Privacy Matters | Several states introduce new privacy bills, Ofer Mendelevitch reflects on synthetic data's privacy capabilities, & more

Experts Expound
 

This edition’s guest comment comes from Ofer Mendelevitch, Co-Founder & Chief Technology Officer of Syntegra and specialist in creating high-fidelity, high-privacy synthetic healthcare data. Ofer reflects on the privacy implications of synthetic data and how generative AI is applied to achieve these improvements in privacy. Datavant recently announced a partnership with Syntegra.

Privacy protection technology has historically focused on methods to redact or transform real data in order to mitigate privacy risks. Synthetic data offers a new approach: use generative AI to create artificial data that closely resembles a real dataset in both format and statistical properties, creating a dataset that provides the same information with orders of magnitude lower disclosure risk than typical de-identification. This novel use of generative AI can break the traditional tradeoff between data utility and privacy, enabling broader data use, reduced friction / governance, and even access to new datasets.

De-identified datasets have a one-to-one relationship between records in the dataset and real people, resulting in some residual risk of triangulation and other inference attacks that may compromise patient privacy. Synthetic healthcare data breaks this relationship by learning the clinical patterns from the entire real dataset, and then using those learned relationships to generate any number of synthetic patient records that maintain the statistical patterns in the real data, yet cannot be mapped to real individuals, resulting in powerful privacy protection. This leads to strikingly low disclosure risks for advanced synthetic data generation models, which can be verified by privacy experts.

Healthcare leaders and innovators have long recognized the need for a strong foundation in data, as well as the high friction in current approaches to accessing and sharing such data, making it expensive, slow and with residual risks. Synthetic data offers a new path forward – one with better privacy and easier access. 

Government Watcher

The following are a select few of the various state privacy bills recently introduced.

Indiana State's Senate Bill 5

• Background: This Indiana State consumer data protection bill, which would allow [Indiana consumers] to find out what data companies are keeping and ask said companies to delete their data or not use it for purposes like targeted advertising, passed unanimously in the Senate in February 2022. However, it failed to pass the House of Representatives a month later. 
• Latest Developments:
  Indiana state senators make data privacy bill a top priority
  CBS4 (January 20, 2023)
  "State Sen. Liz Brown (R-Fort Wayne) has reintroduced a bill that would allow [Indiana consumers] to find out from companies what data they’re collecting and how it’s being used. [They] would also have the right to ask companies to delete their information or not use it for certain purposes." Keep reading
  
  

Biometric Data Privacy Laws:
Maryland's HB 33: Commercial Law – Consumer Protection – Biometric Data Privacy, Mississippi's HB 467: Biometric Identifiers Privacy Act, and New York Assembly Bill 1362: the Biometric Privacy Act

• Background:
  • Maryland's HB 33 would require private entities that hold biometric data to develop and publish policies, establish a retention schedule and data destruction guidelines within certain timeframes. There are exceptions to the policy requirements for businesses only using biometrics from employees or for internal operations.
  • Mississippi's HB 467 would require private organizations to develop and publish policies for the biometric data they hold, including a retention schedule and data destruction policy. It would also require written consent from biometric data subjects. Employee biometrics can be collected, but with restrictions, such as on the retention of data that could be used to track them.
  • New York's AB 1362 establishes the biometric privacy act; requires private entities in possession of biometric identifiers or biometric information to develop a written policy establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information when the initial purpose for collecting or obtaining such identifiers or information has been satisfied or within three years of the individual's last interaction with the private entity, whichever occurs first.
• Latest Developments: 
  • Maryland and Mississippi lawmakers consider biometric data protection bills
    Biometric Update (January 16, 2023)
    "Maryland’s state legislature has introduced a biometric data privacy act, in one of several moves at the state level towards increasing data privacy regulation. . . [while] Mississippi State Legislature has introduced the Biometric Identifiers Privacy Act to regulate the collection and use of biometrics by private sector entities." Keep reading
  • US state privacy developments: Connecticut, Mississippi, New York and more
    IAPP (January 20, 2022)
    "New York Assembly Bill 1362, the Biometric Privacy Act, was introduced and referred to the Committee on Consumer Affairs and Protection." Keep reading
    
    

California's Assembly Bill 223: Transgender Youth Privacy Act

• Background: This bill aims to protect the privacy of transgender youth in California by requiring the courts to seal any petition for a change of gender or sex identifier filed by a minor.
• Latest Developments:
  CA bill aims to protect transgender youths' privacy
  The Bay Area Reporter (January 11, 2023)
  "Legislation [was] introduced this week by gay Assemblymember Chris Ward (D-San Diego). . . Ward announced January 10 that he had filed Assembly Bill 223, which has been titled the Transgender Youth Privacy Act." Keep reading

Food for Thought

The Value of Synthetic Data in Healthcare
Datavant (January 18, 2023)
Article by Jonah Leshin and Quinn Johns
"Over the past several years, advances in machine learning have given rise to new privacy-enhancing technologies for healthcare that have the capacity to. . . [enable] increased data utility without compromising privacy. Synthetic data has the potential to be a critical technology in this space, as it enables representative patient data with inherent privacy protection. Moreover, best practice synthetic data generation processes provide the user with privacy controls that are configurable and quantifiable. Core, decades-old risk assessment principles provide necessary context for evaluating synthetic data. The application of these principles to synthetic data form a privacy framework that makes possible a range of previously unattainable use cases." Keep reading

• Jonah Leshin, Ph.D., is the Head of Privacy Research at Privacy Hub by Datavant.
• Quinn Johns leads Emerging Privacy Solutions at Datavant.

• Stephen Murphy is a Senior Attorney at Network for Public Health Law.
• Daniel Barth-Jones, M.P.H., Ph.D., who contributed his expertise to this article, is a Principal Privacy Expert at Privacy Hub by Datavant.

Benefits of HIPAA for Healthcare Organizations
HIPAA Journal (January 12, 2023)
Editorial by Steve Alder
"HIPAA has been criticized for having too many requirements and also not enough in certain areas, and for being too inflexible and difficult to interpret, and challenging to comply with. Despite the challenges of compliance and the gaps in HIPAA, the legislation has provided many benefits for healthcare organizations, healthcare professionals, patients, and health plan members. The legislation is far from perfect and HIPAA is in desperate need of updating – new HIPAA regulations will soon be introduced – but in its current form, the benefits of this important legislative act far outweigh any disadvantages." Keep reading