normal sensitive health data

[JohnMoehrke]

We might want to discuss the sensitivity scale that is ConfidentialityCode. This sets up 6 levels of non-overlapping risk classification for health data. - https://terminology.hl7.org/ValueSet-v3-Confidentiality.html

The most common would be "Normal Health Data", hence mathematical "normal" distribution. The Normal data is very useful for treatment purposes, but does not include any sensitive classes of data that are stigmatizing.

Data that is related to a stigmatizing health topic are classified Restricted. The definition of stigmatizing is fuzzy, although we are trying to make it more clear all the time. One regions stigmatizing topic may not be a protected topic in another region, which makes this very hard to define. Ultimately the Patient should decide about themselves. Restricted data tends to be protected legally more specifically too. Typical: Sexual Health, Drug Abuse, and Mental Health.

There is a more restrictive. - Very Restricted

MY POINT HERE

is that there are less restrictive class too.

There is a completely unrestricted (from a privacy perspective) - Unrestricted. This is completely not specific to a patient. So this is not useful to us.

There is a Low, but I don't think anything useful falls here. This tends to be used for De-Identified datasets.

There is a "Moderate" class that is higher than Low but lower than Normal. This class is often referred to as "The Emergency Dataset". That data that you would be willing to place in a unrestricted place, and for which there is just the minimal information that Emergency Services need. Would also tend to be useful for health oversight, life insurance, etc. Typically: Allergies, Medications, Immunizations, and Problems. But not those that are stigmatizing (dangerous situation, so might be that if you have stigmatizing conditions you can't use this method at all) -- Note that the Shared Immunization solutions have relied on this Moderate class.

With Moderate class of data we might be able to define the VHL more realistically. Delaying defining it for Normal or higher until we can show Moderate class works.

overall the codes are low to high risk:
U -> L -> M -> N -> R -> V

[litlfred]

What would you classify the IPS as? It sounds like it might be normal not moderate. IPS is definitely a target of the VHL. Cheers, -carl

…

On Tue, Dec 17, 2024, 08:17 John Moehrke ***@***.***> wrote: We might want to discuss the sensitivity scale that is ConfidentialityCode. This sets up 6 levels of non-overlapping risk classification for health data. - https://terminology.hl7.org/ValueSet-v3-Confidentiality.html The most common would be "Normal Health Data", hence mathematical "normal" distribution. The Normal data is very useful for treatment purposes, but does not include any sensitive classes of data that are stigmatizing. Data that is related to a stigmatizing health topic are classified Restricted. The definition of stigmatizing is fuzzy, although we are trying to make it more clear all the time. One regions stigmatizing topic may not be a protected topic in another region, which makes this very hard to define. Ultimately the Patient should decide about themselves. Restricted data tends to be protected legally more specifically too. Typical: Sexual Health, Drug Abuse, and Mental Health. There is a more restrictive. - Very Restricted *MY POINT HERE* is that there are less restrictive class too. There is a completely unrestricted (from a privacy perspective) - Unrestricted. This is completely not specific to a patient. So this is not useful to us. There is a Low, but I don't think anything useful falls here. This tends to be used for De-Identified datasets. *There is a "Moderate" class* that is higher than Low but lower than Normal. This class is often referred to as "The Emergency Dataset". That data that you would be willing to place in a unrestricted place, and for which there is just the minimal information that Emergency Services need. Would also tend to be useful for health oversight, life insurance, etc. Typically: Allergies, Medications, Immunizations, and Problems. But not those that are stigmatizing (dangerous situation, so might be that if you have stigmatizing conditions you can't use this method at all) -- Note that the Shared Immunization solutions have relied on this Moderate class. With Moderate class of data we might be able to define the VHL more realistically. Delaying defining it for Normal or higher until we can show Moderate class works. overall the codes are low to high risk: U -> L -> M -> N -> R -> V — Reply to this email directly, view it on GitHub <#7>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAFBVYXOEXKLPIYKZKWQOT32GAP67AVCNFSM6AAAAABTYM7JLGVHI2DSMVQWIX3LMV43ASLTON2WKOZSG42DIOJSGIYDENI> . You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>

[JohnMoehrke]

What would you classify the IPS as? It sounds like it might be normal not moderate. IPS is definitely a target of the VHL. Cheers, -carl

That is not clear from the IPS specification itself. There would need to be further profiling of the IPS "summarization" algorithm to be deterministic. Meaning that without specificity one must look at the output of an IPS summary operation to determine if that instance was Normal or other. Might be a useful further refinement of IPS to define that the output must meet X confidentialityCode.