1. Medical data: privacy, anonymity, and security What can we learn from the furore around the NHS data sharing plans (“care.data”)? Dr Eerke Boiten Director, Interdisciplinary Centre for Cyber Security, University of Kent (ISC) 2 10 Dec 2014

2. This talk will consider whether such databases can be created in a way that gives high levels of security as well as respecting privacy of the sensitive medical information contained in them.

3. Integrated medical data process GP data, existing databases (e.g. HES) National medical database of everything Pseudonymised database of everything Shared extracts Section 251 shares Aggregated anonymous open data published

4. Integrated medical data process … with safeguards? GP data, existing databases (e.g. HES) National medical database of everything Pseudonymised database of everything Shared extracts Section 251 shares Aggregated anonymous open data published opt outs; sensitive excl AG HSCIC Audits Resharing None! Inquiries (Partridge) “health purposes” Health Data Guardian

5. Concerns Transparency Security: honeypot, severity: lasting effect Diligence: HSCIC sharing, procedures Pseudonymisation doesn’t work (next slide) Honesty: privacy, HSCIC record, sharing Mixing the uncontroversial and highly controversial purposes!

6. Anonymity, or not Read Codes rich info. David Davis MP: 5 broken noses. Governor Weld in Massachusetts. All those: low probability scenarios. Reversible pseudonym generation. (HES: table held safely by HSCIC.) Pseudo at source would be better? Gender: contraceptives, prostate, HPV vacc. Age: birth, vaccinations, “fall after 75”. Family members: sharing/changing GP. Mum: family member, birth matches pregnancy Conclusion: may need very little other info to re-identify even fully pseudonymised data. Mixed messages (and lobbying?) at European level.

7. Sharing does not work! Auditing now very slowly introduced Deletion: refused; certificates!? On-sharing: not regulated (anyone heard of software license? Transitivity of purpose?); within multiple-purpose organisations? Re-identification “illegal” but [big data profiling: no privacy, no traceability]; penalties?

8. On the horizon Fume cupboard (e.g. model used for census; also EasternARC Big Data) – Controlled access – Controlled output – Sanitised output “Accredited safe haven” – security?! More oversight, more consent, more transparency

9. More? Better? Software engineering, research ethics and data protection legislation provide narratives for regulation: “purpose” before “resource”. (Deliberate confusion with “open data” narrative.) Sampling techniques? How can strong big data fit in with this? More liberal form of fume cupboards possible if we can identify “attacks” better.

10. Thank you Feedback welcome. See https://blogs.kent.ac.uk/eerke/2014/05/29/notjustadatabase for “narrative” https://blogs.kent.ac.uk/eerke/2014/05/29/notjustadatabase