Utility-Aware Anonymization of Diagnosis Codes

Abstract

The growing need for performing large-scale and low-cost biomedical studies has led organizations to promote the reuse of patient data. For instance, the National Institutes of Health in the US requires patient-specific data collected and analyzed in the context of Genome-Wide Association Studies (GWAS) to be deposited into a biorepository and broadly disseminated. While essential to comply with regulations, disseminating such data risks privacy breaches, because patients genomic sequences can be linked to their identities through diagnosis codes. This work proposes a novel approach that prevents this type of data linkage by modifying diagnosis codes to limit the probability of associating a patients identity to their genomic sequence. Our approach employs an effective algorithm that uses generalization and suppression of diagnosis codes to preserve privacy and takes into account the intended uses of the disseminated data to guarantee utility. We also present extensive experiments using several datasets derived from the Electronic Medical Record (EMR) system of the Vanderbilt University Medical Center, as well as a large-scale case-study using the EMRs of 79K patients, which are linked to DNA contained in the Vanderbilt University biobank. Our results verify that our approach generates anonymized data that permit accurate biomedical analysis in tasks including case count studies and GWAS.

Anonymizing datasets with demographics and diagnosis codes in the presence of utility constraints

“…Incognito [38] k-anonymity Generalization/Suppression Genetic [34] k-anonymity Generalization Mondrian [39] k-anonymity Generalization TDS [20] k-anonymity Generalization Greedy [78] k-anonymity Generalization Hilb [21] k-anonymity Generalization MDAV [73] k-anonymity Microaggregation CBFS [37] k-anonymity Microaggregation Incognito with -diversity [51] -diversity Generalization / Suppression Mondrian with -diversity [77] -diversity Generalization Anatomize [76] -diversity Bucketization Incognito with τ -closeness [42] τ -closeness Generalization / Suppression Mondrian with τ -closeness [43] τ -closeness Generalization Apriori [71] k m -Anonymity Generalization Disassociation [50] k m -Anonymity Disassociation UGACLIP [46] Privacy-constrained anonymity Generalization/Suppression CBA [45] Privacy-constrained anonymity Generalization/Suppression Greedy [80] (h, k, p)-Coherence Suppression SuppressControl [5] ρ-Uncertainty Suppression TDControl [5] ρ-Uncertainty Generalization/Suppression RBAT [48] P S-rule based anonymity Generalization Tree-based [49] P S-rule based anonymity Generalization Sample-based [49] P S-rule based anonymity Generalization PartialSuppression [35] ρ-Uncertainty Suppression Table 2: Algorithms applicable on diagnosis codes.…”

“…Loukides et al also proposed the UGACLIP and CBA algorithms in [46] and [45], respectively. These algorithms apply generalization and suppression, and they aim to prevent re-identification based on specific sets of diagnosis codes that are provided as input.…”

“…Various epidemiological [11,26,62] and cancer research [36] studies are based on data containing demographics and diagnosis codes of patients in New South Wales (NSW), Australia. For example, the study of [36] used the data of women over 45 who are associated with certain diagnosis and procedural codes indicating invasive breast cancer. These data were obtained from the NSW Cancer Registry and from several routinely-collected administrative and self-reported health datasets in NSW, and they were analyzed to find out their predictive power in identifying invasive breast cancer cases.…”

“…Age, Origin and Gender are demographic attributes, and Disease is a set containing diagnosis codes, whose description is presented in Figure 2. The dataset in Figure 1b was produced by applying the method of [78] on the demographic attributes and the method of [45] on Disease. In particular, the latter dataset satisfies 2-anonymity [67] and 2 2 -anonymity [50,71], because no record contains a unique combination of demographic values, or a unique combination of two or fewer diagnosis codes (the result of generalizing diagnosis codes is enclosed in () and interpreted as any combination of the codes).…”

“…To this end, the algorithm first selects the cluster C UL that has the minimum UL when the diagnosis codes are anonymized (Step 19). The anonymization is performed by an adaptation of the CBA algorithm [45] (see Section 2.2). Our adaptation enforces k m -anonymity to a cluster of records, instead of preventing re-identification based on the specified sets of diagnosis codes as CBA does (a detailed explanation is provided in Appendix A).…”