William Sage, vice provost for health affairs at the University of Texas School of Law and moderator of the panel, said he expects the high court to render a decision in two weeks.
Also on the panel was computer scientist and privacy guru Latanya Sweeney, who spoke via the Internet. Sweeney and other speakers questioned the efficacy of the Health Insurance Portability and Accountability Act of 1996's privacy provisions. Sweeney expressed her doubts about the regulations as they apply to prescription-drug data buyers and sellers such as the analytics company IMS Health.
According to Sweeney, HIPAA allows under two circumstances data sharing for uses other than for specifically exempted areas, such as treatment, payment or healthcare operations. One is when more than a dozen key identifiers are stripped away, creating a "safe harbor."
The other is the HIPAA "statistician provision"—a sketchy safeguard at best, as Sweeney noted.
"The HIPAA statistician provision is so broad that it simultaneously supports good and bad practices indistinguishably, allowing data that can be trivially re-identified to enjoy the same wide distribution, free of HIPAA privacy protection, as data that has provable guarantees on anonymity," Sweeney said. "IMS Health, like many other entities, receives patient data under the HIPAA statistician provision, and the question is, is the data they receive sufficiently de-identified? Can patients be re-identified?"
Sweeney, who directs the Data Privacy Lab at Carnegie Mellon University, didn't answer her own question but said she has two experiments planned and called on IMS Health to join a third to find an answer.
Kimberly Gray, IMS Health's chief privacy officer, served on the same panel. Gray said IMS uses an outside contractor to render anonymous the prescription records it receives.
"The data is de-identified before it hits our doors," Gray said. "We're trying to ensure that the data is not re-identified. Where we've fallen short, perhaps, is in being a little less transparent about our practices. Most corporations do not want to be on the wrong side of pubic opinion. Nobody wants to be a case study for re-identification. IMS Health is much more aligned with this group than many people may think."
Follow Joseph Conn on Twitter: @MHJConn.