Only 13% of UK adults trust big tech firms with handling anonymized NHS data

https://techerati.com/news-hub/only-13-of-uk-adults-trust-tech-firms-with-anonymized-nhs-data/

by beastibash • 7 years ago

89 49 7 years ago

Australian authorities released "anonymised" data into the public domain for research. It didn't take long for the ever-amazing Dr. Vanessa Teague et al. to deanonymise it.

https://www.abc.net.au/news/science/2017-12-18/anonymous-med...

marcinzm3• 7 years ago

To be more specific she de-anonymised 7 individuals in the data set and claimed she could do more (if you used someone's semi-personal information).

The risk with good de-identification is generally not that they can find everyone but that given enough knowledge they can find one individual. Or in other words, that your friend find you in the data set with enough effort. It's also why you're supposed to remove famous people from such data sets.

luckylion4• 7 years ago

It's also why you're supposed to remove famous people from such data sets.

Because they deserve special protection the mere mortals don't?

Ensorceled2• 7 years ago

It's also why you're supposed to remove famous people from such data sets.

That's a very Boomer/Gen X thought pattern, Gen Y, Z and Alpha may not be famous yet but will be included in the data set.

cs02rm03• 7 years ago

It's also why you're supposed to remove famous people from such data sets.

I foresee an article - top 10 signs you shouldn't trust a dataset is sufficiently anonymised.

short_sells_poo• 7 years ago

I had an "of course they did" moment when the article stated:

In 2016, the Government proposed making the re-identification of government data an offence.

That's such a typical and idiotic response that it makes my blood boil. That someone can utter such mind-boggling bullshit in 2016. It highlights how the authorities, while having ostensibly good intentions, are absolutely and near-criminally clueless to the realities of modern technology. And I use the word "modern" loosely.

Post 2000, anyone who is in a position of power and proposes to fix a data-leak (and I believe this is a data-leak) by making it illegal to analyse said data leak, should be sent to a course on cyber-security, because they are apparently clueless and their decision making presents an acute risk.

kitd• 7 years ago

It reminds me of Theresa May's desire when she was UK Home Secretary of making it illegal to use non-Government-approved encryption algorithms. AFAIK, there are still plenty among UK Conservatives who believe it should be so.

tempguy99992• 7 years ago

Results like this always make me wonder what the minority think, how they justify it.

My guess is "I don't care" but it may be more nuanced than that, or something entirely else. I'd like to know if anyone can comment.

pessimizer• 7 years ago

Just wait a few minutes. On HN I bet the number is closer to 60/40 in favor.

As for the 13%, my guess is that they think "Important people say that it will help us to apply computers to NHS data, so they should have at it and advance civilization. Even better that it will be based on UK data, because they might pay us directly and they might be able to find current NHS inefficiencies, which may counter the austerity cuts that lengthened wait times and made our cancer statistics worse than US statistics. Finally, the UK will be thought of as the leading edge of this tech advance, and that might bring investments, employment, and tax receipts."

There could also be the realistic/fatalistic perspective that public opinion has little or no effect on government decision-making so you might as well think positively about it, because it's happening whenever they can sneak it through.

bogle• 7 years ago

Older family members of mine, who are conservative, have this knee-jerk response that it's valuable but there's no downside. As they lack critical thinking skills when they are challenged to suggest the value of this data to bad actors they will brush it off with an, "I can't think of any." Then if pushed they will really not be able to think of the possible consequences.

They all have the vote. They believe what they are told by people like them. They're uneducatable. I think they may be more that 13%!

SmellyGeekBoy2• 7 years ago

The NHS has had data leaks in the past and their IT is supposedly fairly outdated (if our tabloid press is to be believed) so perhaps they genuinely believe that a specialised company would be able to do a better job?

buboard• 7 years ago

This data point is not useful or usable. People should of course not trust anyone with their data, not even the NHS. The question is what tradeoffs they are willing to take considering the possible benefits for science and medicine. That's where researchers , universities and the industry could open a debate and inform the public about how to proceed in the future.

afarrell2• 7 years ago

People should of course not trust anyone with their data, not even the NHS

How do you even use the NHS without trusting them with your medical data?

luckylion4• 7 years ago

Trust != lack of alternative.

delroth• 7 years ago

Anyone got a link to the actual poll and/or the precise questions that were asked? As far as I can tell the original source for this article is a press release from a UK digital healthcare company [1]. There is a fairly obvious conflict of interest there, since big tech firms here means "our competition". It could very well be leading questions, results cherry-picking, etc.

