Chapter 8 Multilateral Security Information flowing across boundaries

Multilateral Models Compartmentation Chinese wall BMA (British Medical Association) Develop system to track from conception to autopsy Policy consists of nine principles listed on pages Pilot implementations of BMA are in service

Inference Control If take name off of medical record is that enough? Medicare keeps 3 sets of records Complete records Beneficiary encrypted Public access Inference control first looked at in census data One record in 1000 made available Noise added Extreme values not included in averages

Theory of inference control Query set size control Trackers Cell suppression Which sometimes requires complementary cell suppression Limit number of attributes of query Audit based controls Randomization

De-identification It is hard Issues can be politically fraught How to pick out specific data in a sea of information

Residual problem Insurers get all the data in order to pay claim They want to know who the most expensive doctors and patients are These are politically charged issue that seldom have rational solutions

Medical records Easy problem setting up system of access controls to the record can only be viewed by sensible number of staff Harder problem statistical security Hardest problem managing interface between the 2 Specifically to medicine how to prevent spread of payment information

Discussion articles Current state of BMA Genetic database in Iceland Inference cases

List of Resources Multilateral security papers/202ra.pdf papers/202ra.pdf Chinese Wall all.html all.html

List of Resources Inference control tions/details.php?id= tions/details.php?id= tions/files/5264.pdf tions/files/5264.pdf trier.de/~ley/db/conf/icsd/icsd2002.html trier.de/~ley/db/conf/icsd/icsd2002.html nf.html nf.html

List of resources De-identification documentation-features-de-identification documentation-features-de-identification udip/index.html udip/index.html %20up/about/privacy.htm %20up/about/privacy.htm