Evaluating Common De-Identification Heuristics for Personal Health Information

Abstract

Background With the growing adoption of electronic medical records, there are increasing demands for the use of this electronic clinical data in observational research. A frequent ethics board requirement for such secondary use of personal health information in observational research is that the data be de-identified. De-identification heuristics are provided in the Health Insurance Portability and Accountability Act Privacy Rule, funding agency and professional association privacy guidelines, and common practice.Objective The aim of the study was to evaluate whether the re-identification risks due to record linkage are sufficiently low when following common de-identification heuristics and whether the risk is stable across sample sizes and data sets.Methods Two methods were followed to construct identification data sets. Re-identification attacks were simulated on these. For each data set we varied the sample size down to 30 individuals, and for each sample size evaluated the risk of re-identification for all combinations of quasi-identifiers. The combinations of quasi-identifiers that were low risk more than 50% of the time were considered stable.Results The identification data sets we were able to construct were the list of all physicians and the list of all lawyers registered in Ontario, using 1% sampling fractions. The quasi-identifiers of region, gender, and year of birth were found to be low risk more than 50% of the time across both data sets. The combination of gender and region was also found to be low risk more than 50% of the time. We were not able to create an identification data set for the whole population.Conclusions Existing Canadian federal and provincial privacy laws help explain why it is difficult to create an identification data set for the whole population. That such examples of high re-identification risk exist for mainstream professions makes a strong case for not disclosing the high-risk variables and their combinations identified here. For professional subpopulations with published membership lists, many variables often needed by researchers would have to be excluded or generalized to ensure consistently low re-identification risk. Data custodians and researchers need to consider other statistical disclosure techniques for protecting privacy.

Patient characteristics, resource use and outcomes associated with general internal medicine hospital care: the General Medicine Inpatient Initiative (GEMINI) retrospective cohort study

“…We used a secure hash algorithm using patient health insurance number to track de-identified patients across sites. 11,12 Administrative health data…”

Evaluating the Risk of Re-identification of Patients from Hospital Prescription Records

“…The risk of re-identification by this means is called "journalist re-identification risk". 21 In this case, the intruder needs an external database, known as an identification database, 22 against which to compare the prescription database. In effect, the identification database contains background information about many patients.…”

“…22 For patients who are youth (generally 18 years of age or younger), there are few publicly available and easily accessible government databases (federal, provincial, or municipal) containing pertinent quasi-identifiers, since they do not own property, borrow money, have telephones in their own names, or vote. 22 However, the membership of sports teams is often publicly available (e.g., an Internet search using the term "youth roster birth" will generate lists of sports teams, along with dates of birth), and many of these lists contain detailed demographic information about the team members. Furthermore, youth increasingly reveal basic demographic information about themselves on blogs and social networking websites, such as Facebook.…”

A Survey of Privacy-Preserving Techniques for Reuse of Distributed Health Data (Preprint)

“…The other approach that is getting an increasing interest to provide a secure access to sensitive data is data safe haven (DSH; analogous to virtual data laboratory and data enclave) where a dataset is stored in a secure computing environment, and the data users get readonly access via secure access sites and/or remote connection. A data user may view microdata and conduct data manipulations and statistical analysis, but the dataset cannot be taken out of the secure environment and analyses results are evaluated for disclosure risk before leaving the secure environment [94,95].…”