Imagine if a clinical researcher were to disclose a list of patient addresses to a third party that was outside of their hospital or health system without a formal agreement with that third party to secure the data. Imagine they then publicly announced that they disclosed the addresses, that the addresses belonged to patients with a specific disease, and that those patients were being treated at a specific hospital. The researcher’s institutional review board (IRB) and Health Insurance Portability and Accountability Act (HIPAA) compliance office would be outraged at these violations of patient privacy. Yet, this sequence of events can happen inadvertently when studying how neighborhood conditions such as access to medical facilities or surrounding food environments affect clinical outcomes in certain patient populations.

Clinical epidemiology and patient-oriented health care research incorporating neighborhood-level data is becoming progressively more common as the National Institutes of Health and professional and patient organizations are increasingly encouraging such research [1,2]. For instance, the American Cancer Society has classified multilevel research on neighborhood-level social determinants of cancer survivorship as a priority recommendation for research [2]. Here, we describe how inadvertent disclosures of personally identifiable information (PII) and protected health information (PHI) can occur when researchers study the effects of neighborhood contexts on clinical outcomes among patients and we describe ways to mitigate this risk. PII is information that can be used to identify individuals; street addresses are classified as PII [3]. PHI includes information about a patient’s past or present health conditions, any treatment for those conditions, or any other provision of care. Under HIPAA, all geographical identifiers below the state level that were created, used, or disclosed during the provision of health care are also considered PHI [4]. Patient residential addresses used during treatment, or even addresses already documented in the medical or billing records, meet the criteria for geographic PHI, as does the name of the hospital treating a patient.

We describe the steps in the research process when PII and PHI can be disclosed when the study population is defined as patients with a specific disease or diseases, as is common in clinical studies. We then explain why many protocols do not protect patient privacy and conclude by offering suggestions for a workflow that avoids the issues we identify. We use a fictional example throughout this article to avoid compounding potential PII and PHI disclosure issues that have occurred in previously published research. The hypothetical study being referenced examines whether residential neighborhood poverty rates are associated with the risk of death among patients with COVID-19 who were treated at the Columbia University Irving Medical Center. Though fictional, the example draws on published studies and studies that we have peer reviewed for clinical and public health journals. Figure 1 summarizes the disclosure risk associated with common approaches to geocoding patient addresses.

Some researchers recognize the risks associated with this type of study but use strategies that do not protect PII and PHI. One approach we have seen proposed is to submit patient addresses of interest to a geocoding service along with a pool of randomly selected addresses [9]. An issue with this approach is that due to referral patterns and the geographies of hospital catchment areas, patient addresses are likely to cluster and may not be sufficiently hidden by pools of randomly selected addresses. In theory, if the pool is large enough (eg, every address in the health care system’s catchment or referral area), this approach to geocoding does not provide PII to the geocoding service provider. However, this approach has several flaws. First, the approach does not follow the National Institute of Standards and Technology recommendations to secure data by requiring an encryption key rather than relying on keeping the information itself hidden [10]. Second, identifying an address list long enough to effectively obscure the patient addresses typically requires more computational skill and resources than simply geocoding the addresses securely in the first place. In our example of outcomes among patients with COVID-19, this approach might require identifying and submitting to the geocoding service every address in the Columbia University Irving Medical Center patient catchment area to fully obscure the study’s patient addresses.

Another possibility may be to use a virtual private network (VPN) that obscures the identity of the computer sending the addresses to the third-party geocoding service, thus concealing the fact that the addresses are being sent from a medical system. However, VPNs can be difficult to set up securely and many commercial VPNs do in fact reveal the location of the user’s computer [11]. Furthermore, even with a secure VPN, default settings on web browsers reveal a user’s location to the websites being visited. Thus, a researcher using a VPN to access a web-based geocoder still risks disclosing PII and PHI to the geocoder service provider. Moreover, even the successful implementation of a VPN only shifts the disclosure of the address information and researcher identity from the geocoding service provider to the VPN service provider. An onion router, such as Tor (The Onion Router), can add a layer of anonymity to ensure that the geocoding service provider cannot link the address data to a researcher, clinician, or institution [12]. However, there have been cases of onion routers being compromised [13]. The complexity of these solutions makes full compliance difficult, especially since simpler solutions exist.

For researchers to be compliant with HIPAA and typical IRB regulations, patient addresses should be geocoded using desktop tools, such as ArcGIS, that store address information on local secured machines. QGIS offers a free open-source alternative to ArcGIS, though default geocode options use OpenStreetMap, so care must be taken to set up desktop options. Alternatively, researchers can use a geocoder designed for server hosting within a virtual machine on their local computer. For example, the open-source PostGIS geocoder can be hosted within a Docker container and accessed using R (see [14] for an example). An alternative is for the hospital or health care system to negotiate a BAA with a third-party geocoding service [4]. Under HIPAA, a business associate provides services, including data analysis, that involve the use or disclosure of individually identifiable health information to a covered entity [4]. Although licenses for ArcGIS can be expensive (note that the various third-party services and R packages we have described are free), without a BAA, the use of third-party services to geocode patient addresses involves the inappropriate disclosure of PII and PHI. The time and administrative cost of establishing a BAA may be equivalent to, or more expensive, than an ArcGIS license.

In summary, geocoding patient addresses using web-based services creates direct and large-scale disclosures of PII and PHI, and the proliferation of simple-to-use R packages for geocoding increases the risk of these inadvertent disclosures. Web-based geospatial tools are powerful and allow for efficient and rigorous research. However, researchers geocoding patient addresses must be aware of the risk of inadvertent disclosure of patient PII and PHI. Researchers should avoid web-based geocoders and use only secure desktop tools when geocoding patient information. Researchers may wish to disconnect computers from the internet while geocoding to ensure that no data are inadvertently passed to third parties.