An evaluation of personal health information remnants in second-hand personal computer disk drives

Journal of Medical Internet Research

Volumn 9, Issue 3, 2007, Pages

  El Emam, Khaled ^a   Neri, Emilio ^b   Jonker, Elizabeth ^a  

^a CHILDREN S HOSPITAL OF EASTERN ONTARIO   (Canada)

^b TrialStat Corporation   (Canada)

Author keywords

Confidentiality; Data disclosure; Privacy; Security

Indexed keywords

ACCESS TO INFORMATION; ARTICLE; CANADA; COMPACT DISK; CONFIDENTIALITY; ELECTRONIC MEDICAL RECORD; HEALTH CARE FACILITY; HUMAN; MARKET; MEDICAL INFORMATION; MENTAL HEALTH; MICROCOMPUTER; COMMERCIAL PHENOMENA; INFORMATION RETRIEVAL;

COMMERCE; CONFIDENTIALITY; HUMANS; INFORMATION STORAGE AND RETRIEVAL; MICROCOMPUTERS;

EID: 36049041868     PISSN: None     EISSN: 14388871     Source Type: Journal    
DOI: 10.2196/jmir.9.3.e24     Document Type: Article

References (70)

1. Irving R. 2002 Report on Information Technology in Canadian Hospitals. Thornhill, ON: Canadian Healthcare Technology; 2003.
2. Healthcare Information and Management Systems Society (HIMSS). 15th Annual HIMSS Leadership Survey Sponsored by Superior Consultant Company. Healthcare CIO Results 2004.
3. Andrews JE, Pearce KA, Sydney C, Ireson C, Love M. Current state of information technology use in a US primary care practice-based research network. Inform Prim Care 2004;12(1):11-18.
4. Bower A. The Diffusion and Value of Healthcare Information Technology. Pittsburgh, PA: RAND Corporation; 2004.
5. Fonkych K, Taylor R. The State and Pattern of Health Information Technology Adoption. Pittsburgh, PA: RAND Corporation; 2005.
6. California HealthCare Foundation. Medical Privacy and Confidentiality Survey Summary and Overview. Oakland, CA: California HealthCare Foundation; 1999. URL: http://www.chcf.org/documents/ihealth/survey.pdf [accessed 2007 Sep 11]
7. Harris Interactive. Health information privacy (HIPAA) notices have improved public's confidence that their medical information is being handled properly. 2005. URL: http://www.harrisinteractive.com/news/allnewsbydate.asp? NewsID=894 [accessed 2007 Sep 11]
8. The Institute for the Future, Grimes-Gruczka T, Gratzer C. Ethics Survey of Consumer Attitudes about Health Web Sites. Oakland, CA: California HealthCare Foundation; 2000.
9. Computerization of Medical Practices for the Enhancement of Therapeutic Effectiveness investigators, Willison DJ, Keshavjee K, Nair K, Goldsmith C, Holbrook AM. Patients' consent preferences for research uses of information in electronic medical records: interview and survey data. BMJ 2003 Feb 15;326(7385):373
10. Mitchell E, Sullivan F. A descriptive feast but an evaluative famine: systematic review of published articles on primary care computing during 1980-97. BMJ 2001 Feb 3;322(7281):279-282
11. Cheng TL, Savageau JA, Sattler AL, Dewitt TG. Confidentiality in health care. A survey of knowledge, perceptions, and attitudes among high school students. JAMA 1993 Mar 17;269(11):1404-1407.
12. Association of American Physicians and Surgeons. New poll: doctors lie to protect patient privacy. 2001 Jul 31. AAPS Online. URL: http://www.aapsonline. org/press/nrnewpoll.htm [accessed 2007 Sep 11]
13. EKOS Research Associates. Rethinking the Information Highway. . 2003.
14. Saravamuttoo M. Privacy: changing attitudes in a tumultuous time. Sixth Annual Privacy and Security Workshop; November 3-4, 2005; Toronto, ON. .
15. Gostin LO, Turek-Brezina J, Powers M, Kozloff R. Privacy and security of health information in the emerging health care system. Health Matrix Clevel 1995;5(1):1-36.
16. Hodge JG, Gostin LO, Jacobson PD. Legal issues concerning electronic health information: privacy, quality, and liability. JAMA 1999 Oct 20;282 (15):1466-1471.
17. Woodward B. The computer-based patient record and confidentiality. N Engl J Med 1995 Nov 23;333 (21):1419-1422.
18. Goldman J. Testimony before the subcommittee on health of the committee on ways and means on "Patient Confidentiality." 1998 Mar 24. .
19. Leape LL, Bates DW, Cullen DJ, Cooper J, Demonaco HJ, Gallivan T, et al. Systems analysis of adverse drug events. ADE Prevention Study Group. JAMA 1995 Jul 5;274(1):35-43.
20. Ash JS, Berg M, Coiera E. Some unintended consequences of information technology in health care: the nature of patient care information system-related errors. J Am Med Inform Assoc 2004;11 (2):104-112
