Anonymizing datasets with demographics and diagnosis codes in the presence of utility constraints

Abstract

Publishing data about patients that contain both demographics and diagnosis codes is essential to perform large-scale, low-cost medical studies. However, preserving the privacy and utility of such data is challenging, because it requires: (i) guarding against identity disclosure (re-identification) attacks based on both demographics and diagnosis codes, (ii) ensuring that the anonymized data remain useful in intended analysis tasks, and (iii) minimizing the information loss, incurred by anonymization, to preserve the utility of general analysis tasks that are difficult to determine before data publishing. Existing anonymization approaches are not suitable for being used in this setting, because they cannot satisfy all three requirements. Therefore, in this work, we propose a new approach to deal with this problem. We enforce the requirement (i) by applying (k, k m )-anonymity, a privacy principle that prevents re-identification from attackers who know the demographics of a patient and up to m of their diagnosis codes, where k and m are tunable parameters. To capture the requirement (ii), we propose the concept of utility constraint for both demographics and diagnosis codes. Utility constraints limit the amount of generalization and are specified by data owners (e.g., the healthcare institution that performs anonymization). We also capture requirement (iii), by employing well-established information loss measures for demographics and for diagnosis codes. To realize our approach, we develop an algorithm that enforces (k, k m )-anonymity on a dataset containing both demographics and diagnosis codes, in a way that satisfies the specified utility constraints and with minimal information loss, according to the measures. Our experiments with a large dataset containing more than 200, 000 electronic health records show the effectiveness and efficiency of our algorithm.

Probabilistic record linkage of de-identified research datasets with discrepancies using diagnosis codes

“…A final limitation is the potential risk to patients from re-identifying a de-identified dataset by linking it to a dataset containing PHI. Often the data use agreements for research datasets forbid any attempts at doing record linkage for this reason, but the use of formal privacy models could help mitigate that risk 29,30 .…”

Privacy Preserving Location Data Publishing: A Machine Learning Approach

“…The authors in [5], [11] chose to avoid alignment by selecting trajectories with the highest similarity as representatives of clusters. Poulis et al [12] investigated applying restriction on the amount of generalization that can be applied by proposing a userdefined utility metric. Takahashi et al [13] proposed an approach termed as CMAO to anonymize the real-time publication of spatiotemporal trajectories.…”

Returning to our roots: The use of geospatial data for nurse‐led community research

“…Many publicly available datasets have already aggregated individual addresses to a census tract. When hospitals collaborate with researchers they are required to aggregate data to a geographic level that protects patient confidentiality (Comer, Grannis, Dixon, Bodenhamer, & Wiehe, ; Poulis, Loukides, Skiadopoulos, & Gkoulalas‐Divanis, ). When primary geospatial data are collected, several steps can be taken to ensure confidentiality for participants.…”