflecting the product of 4 possible privacy protections, 3 uses of information, 2 users of information, and 2 sources of digital information was evaluated. Each participant was randomly assigned 9 scenarios. The survey was administrated between July 10 and July 31, 2020, in Spanish and English. Analysis for this study was conducted between May 2021 and July 2022.Main outcomes and measuresParticipants rated each conjoint profile on a 5-point Likert scale measuring their willingness to share their personal digital information (with 5 indicating the most willingness to share). Results are reported as adjusted mean differences.ResultsOf the 6284 potential participants, 3539 (56%) responded to the conjoint scenarios. A total of 1858 participants (53%) were female, 758 (21%) identified as Black, 833 (24%) identified as Hispanic, 1149 (33%) had an annual income less than $50 000, and 1274 (36%) were 60 years or older. Participants were more willing to share health information with the presence of each individual privacy protection, including consent (difference, 0.32; 95% CI, 0.29-0.35; P < .001), followed by data deletion (difference, 0.16; 95% CI, 0.13-0.18; P < .001), oversight (difference, 0.13; 95% CI, 0.10-0.15; P < .001), and transparency of data collected (difference, 0.08; 95% CI, 0.05-0.10; P < .001). The relative importance (importance weight on a 0%-100% scale) was greatest for the purpose of use (29.9%) but when considered collectively, the 4 privacy protections together were the most important (51.5%) factor in the conjoint experiment. When the 4 privacy protections were considered separately, consent was the most important (23.9%).Conclusions and relevanceIn this survey study of a nationally representative sample of US adults, consumers' willingness to share personal digital health information for health purposes was associated with the presence of specific privacy protections beyond consent alone. Additional protections, including data transparency, oversight, and data deletion may strengthen consumer confidence in sharing their personal digital health information.

Project description:BackgroundHealth care providers are driven by greater participation and systemic cost savings irrespective of benefits to individual patients derived from sharing Personal Health Information (PHI). Protecting PHI is a critical issue in the sharing of health care information systems; yet, there is very little literature examining the topic of sharing PHI electronically. A good overview of the regulatory, privacy, and societal barriers to sharing PHI can be found in the 2009 Health Information Technology for Economic and Clinical Health Act.ObjectiveThis study investigated the factors that influence individuals' intentions to share their PHI electronically with health care providers, creating an understanding of how we can represent a patient's interests more accurately in sharing settings, instead of treating patients like predetermined subjects. Unlike privacy concern and trust, patient activation is a stable trait that is not subject to change in the short term and, thus, is a useful factor in predicting sharing behavior. We apply the extended privacy model in the health information sharing context and adapt this model to include patient activation and issue involvement to predict individuals' intentions.MethodsThis was a survey-based study with 1600+ participants using the Health Information National Trends Survey (HINTS) data to validate a model through various statistical techniques. The research method included an assessment of both the measurement and structural models with post hoc analysis.ResultsWe find that privacy concern has the most influence on individuals' intentions to share. Patient activation, issue involvement, and patient-physician relationship are significant predictors of sharing intention. We contribute to theory by introducing patient activation and issue involvement as proxies for personal interest factors in the health care context.ConclusionsOverall, this study found that although patients are open to sharing their PHI, they still have concerns over the privacy of their PHI during the sharing process. It is paramount to address this factor to increase information flow and identify how patients can assure that their privacy is protected. The outcome of this study is a set of recommendations for motivating the sharing of PHI. The goal of this research is to increase the health profile of the patients by integrating the testing and diagnoses of various doctors across health care providers and, thus, bring patients closer to the physicians.

Project description:ObjectiveDigital nudging has been mooted as a tool to alter user privacy behavior. However, empirical studies on digital nudging have yielded divergent results: while some studies found nudging to be highly effective, other studies found no such effects. Furthermore, previous studies employed a wide range of digital nudges, making it difficult to discern the effectiveness of digital nudging. To address these issues, we performed a systematic review of empirical studies on digital nudging and information disclosure as a specific privacy behavior.MethodThe search was conducted in five digital libraries and databases: Scopus, Google Scholar, ACM Digital Library, Web of Science, and Science Direct for peer-reviewed papers published in English after 2006, examining the effects of various nudging strategies on disclosure of personal information online.ResultsThe review unveiled 78 papers that employed four categories of nudge interventions: presentation, information, defaults, and incentives, either individually or in combination. A meta-analysis on a subset of papers with available data (n = 54) revealed a significant small-to-medium sized effect of the nudge interventions on disclosure (Hedges' g = 0.32). There was significant variation in the effectiveness of nudging (I2 = 89%), which was partially accounted for by interventions to increase disclosure being more effective than interventions to reduce disclosure. No evidence was found for differences in the effectiveness of nudging with presentation, information, defaults, and incentives interventions.ConclusionIdentifying ways to nudge users into making more informed and desirable privacy decisions is of significant practical and policy value. There is a growing interest in digital privacy nudges for disclosure of personal information, with most empirical papers focusing on nudging with presentation. Further research is needed to elucidate the relative effectiveness of different intervention strategies and how nudges can confound one another.

