10
$\begingroup$

Recently someone posted a few questions that contain an extract of what appears to health-related data: here, here and all their questions so far actually.

It's only 10 data points but it seems to come from a medical database/study and looks like "real data". It seems wrong to dump such sensitive personal information online, even it is just for a handful of people. And the questions could have been easily asked with simulated/fake data.

Should questions that seem to contain sensitive data be flagged? Should there be guidelines that say "Don't use sensitive data for your reproducible examples"?

If this is already part of the guidelines, it's not included in the How do I ask a good question? wiki.

$\endgroup$
3
  • 2
    $\begingroup$ It's certainly a concern if data-sets appear to include information that might identify patients (names, health systems IDs, post-codes, names of clinics, &c.). That's not the case here; & there are a lot of such anonymized (or faked) health data-sets published on the web, or in papers or textbooks. Still, adding something about it to the help pages is a good idea. $\endgroup$
    – Scortchi Mod
    Commented Mar 28, 2022 at 8:09
  • 2
    $\begingroup$ @Scortchi You are right! The dataset seems to be (a version of) this one: sahirbhatnagar.com/casebase/reference/support.html. Maybe then the OP should have referenced it in their questions. [The fact the questions weren't enhanced by including all this data remains.... but that's up to the OP.] $\endgroup$
    – dipetkov
    Commented Mar 28, 2022 at 8:18
  • 2
    $\begingroup$ I'd guess the OP is a student, & perhaps not even aware of the data's origin. The help pages do contain guidance on what to do if you've inadvertently included sensitive data in your post. I've thought better of my question; can I delete it?, & there is guidance on Meta on what to do if you spot it in someone else's: What should I do if a user posts sensitive information as part of a question or answer?. $\endgroup$
    – Scortchi Mod
    Commented Mar 28, 2022 at 8:59

2 Answers 2

Reset to default
3
$\begingroup$

We all have a duty to scan for questions displaying personal and identifying information and flag them for deletion. Even editing the question to remove data values leaves the edit history containing the data. I don't think the datasets in OP's question meet these criteria exactly, but I defer to others...

If we allow posters to violate likely compliance laws from their institution, then we denigrate the credibility of our site.

The two questions in OP's example have "reproducible datasets" that suspiciously contain "age" as a decimal. If one knows when the data snapshot was performed, one can backtransform "age" into a birthdate which is identifying. Age can also be identifying when it gets too old, say over 80 or 90, that when combined with another "innocuous" variable like sex and race, can also identify individuals in some cases. Different institutions have different requirements, no set of laws is complete nor completely required.

For reference, HIPAA has a defined list of variables that are considered personal and identifying: https://www.hipaajournal.com/what-is-considered-protected-health-information-under-hipaa/#:~:text=Under%20HIPAA%2C%20protected%20health%20information,provision%20of%20healthcare%2C%20payment%20for This is a partial list, I can identify someone for instance, with variables such as "OwnsASpaceFlightCompany" and "OwnsAnElectricCarEnterprise". In the words of Mad Eye Mooney, "Constant Vigilance!"

$\endgroup$
2
  • $\begingroup$ +1 To be clear, though, HIPPA does not apply to data sets containing those variables if they are not collected in a health care context. So I, epidemiologist and not clinician, can use, say, a spirometer to collect spirometric measurements giving indications for COPD in a research context, while a clinician can use the same instrument and protocol to collect the same data in a diagnostic and health care context: my data are covered by IRB and the Common Rule, but not by HIPPA, whereas the clinician's data are covered by HIPPA (and maybe IRB, depending). I am in the USA. $\endgroup$
    – Alexis
    Commented Apr 8, 2022 at 16:42
  • $\begingroup$ Also, for anyone interested, "anonymity" most often does not and cannot mean "impossible to identify" in an IRB context. Given that >90% of people in the USA can be uniquely ID'ed by birth date, zip code, and sex… before even getting into variables of substantive interest. See Ohm, P. (2009). Broken Promises of Privacy: Responding to the Surprising Failure of Anonymization (Legal Studies Research Paper No. 9; pp. 1–64). University of Colorado Law School. $\endgroup$
    – Alexis
    Commented Apr 8, 2022 at 16:46
6
$\begingroup$

I've generally assumed that all user-posted questions and answers (including example data) were submitted under the cc-by-sa license as indicated in the page's footer. If the data legally can't be posted under that license I think it should be removed.

$\endgroup$
2
  • 1
    $\begingroup$ There's a subtle difference between propriety and confidentiality. The former has legal protection, the latter ethical - of course, breaching confidentiality may lead to legal action, but a whistleblower reports data breaches to an ethics board. $\endgroup$
    – AdamO
    Commented Apr 6, 2022 at 16:53
  • $\begingroup$ I agree, there's a gray area between "legal" and "ethical" - I think "not legal but ethical" posts and data should be deleted because it creates risk to downstream users of stack overflow (eg potential fines for GDPR violations etc), and the "not ethical but legal" should at least be cause for discussion if not deletion as well. $\endgroup$
    – Neal Fultz
    Commented Apr 6, 2022 at 18:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .