Analysis Report Four - Health Privacy and Data Profiling

Executive Summary

This report examines the relationship between electronic health records, patient privacy, and healthcare cybersecurity by combining current research with an analysis of the MIMIC-III database. The literature demonstrates that the HITECH Act significantly accelerated electronic health record adoption, creating new opportunities to improve patient care while increasing the responsibility of healthcare organizations to protect sensitive health information. Recent events, including the BetterHelp privacy case and the continued rise in ransomware attacks targeting healthcare organizations, highlight the growing importance of strong privacy policies and cybersecurity practices.

To demonstrate the amount of information contained within electronic health records, this report profiled the final hospitalization of a patient diagnosed with liver failure using the MIMIC-III database. The analysis reconstructed the patient’s clinical timeline from emergency admission through a prolonged stay in the Surgical Intensive Care Unit until death. Laboratory trends further illustrated the progression of the patient’s condition while demonstrating how detailed electronic health records can become over the course of a hospitalization.

Based on these findings, healthcare organizations should continue strengthening privacy protections, cybersecurity programs, employee training, and responsible data governance practices while supporting the appropriate use of electronic health record data for patient care and clinical research. Protecting patient information is essential for maintaining public trust while continuing to realize the benefits of modern healthcare analytics.

Introduction

The healthcare industry has undergone a significant digital transformation over the past two decades as hospitals and healthcare providers have transitioned from paper records to electronic health records (EHRs). Electronic records have improved communication among providers, increased access to patient information, and created new opportunities to improve clinical decision-making through data analytics. At the same time, this shift has introduced new challenges related to patient privacy, cybersecurity, and the protection of sensitive health information. As healthcare organizations continue to rely on digital technologies, balancing the benefits of data accessibility with the responsibility to protect patient information has become a central issue in healthcare management.

One of the primary drivers of this transformation was the Health Information Technology for Economic and Clinical Health (HITECH) Act of 2009. The legislation encouraged healthcare organizations to adopt certified electronic health record systems by providing financial incentives for demonstrating meaningful use. Research by Adler-Milstein and Jha found that hospitals eligible for HITECH incentives experienced substantially greater increases in electronic health record adoption than hospitals that were not eligible, demonstrating that the legislation significantly accelerated the nation’s transition toward digital healthcare (Adler-Milstein and Jha 2017). As electronic health records became more widespread, healthcare organizations gained the ability to collect and analyze enormous amounts of clinical information while simultaneously assuming greater responsibility for protecting that information from unauthorized access.

The increasing use of electronic health records has also reinforced the importance of federal privacy regulations such as the Health Insurance Portability and Accountability Act (HIPAA). While HIPAA establishes standards for protecting protected health information, HITECH strengthened these protections by expanding security requirements, encouraging electronic record adoption, and increasing breach notification responsibilities. More recently, healthcare organizations have also faced rapidly evolving cybersecurity threats, prompting the U.S. Department of Health and Human Services to publish voluntary Healthcare and Public Health Cybersecurity Performance Goals that encourage organizations to implement stronger security controls such as multifactor authentication, network protection, and incident response planning (U.S. Department of Health and Human Services 2024).

This report examines the relationship between healthcare data, privacy, and security by combining current research with an analysis of the MIMIC-III database. Using one patient’s final hospitalization as a case study, the report demonstrates how electronic health records can reconstruct a detailed clinical timeline from admission through death. Although the database has been de-identified for research purposes, the amount of information available illustrates both the tremendous value of healthcare data for improving patient care and the importance of maintaining strong privacy and cybersecurity protections.

The Healthcare Context

Healthcare organizations have become increasingly dependent on electronic health records to support patient care, improve communication among providers, and enhance clinical decision-making. While this digital transformation has improved efficiency and expanded opportunities for data-driven research, it has also created new challenges involving patient privacy and cybersecurity. Modern healthcare systems now manage enormous amounts of sensitive information, making them attractive targets for cybercriminals while simultaneously increasing the responsibility of healthcare organizations to protect patient data.

The HITECH Act played a major role in accelerating this transformation by encouraging hospitals to adopt electronic health record systems through financial incentives tied to meaningful use. Prior to HITECH, adoption rates increased slowly among hospitals. After implementation of the incentive program, eligible hospitals experienced substantially faster growth in electronic health record adoption than hospitals that were not eligible for the program, demonstrating the effectiveness of the legislation in modernizing healthcare information systems (Adler-Milstein and Jha 2017). Although this widespread adoption improved care coordination and expanded opportunities for clinical research, it also dramatically increased the amount of sensitive patient information being stored electronically.

As healthcare organizations have become more reliant on digital records, protecting patient privacy has become increasingly complex. While many patients assume their medical information is always protected under HIPAA, the growth of mobile health applications and telehealth services has created situations where health-related information may not receive the same legal protections as information maintained by traditional healthcare providers. The Federal Trade Commission’s enforcement action against BetterHelp illustrates this challenge. According to the FTC, BetterHelp shared users’ mental health information with third-party advertising platforms despite assuring consumers that their information would remain private. The proposed settlement prohibited the company from using consumers’ health information for advertising and required millions of dollars in refunds to affected customers. This case demonstrates that healthcare organizations and digital health companies must be transparent about how patient information is collected, used, and shared because public trust depends on responsible data stewardship (Haggin 2023).

Cybersecurity has become an equally important concern as healthcare organizations continue expanding their digital infrastructure. Ransomware attacks have increased in both frequency and sophistication, disrupting healthcare operations and exposing sensitive patient information. Researchers documented 374 ransomware attacks against U.S. healthcare delivery organizations between 2016 and 2021, exposing the protected health information of nearly 42 million patients. The study also found that almost half of these attacks disrupted healthcare delivery through electronic system outages, appointment cancellations, delayed procedures, and ambulance diversions, illustrating that cybersecurity incidents can directly affect patient care rather than simply compromising data.

