Anonymizing Health Data

209 Pages·2013·13 MB·English

by  Khaled El Emam

Anonymizing Health Data
Case Studies and Methods to Get You Started
Khaled El Emam and Luk Arbuckle
Anonymizing Health Data
by Khaled El Emam and Luk Arbuckle
Copyright © 2014 Luk Arbuckle and Khaled El Eman. All rights reserved.
Printed in the United States of America.
Published by O’Reilly Media, Inc., 1005 Gravenstein Highway North, Sebastopol, CA 95472.
O’Reilly books may be purchased for educational, business, or sales promotional use. Online editions are
also available for most titles (http://my.safaribooksonline.com). For more information, contact our corporate/
institutional sales department: 800-998-9938 or [email protected].
Editors: Andy Oram and Allyson MacDonald Indexer: WordCo Indexing Services
Production Editor: Nicole Shelby Cover Designer: Randy Comer
Copyeditor: Charles Roumeliotis Interior Designer: David Futato
Proofreader: Rachel Head Illustrator: Rebecca Demarest
December 2013: First Edition
Revision History for the First Edition:
2013-12-10: First release
See http://oreilly.com/catalog/errata.csp?isbn=9781449363079 for release details.
Nutshell Handbook, the Nutshell Handbook logo, and the O’Reilly logo are registered trademarks of O’Reilly
Media, Inc. Anonymizing Health Data, the image of Atlantic Herrings, and related trade dress are trademarks
of O’Reilly Media, Inc.
Many of the designations used by manufacturers and sellers to distinguish their products are claimed as
trademarks. Where those designations appear in this book, and O’Reilly Media, Inc. was aware of a trademark
claim, the designations have been printed in caps or initial caps.
While every precaution has been taken in the preparation of this book, the publisher and authors assume
no responsibility for errors or omissions, or for damages resulting from the use of the information contained
herein.
ISBN: 978-1-449-36307-9
[LSI]
Table of Contents
Preface. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ix
1. Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
To Anonymize or Not to Anonymize 1
Consent, or Anonymization? 2
Penny Pinching 3
People Are Private 4
The Two Pillars of Anonymization 4
Masking Standards 5
De-Identification Standards 5
Anonymization in the Wild 8
Organizational Readiness 8
Making It Practical 9
Use Cases 10
Stigmatizing Analytics 12
Anonymization in Other Domains 13
About This Book 15
2. A Risk-Based De-Identification Methodology. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Basic Principles 19
Steps in the De-Identification Methodology 21
Step 1: Selecting Direct and Indirect Identifiers 21
Step 2: Setting the Threshold 22
Step 3: Examining Plausible Attacks 23
Step 4: De-Identifying the Data 25
Step 5: Documenting the Process 26
Measuring Risk Under Plausible Attacks 26
T1: Deliberate Attempt at Re-Identification 26
T2: Inadvertent Attempt at Re-Identification 28
iii
T3: Data Breach 29
T4: Public Data 30
Measuring Re-Identification Risk 30
Probability Metrics 30
Information Loss Metrics 32
Risk Thresholds 35
Choosing Thresholds 35
Meeting Thresholds 38
Risky Business 39
3. Cross-Sectional Data: Research Registries. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
Process Overview 43
Secondary Uses and Disclosures 43
Getting the Data 46
Formulating the Protocol 47
Negotiating with the Data Access Committee 48
BORN Ontario 49
BORN Data Set 50
Risk Assessment 51
Threat Modeling 51
Results 52
Year on Year: Reusing Risk Analyses 53
Final Thoughts 54
4. Longitudinal Discharge Abstract Data: State Inpatient Databases. . . . . . . . . . . . . . . . . . 57
Longitudinal Data 58
Don’t Treat It Like Cross-Sectional Data 60
De-Identifying Under Complete Knowledge 61
Approximate Complete Knowledge 63
Exact Complete Knowledge 64
Implementation 65
Generalization Under Complete Knowledge 65
