Anonymization of electronic medical records for validating genome-wide association studies

Abstract

Genome-wide association studies (GWAS) facilitate the discovery of genotype-phenotype relations from population-based sequence databases, which is an integral facet of personalized medicine. The increasing adoption of electronic medical records allows large amounts of patients' standardized clinical features to be combined with the genomic sequences of these patients and shared to support validation of GWAS findings and to enable novel discoveries. However, disseminating these data "as is" may lead to patient reidentification when genomic sequences are linked to resources that contain the corresponding patients' identity information based on standardized clinical features. This work proposes an approach that provably prevents this type of data linkage and furnishes a result that helps support GWAS. Our approach automatically extracts potentially linkable clinical features and modifies them in a way that they can no longer be used to link a genomic sequence to a small number of patients, while preserving the associations between genomic sequences and specific sets of clinical features corresponding to GWAS-related diseases. Extensive experiments with real patient data derived from the Vanderbilt's University Medical Center verify that our approach generates data that eliminate the threat of individual reidentification, while supporting GWAS validation and clinical case analysis tasks.T he decreasing cost of high-throughput sequencing technologies, in combination with the growing adoption of health information systems, has the potential to facilitate personalized medicine. Such technologies can generate a substantial quantity of detailed data, which can be mined to improve clinical diagnostics, as well as treatments, for a wide range of complex diseases (1). Notably, genome-wide association studies (GWAS) are increasingly applied to identify relationships between specific genomic variations and health-related phenomena; yet the cost associated with studies on populations that are large enough for sufficiently powered claims remains nontrivial (2). Consequentially, it is difficult for investigators to validate published associations. To overcome this problem, various regulations have been developed to encourage organizations to deposit data into repositories for reuse (3). The National Institutes of Health (NIH), for instance, recently defined a policy (4) stating that any GWAS data generated by, or studied with, NIH-sponsorship should be deposited in the Database of Genotypes and Phenotypes (dbGaP) (3) for broad dissemination. At the same time, the NIH acknowledges the need to maintain privacy standards and, thus, requires data to be deidentified. A typical deidentification strategy is based on the Safe Harbor standard of the Health Insurance Portability and Accountability Act (5), whereby records are stripped of a number of potential identifiers, such as personal names and geocodes.Electronic medical record (EMR) systems are increasingly recognized as an important resource for GWAS (6). They contain detailed pati...

Disease Diagnosis in Smart Healthcare: Innovation, Technologies and Applications

“…More important, researchers need medical data for carrying out data analysis, statistical analysis and machine learning applications. Common privacy-preserving methods include disclosure control [162,163], output perturbation [164,165] and anonymization [166,167].…”

Research data management: a conceptual framework

“…There are tools and techniques available to anonymize data like Datafly, k-anonymization and others. (Loukides et al, 2010) (Sweeney, 1998) (Sweeney, 2002) There are also methods through which data anonymization can be decrypted, for example, Sweeney et al, 2013 succeeded in breaking the data anonymization code in the personal genome project and were able to identify the participants in the project. Heffetz and Ligett, 2014 discuss a few cases, including the personal genome project (Sweeney et al, 2013), of unintentional privacy breaches where the research studies were presumed to maintain the privacy of the subjects, but later it was discovered that the participants where identifiable.…”

To Share or Not To Share: That Is Not the Question

“…T e liabilities involved on the part of data donors and users are high, and gigabyte networks are still limited to certain institutions. Although deidentif cation and privacy-protection algorithms can mitigate the conf dentiality problem (13)(14)(15)(16)(17), once data are downloaded there is no way to track their use, and there is still some risk of reidentif cation (18).…”