Latest / The FIT4Privacy Podcast | Exploring ISO Standards AI Privacy | Grow Skills Store / Medical Identity Theft

Transcript

Medical Identity Theft · The FIT4Privacy Podcast | Exploring ISO Standards AI Privacy | Grow Skills Store

• 0:00
  So medical identity theft is something I discovered
• 0:02
  accidentally. I had been asked by a
• 0:05
  congressional, AUS congressional subcommittee, the National
• 0:09
  Committee on Vital and Health Statistics, to come testify
• 0:12
  before them. This would have been in 2000.
• 0:15
  And I think four or five right in there.
• 0:20
  Sorry, it was a long time ago and I was sitting there thinking
• 0:25
  and the the my topic was the NHIN, the National Proposed
• 0:30
  National Health Information Network.
• 0:32
  And I thought, what are the risks, the digital risks in such
• 0:35
  a network? And I was thinking and thinking,
• 0:38
  and I had time to prepare for this testimony.
• 0:40
  I had about 3 weeks, which is always dangerous, which means
• 0:42
  you, you, you have too much time to prepare and think, right?
• 0:46
  So I'm sitting there for days thinking, OK, what are the
• 0:48
  risks? And I outlined all the risks,
• 0:49
  but I kept coming back to identity risks because identity
• 0:53
  risks really show up very strong, in very strong ways in
• 0:58
  digital ecosystems. And they're very complex and
• 1:02
  they're, they're quite profound in, in the harms that they can
• 1:06
  cause. It's a really foundational harms
• 1:10
  that identity harms can cause. So I thought I wonder if medical
• 1:13
  identity theft exists because we know identity theft at that time
• 1:17
  was a huge problem in the US, credit card fraud what not.
• 1:21
  So I did a keyword search on all the various search engines for
• 1:25
  medical identity theft and nothing came up.
• 1:27
  It was not the term and I thought OK so I bet this exists
• 1:31
  under different names. So I checked the legal research
• 1:36
  databases such as PACER, the court systems, and I looked for
• 1:41
  a combination of medical data and fraud and identity.
• 1:48
  And I found four cases right away.
• 1:50
  And I, I dug into those cases. I interviewed people, I
• 1:54
  interviewed the insurance companies, the providers.
• 1:58
  I interviewed a lot of people before this testimony happened.
• 2:01
  And I wrote, I think it was 20 or 22 pages of testimony.
• 2:04
  And I included this topic in it. And I said, hey, there's
• 2:09
  something called medical identity theft that's running
• 2:11
  through this ecosystem already. You already have people posing,
• 2:17
  taking the health records of people, altering them and
• 2:21
  pretending to be those people and billing in their names in
• 2:24
  order to make money. It's a sub form of healthcare
• 2:28
  fraud and it's very dangerous. People have been misdiagnosed,
• 2:33
  people have been laying on surgical tables and people have
• 2:37
  almost operated on the wrong organ because their health
• 2:40
  record had been altered. And I said this is going to be a
• 2:43
  serious problem and no one had ever even had this research in
• 2:48
  their hands before. The providers hadn't been
• 2:51
  discussing it. No one had really been
• 2:53
  discussing it because it just wasn't a public issue at that
• 2:55
  time. So the chairman of the committee
• 2:59
  came up to me immediately after the testimony, and he said, you
• 3:05
  need to write about this. No one's heard of this, and it's
• 3:07
  very important and people can die from this.
• 3:11
  And I said, yeah, I think so. And he said, I hope you can go
• 3:15
  do it. So without any funding at all to
• 3:18
  do this work and no backers at all to do this work, I went
• 3:21
  ahead and researched. It took about half a year.
• 3:24
  I worked as fast and as hard as I could.
• 3:27
  And the following year in 20, I think it was 2005 or 2006 in the
• 3:33
  spring, we came out with a report.
• 3:36
  I worked on the report with Robert Gellman, who's one of the
• 3:39
  leading health experts in the entire world and has been for
• 3:42
  many, many decades. He's an incredible legal mind.
• 3:46
  So we looked at, you know, what are the problems here?
• 3:50
  How deep is it? How big are the problems?
• 3:53
  And it was very, very substantive.
• 3:56
  We were able to get the numbers and quantify all of this for the
• 3:59
  first time and then talk about the solutions.
• 4:03
