thedatamap.org You, the Patient Physician, Hospital Payer (Insurer) Life Insurance Company You, the Patient Physician, Hospital ICU Management Blood & Tissue Personal Transport De-identification Debt Collection Clearing House Retirement & Disability Mental & Addiction Human Resources Accreditation Home Health Care Facility Dental/Vision Social Services Law & Justice Employer Clinical Lab Education Law Firms Payer (Insurer) Consulting Physician Employee Union Pharmacy Copy&Transport Registries SSA Transcription Pharmacy Benefits Manager Public Health Disease Management Coding Discharge Data Online Websites Associations When it comes to health data, trust begins with the doctor patient relationship. Without that trust, patients will not give useful information and may risk poor treatment. The patient needs to make his data transparent to physicians and hospitals. What is not transparent are all the places where the data may go. This is important because it is difficult to establish harm when data sharing is hidden. Using publicly available information acquired through breach notices and FOIA requests, we begin to track all the places a typical, but hypothetical patient's data may go. thedatamap.org shows our progress so far. . Each node represents a category of entites (e.g., companies and agencies) and the lines between them represent documented flows of personal health information. If the line is dashed, the information is shared without explicit personal identity. If the line is solid, the explicit name of the person is shared. You may click on any node to see actual names of entities and links to evidence of sharing depicted by edges of the node. Financial Vital Statistics Prescription Analytics Researcher Health IT Licensing Social Support CDC Medical Devices Personal Health Record Pharmaceutical Company Analytics Media Real Estate Employer’s Wellness Program thedatamap.org Federal Trade Commission Other Government

Flows not covered by HIPAA Life Insurance Company You, the Patient Physician, Hospital ICU Management Blood & Tissue Personal Transport De-identification Debt Collection Clearing House Retirement & Disability Mental & Addiction Human Resources Accreditation Home Health Care Facility Dental/Vision Social Services Law & Justice Employer Clinical Lab Education Law Firms Payer (Insurer) Consulting Physician Employee Union Pharmacy Copy&Transport Registries SSA Transcription Pharmacy Benefits Manager Public Health Disease Management Coding Discharge Data Online Websites Associations What is surprising about the image is the number of entities and some of the relationships. Another surprise is that of the hundreds of flows of personal health data documented on thedatamap,only half are actually covered by HIPAA. Most or all of the same data are available elsewhere, and not necessarily under any regime. This becomes important in understanding and assessing risks and remedies. A recipient of the data in the case study may have many other sources on which to link the data than those described. Financial Vital Statistics Prescription Analytics Researcher Health IT Licensing Social Support CDC Medical Devices Personal Health Record Pharmaceutical Company Analytics Media Real Estate Other Government Employer’s Wellness Program Federal Trade Commission Flows not covered by HIPAA