The State Inpatient Database (SID) of California 66
The SID of California and Open Data 66
Risk Assessment 68
Threat Modeling 68
Results 68
Final Thoughts 69
5. Dates, Long Tails, and Correlation: Insurance Claims Data. . . . . . . . . . . . . . . . . . . . . . . . . 71
The Heritage Health Prize 71
Date Generalization 72
iv | Table of Contents
Randomizing Dates Independently of One Another 72
Shifting the Sequence, Ignoring the Intervals 73
Generalizing Intervals to Maintain Order 74
Dates and Intervals and Back Again 76
A Different Anchor 77
Other Quasi-Identifiers 77
Connected Dates 78
Long Tails 78
The Risk from Long Tails 79
Threat Modeling 80
Number of Claims to Truncate 80
Which Claims to Truncate 82
Correlation of Related Items 83
Expert Opinions 84
Predictive Models 85
Implications for De-Identifying Data Sets 85
Final Thoughts 86
6. Longitudinal Events Data: A Disaster Registry. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87
Adversary Power 88
Keeping Power in Check 88
Power in Practice 89
A Sample of Power 90
The WTC Disaster Registry 92
Capturing Events 92
The WTC Data Set 93
The Power of Events 94
Risk Assessment 96
Threat Modeling 97
Results 97
Final Thoughts 97
7. Data Reduction: Research Registry Revisited. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99
The Subsampling Limbo 99
How Low Can We Go? 100
Not for All Types of Risk 100
BORN to Limbo! 101
Many Quasi-Identifiers 102
Subsets of Quasi-Identifiers 103
Covering Designs 104
Covering BORN 106
Table of Contents | v
Final Thoughts 107
8. Free-Form Text: Electronic Medical Records. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109
Not So Regular Expressions 109
General Approaches to Text Anonymization 110
Ways to Mark the Text as Anonymized 112
Evaluation Is Key 113
Appropriate Metrics, Strict but Fair 115
Standards for Recall, and a Risk-Based Approach 116
Standards for Precision 117
Anonymization Rules 118
Informatics for Integrating Biology and the Bedside (i2b2) 119
i2b2 Text Data Set 119
Risk Assessment 121
Threat Modeling 121
A Rule-Based System 122
Results 122
Final Thoughts 124
9. Geospatial Aggregation: Dissemination Areas and ZIP Codes. . . . . . . . . . . . . . . . . . . . . 127
Where the Wild Things Are 128
Being Good Neighbors 129
Distance Between Neighbors 129
Circle of Neighbors 130
Round Earth 132
Flat Earth 133
Clustering Neighbors 134
We All Have Boundaries 135
Fast Nearest Neighbor 136
Too Close to Home 138
Levels of Geoproxy Attacks 139
Measuring Geoproxy Risk 140
Final Thoughts 142
10. Medical Codes: A Hackathon. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145
Codes in Practice 146
Generalization 147
The Digits of Diseases 147
The Digits of Procedures 149
The (Alpha)Digits of Drugs 149
Suppression 150
Shuffling 151
vi | Table of Contents
Final Thoughts 154
11. Masking: Oncology Databases. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157
Schema Shmema 157
Data in Disguise 158
Field Suppression 158
Randomization 159
Pseudonymization 161
Frequency of Pseudonyms 162
Masking On the Fly 163
Final Thoughts 164
12. Secure Linking. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 165
Let’s Link Up 165
Doing It Securely 168
Don’t Try This at Home 168
The Third-Party Problem 170
Basic Layout for Linking Up 171
The Nitty-Gritty Protocol for Linking Up 172
Bringing Paillier to the Parties 172
Matching on the Unknown 173
Scaling Up 175
Cuckoo Hashing 176
How Fast Does a Cuckoo Run? 177
Final Thoughts 177
13. De-Identification and Data Quality. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 179
Useful Data from Useful De-Identification 179
Degrees of Loss 180
Workload-Aware De-Identification 181
Questions to Improve Data Utility 183
Final Thoughts 185
Index. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 189
Table of Contents | vii