Project description:BackgroundLongitudinal personal health record (PHR) provides a foundation for managing patients' health care, but we do not have such a system in the U.S. except for the patients in the Department of Veterans Affairs. Such a gap exists mainly in the rest of the U.S. by the fact that patients' electronic health records are scattered across multiple health care facilities and often not shared due to privacy, security, and business interests concerns from both patients and health care organizations. In addition, patients have ethical concerns related to consent. To patients, data security, privacy, and consent are based on trustfulness, rather than patients' engagement in ensuring only authorized people can view their PHRs with patient-managed granularity. Resolving these challenges is an important step in making longitudinal PHR useful for patient care.ObjectiveThis research aims to design and implement a blockchain-enabled sharing platform prototype for PHR with desired patient-controlled data security, privacy, and consent granularity.MethodsBuilt upon our prior work of a blockchain-enabled access control (BAC) model, we design a blockchain-enabled sharing platform for PHR with patient-controlled security, privacy, and consent granularity. We further implement the construct by building a prototypical platform among a patient and two typical health care organizations. Health organizations that hold the patient's electronic health records can join the platform with trust based on the validation from the patient. The mutual trust can be established through a rigorous validation process by both the patient and the built-in Hyperledger Fabric blockchain consensus mechanism.ResultsWe proposed a system trusted by patients and health care providers and constructed a Web-based PHR sharing platform with patient-controlled security, privacy, and consent granularity. We analyzed the system scalability in three aspects and showed millisecond range of performance when simultaneously changing access permissions on hundreds of PHRs. Consent, security and privacy of the model are ensured by the merits of the BAC model. We discovered the current blockchain model limits the system scalability due to using a non-graphical database. A new graphical database is suggested for future improvements.ConclusionsIn this research, we report a solution to electronically sharing and managing patients' electronic health records originating from multiple organizations, focusing on privacy, security, and granularity control of consent in the U.S. Specifically, the system protects data security and privacy, and provides auditability, scalability, distributedness, patient consent autonomy, and zero-trust capabilities. The prototypical instantiation of the designed model suggested the feasibility of combining emerging blockchain technology with next generation access control model to tackle a longstanding longitudinal PHR problem.

Project description:BackgroundPatients and citizens need access to their health information to get a retrospective as well as a prospective view on their care and rehabilitation processes. However, patients' health information is stored in several health information systems and interoperability problems often hamper accessibility. In Sweden a national health information exchange (HIE) platform has been developed that enables information exchange between different health information systems. The aim of this study is to explore the opportunities and limitations of accessing and interacting with important health information through the Swedish national HIE platform.MethodsA single case study approach was used for this study as an in-depth understanding of the subject was needed. A fictive patient case with a pseudo-name was created based on an interview with a stroke coordinator in Stockholm County. Information access through the national health information exchange platform and available service contracts and application programming interfaces were studied using different scenarios.ResultsBased on the scenarios created in this study, patients would be able to access some health related information from their electronic health records using the national health information exchange platform. However, there is necessary information which is not retrievable as it is either stored in electronic health records and eHealth services which are not connected to the national health information exchange platform or there is no service contract developed for these types of information. In addition, patients are not able to share information with healthcare professionals.ConclusionThe national Swedish HIE platform provides the building blocks needed to allow patients online access to their health information in a fragmented and distributed health system. However, more complex interaction scenarios allowing patients to communicate with their health care providers or to update their health related information are not yet supported. Therefore it is of great importance to involve patients throughout the design and evaluation of eHealth services on both national and local levels to ensure that their needs for interoperability and information exchange are met.

Dataset Information

The inadvertent disclosure of personal health information through peer-to-peer file sharing programs.

Objective

Design

Measurement

Results

Conclusion

Publications

The inadvertent disclosure of personal health information through peer-to-peer file sharing programs.

Similar Datasets

OmicsDI is part of the ELIXIR infrastructure

Tweets