Recognizing these growing threats, the U.S. Department of Health and Human Services has encouraged healthcare organizations to strengthen cybersecurity through measures such as multifactor authentication, network segmentation, regular system updates, employee security awareness training, and comprehensive incident response planning. These recommendations reflect a broader shift in healthcare administration, where protecting patient information is no longer viewed solely as a regulatory requirement but as an essential component of patient safety and organizational resilience (U.S. Department of Health and Human Services 2024).

Together, these developments highlight the central challenge facing modern healthcare organizations. Electronic health records have transformed healthcare by improving access to clinical information and enabling advanced research, but they also require organizations to safeguard enormous amounts of highly sensitive data. As demonstrated throughout this report, even de-identified research databases such as MIMIC-III contain enough information to reconstruct a remarkably detailed picture of a patient’s hospitalization, reinforcing why strong privacy protections, cybersecurity practices, and ethical data governance remain critical throughout the healthcare industry.

Data Visualizations

Patient Background

The patient selected for this profile was Subject ID 10126. This patient was a 44-year-old female who was admitted on July 12, 2171, through an emergency admission after a physician referral. Her primary diagnosis was liver failure. She remained hospitalized for approximately 35 days before dying on August 16, 2171. The patient’s hospital course was especially serious because she entered the Surgical Intensive Care Unit shortly after admission and remained there for nearly the entire hospitalization. Her ICU stay shows that this was not a brief or routine admission, but a prolonged critical care episode ending in death.

SELECT subject_id,
hadm_id,
admittime,
dischtime,
deathtime,
diagnosis,
admission_type,
admission_location,
discharge_location,
(julianday(dischtime)-julianday(admittime)) as stay_length
FROM admissions
WHERE hospital_expire_flag = 1
ORDER BY stay_length DESC
LIMIT 10

SELECT subject_id,
gender,
dob,
dod
FROM patients
WHERE subject_id = 10126

SELECT subject_id,
hadm_id,
admittime,
dischtime,
deathtime,
admission_type,
admission_location,
discharge_location,
diagnosis,
(julianday(dischtime)-julianday(admittime)) as stay_length
FROM admissions
WHERE hadm_id = 160445

SELECT first_careunit,
last_careunit,
intime,
outtime,
(julianday(outtime)-julianday(intime)) as icu_length
FROM icustays
WHERE hadm_id = 160445

SELECT charttime,
valuenum
FROM labevents
WHERE hadm_id = 160445
AND itemid = 51237
AND valuenum IS NOT NULL
ORDER BY charttime

Laboratory Trend

ggplot(data = myquery5,
       aes(x = charttime,
           y = valuenum,
           group = 1))+
  geom_line()

Figure 1 shows the patient’s INR values throughout the hospitalization. INR is commonly monitored in patients with liver failure because the liver plays an important role in producing clotting factors. During this patient’s stay, INR levels fluctuated, improved for a period, and then rose sharply near the end of the admission. This suggests worsening clotting function and supports the overall clinical picture of progressive liver failure. This patient profile also shows how much information can be reconstructed from electronic health record data. Even though MIMIC-III is de-identified, the database still makes it possible to follow one patient’s age, sex, admission source, diagnosis, ICU location, length of stay, lab trends, and death. That level of visibility is valuable for research, but it also reinforces why healthcare privacy and cybersecurity protections are so important.

Recommendations for Industry

Healthcare organizations should continue investing in electronic health record systems while recognizing that protecting patient privacy is just as important as improving access to clinical information. As demonstrated by the BetterHelp case and the continued rise in ransomware attacks, healthcare organizations must ensure that patient information is collected, stored, and shared responsibly. Administrators should regularly review privacy policies, strengthen employee training on HIPAA compliance, and verify that third-party vendors handling patient information follow the same security standards as the healthcare organization.

Healthcare leaders should also prioritize cybersecurity investments as part of everyday operations rather than treating them as occasional technology upgrades. Implementing measures such as multi-factor authentication, regular software updates, network monitoring, routine data backups, and employee phishing awareness training can reduce the likelihood of successful cyberattacks and minimize disruptions to patient care. Developing and testing incident response plans before a cybersecurity event occurs can also help organizations recover more quickly while protecting patient information.

Finally, healthcare organizations should continue supporting the responsible use of de-identified clinical databases for research while maintaining strong safeguards that protect patient confidentiality. Databases such as MIMIC-III provide valuable opportunities to improve clinical decision-making, evaluate treatment outcomes, and advance medical research. However, this assignment demonstrates that even de-identified records can reveal detailed information about an individual’s healthcare experience. Maintaining strong privacy protections, ethical data governance, and ongoing security improvements will allow healthcare organizations to benefit from healthcare analytics while preserving patient trust.

References

Adler-Milstein, Julia, and Ashish K. Jha. 2017. “HITECH Act Drove Large Gains in Hospital Electronic Health Record Adoption.” Health Affairs 36 (8): 1416–22. https://doi.org/10.1377/hlthaff.2016.1651.

Haggin, Patience. 2023. “BetterHelp Barred Under Proposed Settlement from Supplying Health Data for Ads.” The Wall Street Journal.

U.S. Department of Health and Human Services. 2024. “Healthcare and Public Health Cybersecurity Performance Goals.” https://hhscyber.hhs.gov/cybersecurity-performance-goals.html.