21. Johnson N, Mant D, Jones L, Randall T. Use of computerised general practice data for population surveillance: comparative study of influenza data. BMJ 1991 Mar 30;302(6779):763-765
22. Wilton R, Pennisi AJ. Evaluating the accuracy of transcribed computer-stored immunization data. Pediatrics 1994 Dec;94(6 Pt 1):902-906.
23. Davidson B, Lee Y, Wang R. Developing data production maps: meeting patient discharge data submission requirements. Int J Healthcare Technol Manage 2004;6(2):223-240.
24. Garfinkel S, Shilat A. Remembrance of data passed: a study of disk sanitization practices. IEEE Secur Priv 2003:17-27.
25. Jones A, Mee V, Meyler C, Gooch J. Analysis of data recovered from computer disks released for resale by organizations. J Inform Warfare 2005;4(2):45-53.
26. Jones A, Valli C, Sutherland I, Thomas P. The 2006 analysis of information remaining on disks offered for sale on the second hand market. J Digit Forensics Secur Law 2006;1(3):23-36.
27. Canadian Internet Policy and Public Interest Clinic. Approaches to Security Breach Notification: A White Paper. Ottawa, ON: Canadian Internet Policy and Public Interest Clinic; 2007. URL: http://www.cippic.ca/documents/ bulletins/BreachNotification_9jan07-print.pdf [accessed 2007 Sep 11]
28. GetData. Recover My Files. URL: http://www.recovermyfiles.com/ [accessed 2007 Sep 11]
29. Department of Defense - Department of Energy - Nuclear Regulatory Commission - Central Intelligence Agency. DoD 5220.22-M National Industrial Security Program Operating Manual (NISPOM). Washington, DC: US Government Printing Office; 1995. URL: URL: http://download.ehealthinformation.ca/cite/ nispo-522022m-1995.pdf [accessed 2007 Sep 11]
30. Department of Defense. DoD 5220.22-M: National Industrial Security Program Operating Manual (NISPOM). Washington, DC: Department of Defense; 2006. URL: URL: http://www.dss.mil/isp/odaa/documents/nispom2006-5220.pdf [accessed 2007 Sep 11]
31. Updated DSS Clearing and Sanitization Matrix. 2007. DSS. URL: http://www.dss.mil/isp/odaa/documents/clearing_and_sanitization_matrix.pdf
32. Russinovich M. SDelete v.1.51. 2006 Nov 1. Microsoft Technet. URL: http://www.microsoft.com/technet/sysinternals/Security/SDelete.mspx [accessed 2007 Sep 11]
33. Radwanski G. PIPED Act Case Summary #15. 2001 Oct 2. Office of the Privacy Commissioner of Canada. URL: http://www.privcom.gc.ca/media/an/ wn_011002_e.asp [accessed 2007 Sep 11]
34. The Working Party on the Protection of Individuals With Regard to the Processing of Personal Data. Article 29 Data Protection Working Party. Opinion 4/2007 on the concept of personal data. Adopted on 20th June. 2007. European Commission. URL: http://ec.europa.eu/justice_home/fsj/privacy/docs/wpdocs/2007/ wp136_en.pdf [accessed 2007 Sep 11]
35. Cohen J. A coefficient of agreement for nominal scales. Educ Psychol Meas 1960;XX(1):37-46.
36. Hartmann DP. Considerations in the choice of interobserver reliability estimates. J Appl Behav Anal 1977;10(1):103-116
37. Landis JR, Koch GG. The measurement of observer agreement for categorical data. Biometrics 1977 Mar;33(1):159-174.
38. Altman D. Practical Statistics for Medical Research. London, UK: Chapman and Hall; 1991.
39. Fleiss J. Statistical Methods for Rates and Proportions. Hoboken, NJ: Wiley; 1981.
40. Sim J, Wright CC. The kappa statistic in reliability studies: use, interpretation, and sample size requirements. Phys Ther 2005 Mar;85(3):257-268.
41. Flack V, Afifi A, Lachenbruch P. Sample size determinations for the two rater kappa statistic. Psychometrika 1988;53(3):321-325.
42. Agresti A, Coull B. Approximate is better than "exact" for interval estimation of binomial proportions. Am Stat 1998;52(2):119-126.
43. Pong R, Pitblado J. Don't take geography for granted! Some methodological issues in measuring geographic distribution of physicians. Can J Rural Med 2001;6 (2):103-112.
44. Escherich M. Thriving secondary PC market puts old PCs to good use. Gartner Inc. 2005.
45. Shiffler GI. Forecast: PC installed base worldwide, 2003-2011. Gartner Inc. 2007.
46. Escherich M, Shao J, Maita K. Mature regions fuel supply of used PCs.. Gartner Inc - Dataquest. 2005.
47. Escherich M, Teng A. Thirst for technology drives used PC demand in emerging markets.. Gartner Inc. 2005.
48. Organization for Economic Development and Cooperation. OECD Key ICT indicators: households with access to a home computer. 2006. OECD. URL: http://www.oecd.org/dataoecd/19/46/34083096.xls [accessed 2007 Sep 11]
