Rand report signals threat to patient privacy

I’ll warn you in advance that this column contains a bit of speculative fiction. Nevertheless, today’s science fiction sometimes will become tomorrow’s fact. For example, in William Gibson’s classic 1984 novel "Neuromancer," he coined the term "cyberspace" and speculated about a world where people lived simultaneously in a virtual reality and a physical reality. With the invention of social media, real-time news, and Google databases, our cyberworlds and physical worlds have started to converge.

One way this has shown up is in the realm of targeted, predictive advertising. Last year, Target made news when it sent coupons and advertisements for baby diapers to a 16-year-old girl. Her father called the store to complain angrily about this, only to later discover that his daughter actually was pregnant. It turned out that Target had collected and analyzed extensive shopping data from its customers and was able to use this information to pick out which female shoppers were likely to be pregnant and even how close they were to delivery.

Unsurprisingly, the general public reacted strongly to this invasion of privacy and Target had to change advertising tactics. Instead of sending the targeted customer only maternity-related coupons, it buried the coupons among ads for other unrelated products to make the coupons appear random. This worked. The pseudo-coincidental coupons were used by targeted pregnant customers.

I had a flashback to this story recently when I came across a recently published 300-page document entitled "Using Behavioral Indicators to Help Detect Potential Violent Acts." It is an overview of existing research compiled by the national security research division of Rand, a federally funded agency that does research and planning for the U.S. Secretary of Defense, the U.S. military, and the intelligence community. The purpose of the report was to present a review of the currently available methods for using real-time or stored digital data to predict insurgent and terrorist activity by individuals.

The report talks about characteristics of individuals at risk and methods for gathering and analyzing data about those individuals. Data would be drawn from several sources. Smartphone data would provide travel patterns and physical movement, while existing commercial databases such as those available through Google or Amazon would contain information about purchases, opinions, interests, and political affiliations. Social-media accounts would enable examination and surveillance of an individual’s communications or planning activity with known foreign operatives.

All of this information would be considered "pattern of life" data that could be collected in real time and analyzed through a proposed "fusion center." The fusion center would do data analysis using machine algorithms or natural language processing and layer this data with information drawn from law enforcement or national intelligence sources. Some studies have already been done that have shown that smartphone data can be used to predict personality traits and travel patterns. Facial-recognition software can be applied to surveillance videos to interpret emotions such as anxiety or anger preceding an impending attack.

In theory, all of this information could be collated to generate a checklist security screen or risk score. Specifically, the report suggested building an individual profile drawn from "whole-life data (e.g., from school, criminal, civil, legal, interrogation, medical [emphasis mine], travel, financial, consumer, and social/public communication)."

The report goes on to discuss what would happen after the individual is identified:

"First, an indicator that would by no means justify an arrest or enforced medical treatment (emphasis mine) might, in connection with other information, have value at a checkpoint or an intelligence center pondering a tip about terrorist action. The result might be to increase caution, double check a discrepancy, look for more information, put the person in question under surveillance, or conduct an interrogation."

Of course, no one anticipates that this kind of activity might affect them, but consider what the report identifies as some of the psychological underpinnings of a terrorist: someone with a history of childhood trauma or cruelty to animals; someone with rapid shifts in mood; or someone showing evidence of stress, fear, or anger. In other words, characteristics sometimes associated with our patients.

For what it’s worth, the Rand report recognizes that individuals with mental illness are unlikely to become involved in organized terrorist activities. The report also acknowledges that there are likely to be a high number of false-positive identifications and that "such data could be [a] start down a very slippery slope" and would be "quite controversial, both scientifically and with respect to privacy and civil liberties."

Unfortunately, like Target, rather than cautioning against such activity, the report discussed ways to mitigate civilian concerns and potential damage.

To my knowledge, no medical information is being drawn from health information systems for this purpose yet. But given the recent concern about potentially dangerous patients during the debate about gun legislation, it’s not too much of a stretch to speculate that eventually some agency might wish to bypass the clinician entirely and draw certain risk-associated data directly from a health information system. The Rand report concluded that such information fusion is "likely essential for success" in the prevention of terrorism.

As hospitals, clinics, and the public mental health system move to integrate their information systems, privacy protections might need to include more than protection from unauthorized access by employees.

Dr. Hanson is a forensic psychiatrist and coauthor of "Shrink Rap: Three Psychiatrists Explain Their Work." The opinions expressed are those of the author only and do not represent those of any of Dr. Hanson’s employers or consultees, including the Maryland Department of Health and Mental Hygiene or the Maryland Division of Correction.

