COAT: COnstraint-based anonymization of transactions

Loukides, Grigorios; Gkoulalas-Divanis, Aris; Malin, Bradley

doi:10.1007/s10115-010-0354-4

Cited by 49 publications

(108 citation statements)

References 58 publications

Supporting

Mentioning

106

Contrasting

Order By: Relevance

“…This algorithmic design choice clearly reflects the semantics of utility constraints, which dictate that a group of records that is "too" generalized is useless for analysis, and it is consistent with prior work [46,47,48]. An alternative design choice is to relax Requirements 1 and 4 of Problem 1 progressively, as the algorithm is being executed, and let the data owner decide when the produced anonymized dataset is useful for them (i.e., it has acceptable N CP a sufficiently low number of suppressed diagnosis codes).…”

Section: Adaptation Of Art U C Based On Progressive Relaxation Of Reqmentioning

confidence: 59%

“…That is, a query asks for the number of patients with certain demographics that are diagnosed with a set of one or more diagnosis codes. A similar setting involving only diagnosis codes was considered in [46,47,70].…”

Section: Generalization Suppression and Data Utility Quantificationmentioning

confidence: 99%

“…To measure the amount of information loss, there are various utility measures that are applicable to demographics [4,22,39,79] or diagnosis codes [30,47,72]. For demographics, we use the NCP (Normalized Certainty Penalty) measure [79], due to its flexibility in dealing with both numerical and categorical demographic attributes and its ability to accurately quantify the uncertainty in interpreting generalized values [79].…”

Section: Generalization Suppression and Data Utility Quantificationmentioning

confidence: 99%

“…al [44] showed that 96% of 2700 patients, who are involved in an NIH-funded GWAS, are uniquely re-identifiable based on their set of diagnosis codes. In response, various methods have been proposed to prevent identity disclosure when publishing Email addresses: poulis@uop.gr (Giorgos Poulis), gloukides@acm.org (Grigorios Loukides), spiros@uop.gr (Spiros Skiadopoulos), gkoulala@us.ibm.com (Aris Gkoulalas-Divanis) a dataset that contains demographic attributes (e.g., [16,39,64,79]), or diagnosis codes (e.g., [24,31,47,70]). …”

Section: Introductionmentioning

confidence: 99%

“…In fact, a major concern in healthcare data publishing is identity disclosure (or re-identification), an attack in which patients are linked with their records in the published dataset. Identity disclosure can be performed, even when the published dataset is devoid of direct identifiers (e.g., patient phone numbers), due to the availability of external data sources that can be linked to the published dataset, based on demographics [67] or diagnosis codes [47]. For example, Sweeney estimated that 87% of US citizens can be re-identified based on gender, date of birth, and ZIP code, while Golle [27] estimated this percentage as 63%, using newer, Census 2000 data.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

Anonymizing datasets with demographics and diagnosis codes in the presence of utility constraints

Poulis

Loukides

Skiadopoulos

et al. 2017

Journal of Biomedical Informatics

Self Cite

View full text Add to dashboard Cite

Publishing data about patients that contain both demographics and diagnosis codes is essential to perform large-scale, low-cost medical studies. However, preserving the privacy and utility of such data is challenging, because it requires: (i) guarding against identity disclosure (re-identification) attacks based on both demographics and diagnosis codes, (ii) ensuring that the anonymized data remain useful in intended analysis tasks, and (iii) minimizing the information loss, incurred by anonymization, to preserve the utility of general analysis tasks that are difficult to determine before data publishing. Existing anonymization approaches are not suitable for being used in this setting, because they cannot satisfy all three requirements. Therefore, in this work, we propose a new approach to deal with this problem. We enforce the requirement (i) by applying (k, k m )-anonymity, a privacy principle that prevents re-identification from attackers who know the demographics of a patient and up to m of their diagnosis codes, where k and m are tunable parameters. To capture the requirement (ii), we propose the concept of utility constraint for both demographics and diagnosis codes. Utility constraints limit the amount of generalization and are specified by data owners (e.g., the healthcare institution that performs anonymization). We also capture requirement (iii), by employing well-established information loss measures for demographics and for diagnosis codes. To realize our approach, we develop an algorithm that enforces (k, k m )-anonymity on a dataset containing both demographics and diagnosis codes, in a way that satisfies the specified utility constraints and with minimal information loss, according to the measures. Our experiments with a large dataset containing more than 200, 000 electronic health records show the effectiveness and efficiency of our algorithm.

show abstract

Section: Adaptation Of Art U C Based On Progressive Relaxation Of Reqmentioning

confidence: 59%

Section: Generalization Suppression and Data Utility Quantificationmentioning

confidence: 99%