[1] https://www.sensynehealth.com/insights/yougov-survey-shows-u...

Disclaimer: I work at Google, not on anything related to health or AI or ML.

marcinzm3• 7 years ago

If you're in the US then the tech giants can already easily get your de-identified billing data. Billing data would contain what was done, by whom, when (probably only at a year level), where and why. It costs money but a drop in the bucket for them.

So the question is I feel, given that this has already been done, has this caused real-life problems for anyone? Known re-identification would be a HIPAA violation I believe so more likely to be reported.

amelius• 7 years ago

Survey:

Q: Do you trust big tech with your data?

A: No, of course not!

Real world:

Q: If you trust us with your data, you will get access to X, and you will get discount on Y and free Z. Will you trust us?

A: Yes, sign me up!

danw1979• 7 years ago

Q: if you trust us with the very personal data about your health and medical conditions you'll get free healthcare !

A:. It's already free (at the point of use). Thanks anyway.

forgotmypwd123• 7 years ago

More like:

Q: Want access to X, and you will get discount on Y and free Z? You just have to tru-

A: OKAY!

ollie87• 7 years ago

As high as 13%? Wow, I thought it would be much, much lower.

johnnycab2• 7 years ago

There has been a very poor record of NHS and IT, at least for the last two decades i.e. the previous Labour government wasted £10bn+ and failed to provide any solutions. In the process, they alienated a range of medical professionals by creating a culture of mistrust towards the digital strategy[1]. In 2016, the 'WannaCry' ransomware attack, exposed the gaping holes in the system[2]. The current trend of rushing to give access to parts of the silo/NHS Spine to other providers like Babylon health et al., without due consideration or a debate, is another can of worms best left unopened.[3]

In the absence of any robust measures to safeguard data, it is right for the patients to be diligent and have a high degree of control over who gets access to their health data and opt-out while they still have a choice, as no explicit promises are provided by the NHS to keep your data confidential: use anonymised data whenever possible[4]

[1] https://www.theguardian.com/society/2013/sep/18/nhs-records-...

[2] https://www.bbc.co.uk/news/technology-41753022

[3] https://www.wired.co.uk/article/babylon-health-nhs

[4] https://www.nhs.uk/your-nhs-data-matters/where-confidential-...

cs02rm03• 7 years ago

I was a software dev working in the NHS at the time of the National Programme for IT. They couldn't decide how they wanted authorisation to work, whether it was role based or whatever else.

We put a config flag in to switch between the two models they were going back and forth between and just twiddled it every week for months. There was some set charge every time they did it. They had the opposite problem with anything that actually mattered where they couldn't make a decision at all. Some of that software is still running in hospitals 10+ years later with apparently little change since the the NPfIT died.

I moved out of the healthcare domain shortly after that. A few years ago I tried to sell some software for next to nothing to the NHS for a team my wife worked for. A simple webapp backed by a DB instead of spreadsheets on a shared drive. They took the idea and gave it to an in house employee who was running it as a side project (charging more for it than I was) and never finished building it.

Speaking to someone in charge of innovation for a large part of the country recently, he said he couldn't even take some software I'd offered for a free trial. As he saw it the system was so broken he was warning everyone off. And his job was innovation.

The NHS is ripe for improvement. I suspect its management haven't got a clue what they're doing though and fear the lure of big tech firms will be the only thing they can't resist.

TazeTSchnitzel• 7 years ago

Now living in Sweden which has what seem like very sophisticated e-health systems by comparison (at least on the user-facing side), I wonder why the UK couldn't have purchased and adapted an existing system that worked elsewhere.

DanBC5• 7 years ago

The current trend of rushing to give access to parts of the silo/NHS Spine to other providers like Babylon health et al., without due consideration or a debate, is another can of worms best left unopened.[3]

I don't get it. Babylon is just another provider. There's not much difference between Babylon and other GP providers - they get your data if you're their patient and not otherwise. They're subjected to the same rules as other GPs.