I’ll warn you in advance that this column contains a bit of speculative fiction. Nevertheless, today’s science fiction sometimes will become tomorrow’s fact. For example, in William Gibson’s classic 1984 novel "Neuromancer," he coined the term "cyberspace" and speculated about a world where people lived simultaneously in a virtual reality and a physical reality. With the invention of social media, real-time news, and Google databases, our cyberworlds and physical worlds have started to converge.

One way this has shown up is in the realm of targeted, predictive advertising. Last year, Target made news when it sent coupons and advertisements for baby diapers to a 16-year-old girl. Her father called the store to complain angrily about this, only to later discover that his daughter actually was pregnant. It turned out that Target had collected and analyzed extensive shopping data from its customers and was able to use this information to pick out which female shoppers were likely to be pregnant and even how close they were to delivery.

Unsurprisingly, the general public reacted strongly to this invasion of privacy and Target had to change advertising tactics. Instead of sending the targeted customer only maternity-related coupons, it buried the coupons among ads for other unrelated products to make the coupons appear random. This worked. The pseudo-coincidental coupons were used by targeted pregnant customers.

I had a flashback to this story recently when I came across a recently published 300-page document entitled "Using Behavioral Indicators to Help Detect Potential Violent Acts." It is an overview of existing research compiled by the national security research division of Rand, a federally funded agency that does research and planning for the U.S. Secretary of Defense, the U.S. military, and the intelligence community. The purpose of the report was to present a review of the currently available methods for using real-time or stored digital data to predict insurgent and terrorist activity by individuals.

The report talks about characteristics of individuals at risk and methods for gathering and analyzing data about those individuals. Data would be drawn from several sources. Smartphone data would provide travel patterns and physical movement, while existing commercial databases such as those available through Google or Amazon would contain information about purchases, opinions, interests, and political affiliations. Social-media accounts would enable examination and surveillance of an individual’s communications or planning activity with known foreign operatives.

All of this information would be considered "pattern of life" data that could be collected in real time and analyzed through a proposed "fusion center." The fusion center would do data analysis using machine algorithms or natural language processing and layer this data with information drawn from law enforcement or national intelligence sources. Some studies have already been done that have shown that smartphone data can be used to predict personality traits and travel patterns. Facial-recognition software can be applied to surveillance videos to interpret emotions such as anxiety or anger preceding an impending attack.

In theory, all of this information could be collated to generate a checklist security screen or risk score. Specifically, the report suggested building an individual profile drawn from "whole-life data (e.g., from school, criminal, civil, legal, interrogation, medical [emphasis mine], travel, financial, consumer, and social/public communication)."

The report goes on to discuss what would happen after the individual is identified:

"First, an indicator that would by no means justify an arrest or enforced medical treatment (emphasis mine) might, in connection with other information, have value at a checkpoint or an intelligence center pondering a tip about terrorist action. The result might be to increase caution, double check a discrepancy, look for more information, put the person in question under surveillance, or conduct an interrogation."

Of course, no one anticipates that this kind of activity might affect them, but consider what the report identifies as some of the psychological underpinnings of a terrorist: someone with a history of childhood trauma or cruelty to animals; someone with rapid shifts in mood; or someone showing evidence of stress, fear, or anger. In other words, characteristics sometimes associated with our patients.

For what it’s worth, the Rand report recognizes that individuals with mental illness are unlikely to become involved in organized terrorist activities. The report also acknowledges that there are likely to be a high number of false-positive identifications and that "such data could be [a] start down a very slippery slope" and would be "quite controversial, both scientifically and with respect to privacy and civil liberties."

Unfortunately, like Target, rather than cautioning against such activity, the report discussed ways to mitigate civilian concerns and potential damage.

To my knowledge, no medical information is being drawn from health information systems for this purpose yet. But given the recent concern about potentially dangerous patients during the debate about gun legislation, it’s not too much of a stretch to speculate that eventually some agency might wish to bypass the clinician entirely and draw certain risk-associated data directly from a health information system. The Rand report concluded that such information fusion is "likely essential for success" in the prevention of terrorism.

As hospitals, clinics, and the public mental health system move to integrate their information systems, privacy protections might need to include more than protection from unauthorized access by employees.

Dr. Hanson is a forensic psychiatrist and coauthor of "Shrink Rap: Three Psychiatrists Explain Their Work." The opinions expressed are those of the author only and do not represent those of any of Dr. Hanson’s employers or consultees, including the Maryland Department of Health and Mental Hygiene or the Maryland Division of Correction.

