title: The inadvertent disclosure of personal health information through peer-to-peer file sharing programs.
abstract: OBJECTIVE
  There has been a consistent concern about the inadvertent disclosure of personal information through peer-to-peer file sharing applications, such as Limewire and Morpheus. Examples of personal health and financial information being exposed have been published. We wanted to estimate the extent to which personal health information (PHI) is being disclosed in this way, and compare that to the extent of disclosure of personal financial information (PFI).
  
  
  METHODS
  After careful review and approval of our protocol by our institutional research ethics board, files were downloaded from peer-to-peer file sharing networks and manually analyzed for the presence of PHI and PFI. The geographic region of the IP addresses was determined, and classified as either USA or Canada.
  
  
  METHODS
  We estimated the proportion of files that contain personal health and financial information for each region. We also estimated the proportion of search terms that return files with personal health and financial information. We ascertained and discuss the ethical issues related to this study.
  
  
  RESULTS
  Approximately 0.4% of Canadian IP addresses had PHI, as did 0.5% of US IP addresses. There was more disclosure of financial information, at 1.7% of Canadian IP addresses and 4.7% of US IP addresses. An analysis of search terms used in these file sharing networks showed that a small percentage of the terms would return PHI and PFI files (ie, there are people successfully searching for PFI and PHI on the peer-to-peer file sharing networks).
  
  
  CONCLUSIONS
  There is a real risk of inadvertent disclosure of PHI through peer-to-peer file sharing networks, although the risk is not as large as for PFI. Anyone keeping PHI on their computers should avoid installing file sharing applications on their computers, or if they have to use such tools, actively manage the risks of inadvertent disclosure of their, their family's, their clients', or patients' PHI.
authors.affiliation: Department of Pediatrics, Faculty of Medicine, University of Ottawa, Ottawa, Ontario, Canada. kelemam@uottawa.ca
authors.forename: Khaled
authors.initials: K
authors.lastname: El Emam
authors.forename: Emilio
authors.initials: E
authors.lastname: Neri
authors.forename: Elizabeth
authors.initials: E
authors.lastname: Jonker
authors.forename: Marina
authors.initials: M
authors.lastname: Sokolova
authors.forename: Liam
authors.initials: L
authors.lastname: Peyton
authors.forename: Angelica
authors.initials: A
authors.lastname: Neisa
authors.forename: Teresa
authors.initials: T
authors.lastname: Scassa
mesh_terms: D002170:Canada; D003195:Computer Communication Networks; D016494:Computer Security; D003219:Confidentiality; D030881:Disclosure; D057286:Electronic Health Records; D006801:Humans; D033181:Information Dissemination; D016247:Information Storage and Retrieval; D012308:Risk Management; D014481:United States