There isn't some huge database somewhere of "all the NHS data" that providers can dip into. Each provider has it's own data, with little bits fed-back into the gp system or the spine.

johnnycab2• 7 years ago

I don't get it. Babylon is just another provider. There's not much difference between Babylon and other GP providers - they get your data if you're their patient and not otherwise. They're subjected to the same rules as other GPs.

Babylon is unlike any other providers; it is an AI & Data first, app-based subscription model with a mix of state funded services. It's aim is to acquire more data in order to train models. The overwhelming majority of traditional GP's are primarily focused on patient first policy ─ they are usually non-profit with scant resources and a poor to non-existent IT strategy. To normalise these new models by trivialising differences between traditional services (as flawed, as they might be) would only serve to marginalise existing practices and it is the first step towards introducing scope-creep by politicians, who have an unhealthy obsession with statistics, quick fixes and making Faustian pacts with the private sector.

Babylon claims to go beyond any GP by being on par with human doctors and boasts of it's partnerships with Samsung and Tencent and counts DeepMind as one of it's investors. Just like any startup looking to disrupt, the platform is cloud-based and hosted on AWS[1]. It records every interaction, including video ─ which is retained for later review. It is growing at an exponential rate, despite a limited presence in London. The patient database reveals that it caters to a very specific demographic across varied and different parts of the city i.e. 83% of patients are aged between 20 to 39 years.

While it is still in it's infancy, it has already been involved in legal tussles and has been accused of dubious practices[2][3]. There is no visibility on algorithms, models and related datasets nor is there any indication of AI ethics being in place. There is also the issue of the CEO being linked to a white elephant project before his current fast-tracked foray into digital healthcare, which was probably rubber-stamped by officials in Whitehall. Although, it is undeniable that the NHS is overburdened and could do with some help to ease the pressure, but Babylon seems to be doing the exact opposite by applying the 'moving fast-breaking things' ethos inside an institution, which is already broken and moving slow.

I have already linked the Wired article, which discusses some of the topics above in-depth, other facts are supported by the FT article (paywall) and Forbes, which are reasonably reputable sources in my opinion.

https://www.ft.com/content/19dc6b7e-8529-11e8-96dd-fa565ec55...

https://www.forbes.com/sites/parmyolson/2018/12/17/this-heal...

[1] https://aws.amazon.com/blogs/startups/how-babylon-health-bui...

[2] https://www.digitalhealth.net/2017/12/babylon-healthcare-cqc...

[3] https://www.artificialintelligence-news.com/2019/04/12/babyl...

darkpuma• 7 years ago

The big question is how did 13% of the British public become so naive?

tomtompl• 7 years ago

I actually think 13% is ridiculously high number for this

fmajid• 7 years ago

13% of UK adults have reading comprehension problems.

FTFY.

blauditore• 7 years ago

This stance seems a bit silly to be honest. In my experience, smaller companies have much less structure in how they handle data access internally, as well as for security in general. Thus privacy seems actually better protected through control mechanisms there, perhaps a bit counter-intuitively though. Of course it depends a lot on the particular company.

ksaj• 7 years ago

A few years back I did a penetration test for a hospital, in which a mainframe was in scope (I have some mainframe training from Y2K / tech bubble era, so I almost know what I'm doing in that camp). Because medical students were also working on that mainframe, ample anonymized records were lying around for their studies.

All things said, in my final report were several examples of said anonymized records paired with the actual patient real-life info, obscured only enough that they could verify the result without my report contributing to the problem.

What stood out was how vocal and even cynical they were when I brought up what I had found initially. That is, until I finished the testing and report, complete with a batch script that would automate what I had done manually.

So, I commend these UK adults for recognizing the risks. Everything might be safe as described, but a policy of transparency might help alleviate the trust issue. Allow the public, or at least an expert not connected to the success of the system to know exactly what information is in the records being shared, because sometimes 2 or more disparate data sets can be combined to tell a much bigger story.

Only 13% of UK adults trust big tech firms with handling anonymized NHS data

Related Stories