I’ll warn you in advance that this column contains a bit of speculative fiction. Nevertheless, today’s science fiction sometimes will become tomorrow’s fact. For example, in William Gibson’s classic 1984 novel "Neuromancer," he coined the term "cyberspace" and speculated about a world where people lived simultaneously in a virtual reality and a physical reality. With the invention of social media, real-time news, and Google databases, our cyberworlds and physical worlds have started to converge.

One way this has shown up is in the realm of targeted, predictive advertising. Last year, Target made news when it sent coupons and advertisements for baby diapers to a 16-year-old girl. Her father called the store to complain angrily about this, only to later discover that his daughter actually was pregnant. It turned out that Target had collected and analyzed extensive shopping data from its customers and was able to use this information to pick out which female shoppers were likely to be pregnant and even how close they were to delivery.

Unsurprisingly, the general public reacted strongly to this invasion of privacy and Target had to change advertising tactics. Instead of sending the targeted customer only maternity-related coupons, it buried the coupons among ads for other unrelated products to make the coupons appear random. This worked. The pseudo-coincidental coupons were used by targeted pregnant customers.

I had a flashback to this story recently when I came across a recently published 300-page document entitled "Using Behavioral Indicators to Help Detect Potential Violent Acts." It is an overview of existing research compiled by the national security research division of Rand, a federally funded agency that does research and planning for the U.S. Secretary of Defense, the U.S. military, and the intelligence community. The purpose of the report was to present a review of the currently available methods for using real-time or stored digital data to predict insurgent and terrorist activity by individuals.

The report talks about characteristics of individuals at risk and methods for gathering and analyzing data about those individuals. Data would be drawn from several sources. Smartphone data would provide travel patterns and physical movement, while existing commercial databases such as those available through Google or Amazon would contain information about purchases, opinions, interests, and political affiliations. Social-media accounts would enable examination and surveillance of an individual’s communications or planning activity with known foreign operatives.

All of this information would be considered "pattern of life" data that could be collected in real time and analyzed through a proposed "fusion center." The fusion center would do data analysis using machine algorithms or natural language processing and layer this data with information drawn from law enforcement or national intelligence sources. Some studies have already been done that have shown that smartphone data can be used to predict personality traits and travel patterns. Facial-recognition software can be applied to surveillance videos to interpret emotions such as anxiety or anger preceding an impending attack.

In theory, all of this information could be collated to generate a checklist security screen or risk score. Specifically, the report suggested building an individual profile drawn from "whole-life data (e.g., from school, criminal, civil, legal, interrogation, medical [emphasis mine], travel, financial, consumer, and social/public communication)."

The report goes on to discuss what would happen after the individual is identified:

"First, an indicator that would by no means justify an arrest or enforced medical treatment (emphasis mine) might, in connection with other information, have value at a checkpoint or an intelligence center pondering a tip about terrorist action. The result might be to increase caution, double check a discrepancy, look for more information, put the person in question under surveillance, or conduct an interrogation."

Of course, no one anticipates that this kind of activity might affect them, but consider what the report identifies as some of the psychological underpinnings of a terrorist: someone with a history of childhood trauma or cruelty to animals; someone with rapid shifts in mood; or someone showing evidence of stress, fear, or anger. In other words, characteristics sometimes associated with our patients.

For what it’s worth, the Rand report recognizes that individuals with mental illness are unlikely to become involved in organized terrorist activities. The report also acknowledges that there are likely to be a high number of false-positive identifications and that "such data could be [a] start down a very slippery slope" and would be "quite controversial, both scientifically and with respect to privacy and civil liberties."

Unfortunately, like Target, rather than cautioning against such activity, the report discussed ways to mitigate civilian concerns and potential damage.

To my knowledge, no medical information is being drawn from health information systems for this purpose yet. But given the recent concern about potentially dangerous patients during the debate about gun legislation, it’s not too much of a stretch to speculate that eventually some agency might wish to bypass the clinician entirely and draw certain risk-associated data directly from a health information system. The Rand report concluded that such information fusion is "likely essential for success" in the prevention of terrorism.

As hospitals, clinics, and the public mental health system move to integrate their information systems, privacy protections might need to include more than protection from unauthorized access by employees.

Dr. Hanson is a forensic psychiatrist and coauthor of "Shrink Rap: Three Psychiatrists Explain Their Work." The opinions expressed are those of the author only and do not represent those of any of Dr. Hanson’s employers or consultees, including the Maryland Department of Health and Mental Hygiene or the Maryland Division of Correction.