Privacy preserving data anonymization of spontaneous ADE reporting system dataset

Abstract

BackgroundTo facilitate long-term safety surveillance of marketing drugs, many spontaneously reporting systems (SRSs) of ADR events have been established world-wide. Since the data collected by SRSs contain sensitive personal health information that should be protected to prevent the identification of individuals, it procures the issue of privacy preserving data publishing (PPDP), that is, how to sanitize (anonymize) raw data before publishing. Although much work has been done on PPDP, very few studies have focused on protecting privacy of SRS data and none of the anonymization methods is favorable for SRS datasets, due to which contain some characteristics such as rare events, multiple individual records, and multi-valued sensitive attributes.MethodsWe propose a new privacy model called MS(k, θ*)-bounding for protecting published spontaneous ADE reporting data from privacy attacks. Our model has the flexibility of varying privacy thresholds, i.e., θ*, for different sensitive values and takes the characteristics of SRS data into consideration. We also propose an anonymization algorithm for sanitizing the raw data to meet the requirements specified through the proposed model. Our algorithm adopts a greedy-based clustering strategy to group the records into clusters, conforming to an innovative anonymization metric aiming to minimize the privacy risk as well as maintain the data utility for ADR detection. Empirical study was conducted using FAERS dataset from 2004Q1 to 2011Q4. We compared our model with four prevailing methods, including k-anonymity, (X, Y)-anonymity, Multi-sensitive l-diversity, and (α, k)-anonymity, evaluated via two measures, Danger Ratio (DR) and Information Loss (IL), and considered three different scenarios of threshold setting for θ*, including uniform setting, level-wise setting and frequency-based setting. We also conducted experiments to inspect the impact of anonymized data on the strengths of discovered ADR signals.ResultsWith all three different threshold settings for sensitive value, our method can successively prevent the disclosure of sensitive values (nearly all observed DRs are zeros) without sacrificing too much of data utility. With non-uniform threshold setting, level-wise or frequency-based, our MS(k, θ*)-bounding exhibits the best data utility and the least privacy risk among all the models. The experiments conducted on selected ADR signals from MedWatch show that only very small difference on signal strength (PRR or ROR) were observed. The results show that our method can effectively prevent the disclosure of patient sensitive information without sacrificing data utility for ADR signal detection.ConclusionsWe propose a new privacy model for protecting SRS data that possess some characteristics overlooked by contemporary models and an anonymization algorithm to sanitize SRS data in accordance with the proposed model. Empirical evaluation on the real SRS dataset, i.e., FAERS, shows that our method can effectively solve the privacy problem in SRS data without influencing the AD...

Utility-preserving anonymization for health data publishing

“…As possible future works, we can design new anonymization methods that can satisfy h -ceiling with other privacy preserving models such as l -diversity, t -closeness, or MS( k , θ ∗ )-anonymity [ 20 – 22 ]. In this paper, we considered only the full-domain generalization which is the most widely used anonymization methodology especially in health/medical domains [ 16 , 17 , 23 , 24 ].…”

Improved privacy preserving method for periodical SRS publishing

“…Dangerous Identity Ratio(DIR) [21][22] and Dangerous Sensitivity Ratio (DSR) [21][22] are used to evaluate the security of publishing methods. We call a group as a dangerous identity group (DIG) if the number of records in the group is less than threshold k. If a group contains at least one sensitive value v i whose frequency is higher than its threshold θ i , we call it as a dangerous sensitivity group (DSG).…”

ρ-kazanım: fayda temelli veri yayınlama modeli

“…Ayrıca sırasıyla savcı, gazeteci ve pazarlamacı risklerinin %20, %20 ve % 6,96 olduğu görülmektedir. Bu çalışmada saldırgan kurbanın yayınlanan veri seti içerisinde olduğu bilgisine sahip olduğu varsayıldığından ρ-Kazanım öncesi savcı risk grafiği Şekil 9'da verilmiştir Grafik incelendiğinde kayıtların %4,24'nün yüksek risk aralığında (16,(7)(8)(9)(10)(11)(12)(13)(14)(15)(16)(17)(18)(19)(20) olduğu ve başlangıç riskinin %20 olduğu görülmektedir.…”

“…Veri toplayıcılar, topladıkları verileri çoğunlukla öznitelik ve kayıtlardan oluşan mikro veri tablosu biçiminde paylaşırlar. Mikro veri tablosundaki öznitelikler, her bir kayıtta yer alan muhatapları hakkında verdikleri bilgilere göre, kimlik tanımlayıcı öznitelik (Identifier-ID), birleşik tanımlayıcı öznitelik (Quasi Identifier-QID), hassas öznitelik (Sensitive Attribute-SA) ve hassas olmayan öznitelik (Non Sensitive Attribute-NSA) olmak üzere dört grupta sınıflandırılır [10]. Orijinal mikro veri tablosu T (ID, QID, SA, NSA), anonimleştirilmiş mikro veri tablosu T* (QID*, SA) biçiminde gösterilir.…”