Only way is to completly anonymize data, which is way harder than it sounds.
Only way is to completly anonymize data, which is way harder than it sounds.
What's complicated about it? So long as it's not attached to a name, social security number, or some other personally identifiable marker - how would anybody know it's you? You're just an anonymous collection of data points.
I understand whatever fingerprint they use for your data is almost definitely completely unique, but that doesn't mean it can be associated with the corresponding person unless you allow that to happen. I mean I get that it's obviously not trivial from a security perspective, but what's the main blockade here?
What's complicated is Google and others are extreme data hoarders. Google can get the anonymous health records and run a fuzzy match of model records against Home, URL and gmail records. Find high confidence correlations against multiple conditions across the years, where the search preceded new medical entries for those conditions within x time. Now they're in this data set for condition y and oh lookie, they searched condition y related topics multiple times last year. Anonymous record i1389541 is Alice Smith of Wimbledon, set her adwords flags to condition y snake oil, sell record to UK life insurance consortium. [repeat]. No personal data was released, but you're fully de-anonymised.
With enough data and history it becomes absurdly easy to decloak the majority with high or complete confidence.
Welcome to the future.
The alternative is find a way to prevent those uniquely identifying correlations at any point in the future, using techniques we haven't yet thought of. Which is probably impossible without diverging the anonymous medical record some considerable distance from reality. Faked enough to remain anonymous might not be helpful for research into a condition or its diagnosis...
That said, that's completely different from what I implied in my original comment, so point taken.
If I'm exaggerating it's from trying to make up a credible example off the cuff. When the Snowden revelations were coming thick and fast I remember several examples coming up around search stream and meta-data. Mostly terrifying as either could reveal in far more detail than actual content of messages what you appeared to be thinking in the moment. Tie that with medical and health data and any pretence of privacy falls.
The key insight[ß] was that privacy researchers are essentially rediscovering the information-theoretical deanonymisation attacks that have been known to advanced marketing departments for the past two decades.
0: Evgenios Kornaropoulos, UC Berkeley: "Attacks on Encrypted Databases Beyond the Uniform Query Distribution"
ß: anyone present at the last talk should recognise the term used.