  And the report made a massive splash when it was published.
• 4:06
  And what ended up happening is I was invited to speak to hymns,
• 4:12
  which is the entire nation in the US of the health information
• 4:16
  management system at the, which at the time was different.
• 4:19
  There were thousands of people in the audience, and they
• 4:21
  allowed me to talk about solutions for medical identity
• 4:24
  theft. And this was a real turning
• 4:26
  point because, you know, it's one thing to do the research and
• 4:29
  to write a report and point out what's wrong, but then you need
• 4:33
  to take the next step and work toward a solution.
• 4:36
  So I'm very proud that I worked with all of these folks to come
• 4:40
  to a solution and what would work.
• 4:42
  So we came to a variety of really effective solutions for
• 4:46
  medical identity theft. One is called a Jane and John
• 4:49
  Doe file extraction, which means that you remove the fictitious
• 4:53
  information from the file while retaining the legal integrity of
• 4:57
  the file. Because it's actually in HIPAA,
• 4:59
  you don't have the right to delete data.
• 5:02
  So even if it's fictitious data and could kill you, you can't
• 5:06
  delete it. So there's now a method that you
• 5:08
  can do that. And there's red flags, there's
• 5:11
  all sorts of name warnings. There's, there's, there's huge
• 5:15
  advancement. So medical identity theft is
• 5:17
  becoming much less prevalent. People know about it.
• 5:21
  It's well known. And I, I, the problem is greatly
• 5:25
  improved from where it was. So that's that work.
• 5:29
  No, that's indeed an area and you have done a huge
• 5:33
  contribution through World Privacy Forum and your research
• 5:36
  in that space. And you, another area that comes
• 5:40
  to my mind in which you have contributed immensely is the AI
• 5:44
  Principles, especially at the OECD level.
• 5:47
  Because a few years back, if I recall well and recall our
• 5:51
  conversation, there was nothing and you were part of the group
• 5:54
  that created the AI principles. Tell us something about that as
• 5:57
  well. Yeah.
• 5:59
  So I've actually worked with OECD for about 20 years, but I
• 6:03
  was mainly working in health privacy.
• 6:05
  I was part of their Health Data uses working group many, many
• 6:08
  years ago in the Super early 2000s.
• 6:12
  But what happened is that I had been invited to a group in
• 6:17
  Switzerland to make a a very technical AI presentation on
• 6:22
  basically how AI ecosystems operated and how the data flows,
• 6:27
  and then where trustworthy AI could be articulated within that
• 6:31
  and where it couldn't be. So I gave this extremely
• 6:35
  technical presentation and it just so happened that two people
• 6:38
  from OECD were there and the audience, and it just so
• 6:42
  happened that they were scouting for people who knew, who
• 6:46
  understood the tech technology of AI, but who also understood
• 6:51
  the trustworthy aspects. And I had the privacy piece in a
• 6:55
  way that most people who are in AI don't have, in that I have,
• 7:00
  you know, the kind of the legal privacy and then the technical
• 7:03
  privacy that's, that's fairly rare even today.
• 7:06
  So they approached me and they asked me if I might want to join
• 7:11
  a new effort that the OCD had going to develop multilateral
• 7:16
  principles on trustworthy AI. And I'm like, oh, are you
• 7:19
  kidding? You can't hold me back.
• 7:22
  So I started with that immediately there was a core of
• 7:25
  us. It was called I go the AI
• 7:28
  Network of experts. And I think I mean, it was a
• 7:32
  very small group to begin with and it was a really incredible
• 7:37
  conversation. I'm still in touch with most of
• 7:39
  the people who are in that group.
• 7:40
  Marco Groeberlingkit from Slovenia, just really, really
• 7:46
  amazing researchers and and thinkers and people.
• 7:49
  So I did that until 2019 while still doing work at full time at
• 7:56
  World Privacy Forum. It was a very busy time, but
• 8:00
  that work was extraordinary. It was really foundational in
• 8:03
  really talking to all of the stakeholders because it was a
• 8:07
  very broad effort. By the end, I think they were
• 8:09
  about, I think the group expended to about 54 experts
• 8:13
  plus all the governments. And it was, it was a very
• 8:17
  robust, very, very incredible conversation.
• 8:20
  Very rich, important time of transition.