49. Organization for Economic Development and Cooperation. OECD Key ICT indicators: households with access to the Internet in selected OECD countries. 2006. OECD. URL: http://www.oecd.org/dataoecd/19/45/34083073.xls [accessed 2007 Sep 11]
50. Fox S, Fallows D. Internet health resources: health searches and email have become more commonplace, but there is room for improvement in searches and overall Internet access. Washington, DC: Pew Internet & American Life Project; 2003. URL: http://www.pewinternet.org/pdfs/PIP_Health_Report_July_2003. pdf
51. Fioriglio G, Szolovits P. Copy fees and patients' rights to obtain a copy of their medical records: from law to reality. AMIA Annu Symp Proc 2005:251-255
52. Hsu J, Huang J, Kinsman J, Fireman B, Miller R, Selby J, et al. Use of e-Health services between 1999 and 2002: a growing digital divide. J Am Med Inform Assoc 2005;12(2):164-171
53. Beckjord EB, Finney Rutten LJ, Squiers L, Arora NK, Volckmann L, Moser RP, et al. Use of the internet to communicate with health care providers in the United States: estimates from the 2003 and 2005 Health Information National Trends Surveys (HINTS). J Med Internet Res 2007;9(3):e20
54. Andreassen HK, Bujnowska-Fedak MM, Chronaki CE, Dumitru RC, Pudule I, Santana S, et al. European citizens' use of E-health services: a study of seven countries. BMC Public Health 2007;7(1):53
55. Liebhaber AB, Grossman JM. Physicians slow to adopt patient e-mail. Data Bull (Cent Stud Health Syst Change) 2006 Sep(32):1-2.
56. Grant RW, Campbell EG, Gruen RL, Ferris TG, Blumenthal D. Prevalence of basic information technology use by U.S. physicians. J Gen Intern Med 2006 Nov;21(11):1150-1155.
57. Brooks RG, Menachemi N. Physicians' use of email with patients: factors influencing electronic communication and adherence to best practices. J Med Internet Res 2006;8(1):e2
58. Eysenbach G, Powell J, Englesakis M, Rizo C, Stern A. Health related virtual communities and electronic support groups: systematic review of the effects of online peer to peer interactions. BMJ 2004 May 15;328(7449):1166
59. Escherich M, Smulders C. Market focus: worldwide secondary PC market sizing methodology. Gartner Inc. 2005.
60. Communications Security Establishment. Clearing and Declassifying Electronic Data Storage Devices. Ottawa, ON: Government of Canada; 2006. URL: http://www.cse-cst.gc.ca/documents/publications/gov-pubs/itsg/itsg06.pdf [accessed 2007 Sep 11]
61. UK bank details sold in Nigeria. BBC News. 2006. URL: http://news.bbc.co.uk/2/hi/business/4790293.stm [accessed 2007 Sep 11]
62. Sullivan B. I just bought your hard drive. MSNBC News. 2006. URL: http://redtape.msnbc.com/2006/06/one_year_ago_ha.html [accessed 2007 Sep 11]
63. El Emam K, Jabbouri S, Sams S, Drouet Y, Power M. Evaluating common de-identification heuristics for personal health information. J Med Internet Res 2006;8(4):e28
64. El Emam K, Jonker E, Sams S, Neri E, Neisa A, Gao T, et al. Pan-Canadian De-Identification Guidelines for Personal Health Information. Report Prepared for the Office of the Privacy Commissioner of Canada. 2007. URL: http://www.ehealthinformation.ca/documents/OPCReportv11.pdf [accessed 2007 Sep 11]
65. Cavoukian A. Office of the Privacy Commissioner of Ontario. Encrypting Personal Health Information on Mobile Devices. Fact Sheet. 2007 May. URL: http://www.ipc.on.ca/images/Resources/up-fact_12e.pdf [accessed 2007 Sep 11]
66. Geiger M, Cranor L. Scrubbing stubborn data: an evaluation of counter-forensic privacy tools. IEEE Secur Priv 2006;4(5):16-25.
67. Gordon LA, Loeb MP, Lucyshyn W, Richardson R. Eleventh Annual CSI/FBI Computer Crime and Security Survey. Computer Security Institute. 2006.
68. Personal Health Information Protection Act Report HI-050047-1: A Physiotherapy and Rehabilitation Centre. Toronto, ON: Office of the Privacy Commissioner of Ontario. 2006. URL: http:// www.ipc.on.ca/images/Findings/up- I_050047_1.pdf [accessed 2007 Sep 11]
69. Personal Health Information Protection Act Report HI 050044-1: A Psychologist Working for a School Board. Toronto, ON: Office of the Privacy Commissioner of Ontario. 2006. URL: http://www.ipc.on.ca/images/Findings/up- HI_050044_1_Report.pdf [accessed 2007 Sep 11]
70. Order HO-004. Toronto, ON: Office of the Privacy Commissioner of Ontario. 2007. URL: http://www.ipc.on.ca/images/Findings/up-3ho_004.pdf [accessed 2007 Sep 11]