Thousands of people have received brain scans as well as cognitive and genetic tests while participating in studies. Although the data can be widely disseminated to scientists, most participants accept that their privacy is protected because researchers remove their names and other identifying information from their records.
But can a curious family member identify one of them only from the brain scan? Can a company that obtains medical records for the sale of targeted ads do so, or someone who wants to bother a study participant?
The answer is yes, investigators at the Mayo Clinic said Wednesday.
In some circumstances, that person may be compared to an individual with facial recognition software.
In a letter published in the New England Journal of Medicine, researchers at the Mayo Clinic indicated that the necessary steps were not complicated. But privacy experts questioned whether the process could be replicated on a much larger scale with today's technology.
The subjects were 84 healthy participants in a long-term survey of approximately 2000 residents in Olmsted County, Min. participants received brain scans to look for signs of Alzheimer's disease, as well as cognitive, blood and genetic tests.
Over the years, the survey has accumulated over 6,000 M.R.I. scanning. (Participants do not report the results of their tests.)
After the participants agreed to the experiment, a team led by Christopher Schwartz, a computer scientist at the Mayo Clinic took their faces separately and used a computer reconstruction program of NMR subjects.
The team then turned to face recognition software to verify that participants could be properly matched. The program correctly identifies 70 of the items. Only one correct match can be expected by chance, said Dr. Schwartz.
Indeed, he added, it was a fairly simple test. Face recognition software only had to search for pictures of 84 people, not thousands or millions.
But the fact that it was a direct test is "down to the end," says Aaron Roth, a computer scientist and confidentiality expert at the University of Pennsylvania.
"Clearly, this will ultimately be a harassing attack " on stored medical records, he said.
More likely abuse may be even easier than the method tested by Mayo researchers, ”Dr. Roth said. Imagine a bad actor already knew that a particular person was being investigated and may have had some information about age and gender.
In these circumstances, it should be far less difficult to find M.R.I. than to start scanning and identify the object. The task is "unfortunately reasonably clear," said Dr. Schwartz.
The threat to privacy is real, said Dr. Michael Weiner of the University of California, San Francisco.
Dr. Weiner is leading a national study called the Alzheimer's Neuroimaging Initiative, which included 2,400 healthy people trying to find signs of dementia before a person showed symptoms.
With the publication of the study from the Mayo Clinic, he said, the initiative's administrators will send letters to participating research centers informing them of potential privacy violations.
The survey data is devoid of identifying information such as participant names and Social Security numbers, but MRI scans include individuals. The only protection of subjects' confidentiality so far is the fact that researchers who want to have access to survey data must sign agreements stating that they will not attempt to identify participants.
"There have been millions of image downloads," said Dr. Arthur Toga of the University of Southern California, whose group is sending NMR scans and other data to researchers who request them from A.D.N.I. About 6,300 investigators received survey data, he said.
Dr. Weiner himself is a participant in this study and his brain scans are included in the research data.
"My genetics are there," he said. – All my tests are there. I bet there are many images of me on the internet. You could compare me to A.D.N.I. subject code and look at all my data. "
" The question is, what can we do now? "
The obvious way to remedy the problem would be to remove individuals from M.R.I. scans stored in databases. This process, however, blurs the image of the brain.
Also, fixing images in this way would not help to protect the privacy of millions of subjects whose brain scans are already stored by ADNI, the Mayo study, and other major research projects.
p. Schwartz said his group is working on a different solution, but declined to say what it was. Yves-Alexander de Monjoe, a privacy researcher at Imperial College London, questioned whether an easy fix could even be made.
"If it does not exist, it raises many questions about how M.R.I. the data is being used, "he said. The Mayo group's letter, he added, "is a good warning."