A secure protocol for protecting the identity of providers when disclosing data for disease surveillance

Abstract

BackgroundProviders have been reluctant to disclose patient data for public-health purposes. Even if patient privacy is ensured, the desire to protect provider confidentiality has been an important driver of this reluctance.MethodsSix requirements for a surveillance protocol were defined that satisfy the confidentiality needs of providers and ensure utility to public health. The authors developed a secure multi-party computation protocol using the Paillier cryptosystem to allow the disclosure of stratified case counts and denominators to meet these requirements. The authors evaluated the protocol in a simulated environment on its computation performance and ability to detect disease outbreak clusters.ResultsTheoretical and empirical assessments demonstrate that all requirements are met by the protocol. A system implementing the protocol scales linearly in terms of computation time as the number of providers is increased. The absolute time to perform the computations was 12.5 s for data from 3000 practices. This is acceptable performance, given that the reporting would normally be done at 24 h intervals. The accuracy of detection disease outbreak cluster was unchanged compared with a non-secure distributed surveillance protocol, with an F-score higher than 0.92 for outbreaks involving 500 or more cases.ConclusionThe protocol and associated software provide a practical method for providers to disclose patient data for sentinel, syndromic or other indicator-based surveillance while protecting patient privacy and the identity of individual providers.

Snoop

“…The constraints for SMC discussed in [11] combined with an practical and efficient implementation [7] are the basis for our work. Secure disease surveillance might enforce other requirements [8] that should be considered in future work.…”

A Survey of Privacy-Preserving Techniques for Reuse of Distributed Health Data (Preprint)

“…However, the resulting integrated de-identified dataset does not satisfy a standard privacy model (e.g., k -anonymous) and suffers a significant loss of utility [85,86]. Even when individuals' privacy is protected, the de-identified dataset of a healthcare provider might reveal its sensitive business information [29].…”

“…In addition, the statistical results from a single data custodian might reveal sensitive information about the data custodian [29].…”

“…Clinicians and healthcare providers are also concerned about their own privacy as well as their patients' privacy. Healthcare providers are concerned that the health data they disclose for research might be used to evaluate their compliance and performance, damage the doctor-patient relationship, and reveal business information [28,29].…”

User-centric distributed solutions for privacy-preserving analytics

“…Other examples of deploying MPC for social good include tax fraud detection [6] and disease surveillance [7]. Additionally, because MPC decouples computing and networking resources from data, users can leverage the benefits of large data centers without ceding control over their sensitive data.…”