De-identifying Data Research Articles

A novel encryption protocol for facilitating de-identification of genomics health data

The exponential growth and affordability of genomics sequencing in the clinical landscape in recent years have intensified a challenge facing privacy experts. They grapple with how to evaluate and mitigate the significant risk of genomics data being used to re-identify individuals. The lack of clear genomics guidance in HIPAA has invited a wide spectrum of expert opinion from advocating for conservative limitations to be placed on genomics data sharing to ‘security’-based arguments that carefully calibrated technical, administrative, and legal safeguards may provide adequate protection in many cases. The need to weigh privacy concerns against the extraordinary value that genomics data offers to cancer and rare disease clinical research is compounded by the reality that conventional data modifications, such as redaction, aggregation, and perturbation, often critically undermine these important use cases. We present an innovative solution for de-identifying genomics data according to a conservative interpretation of HIPAA while still preserving maximal utility for clinical purposes. Our solution rejects the notion that privacy can be achieved directly via security. Instead, we introduce a reversible encryption protocol designed to be applied to specific combinations of genetic variants and their locations on the genome. The encrypted genomic data is fully de-identified, allowing researchers to perform analyses on the encrypted data in a secure Clean Room environment. The environment host is then able to decrypt and deliver variant-level summary statistics and aggregated outputs from the analysis to the recipient. As information in this format no longer links to patient-level data the solution remains de-identified end-to-end.

Exploring Freely Available Data Tools to Support Open Data and Open Science

ABSTRACT Librarians support researchers by promoting open science and open data practices. This article explores five freely available tools that support and facilitate open science practices. Open Science Framework provides a platform for project management, data sharing, and data storage. OpenRefine cleans and formats data. DMPTool has templates for data management and sharing plans that comply with funder mandates. The NIH Common Data Elements is a repository for standardized data elements, and finally, the NLM Scrubber is a tool for de-identifying clinical text data. Information professionals can add these tools to their repertoire and share them with researchers at their institution.

Open-Science Guidance for Qualitative Research: An Empirically Validated Approach for De-Identifying Sensitive Narrative Data

The open-science movement seeks to make research more transparent and accessible. To that end, researchers are increasingly expected to share de-identified data with other scholars for review, reanalysis, and reuse. In psychology, open-science practices have been explored primarily within the context of quantitative data, but demands to share qualitative data are becoming more prevalent. Narrative data are far more challenging to de-identify fully, and because qualitative methods are often used in studies with marginalized, minoritized, and/or traumatized populations, data sharing may pose substantial risks for participants if their information can be later reidentified. To date, there has been little guidance in the literature on how to de-identify qualitative data. To address this gap, we developed a methodological framework for remediating sensitive narrative data. This multiphase process is modeled on common qualitative-coding strategies. The first phase includes consultations with diverse stakeholders and sources to understand reidentifiability risks and data-sharing concerns. The second phase outlines an iterative process for recognizing potentially identifiable information and constructing individualized remediation strategies through group review and consensus. The third phase includes multiple strategies for assessing the validity of the de-identification analyses (i.e., whether the remediated transcripts adequately protect participants’ privacy). We applied this framework to a set of 32 qualitative interviews with sexual-assault survivors. We provide case examples of how blurring and redaction techniques can be used to protect names, dates, locations, trauma histories, help-seeking experiences, and other information about dyadic interactions.

A framework for de-identification of free-text data in electronic medical records enabling secondary use.

Clinical free-text data represent a vast, untapped source of rich information. If more accessible for research it would supplement information captured in structured fields. Data need to be de-identified prior to being reused for research. However, a lack of transparency with existing de-identification software tools makes it difficult for data custodians to assess potential risks associated with the release of de-identified clinical free-text data. This case study describes the development of a framework for releasing de-identified clinical free-text data in two local health districts in NSW, Australia. A sample of clinical documents (n = 14 768 965), including progress notes, nursing and medical assessments and discharge summaries, were used for development. An algorithm was designed to identify and mask patient names without damaging data utility. For each note, the algorithm output the (i) note length before and after de-identification, (ii) the number of patient names and (iii) the number of common words. These outputs were used to iteratively refine the algorithm performance. This was followed by manual review of a random subset of records by a health information manager. Notes that were not correctly de-identified were fixed, and performance was reassessed until resolution. All notes in this sample were suitably de-identified using this method. Developing a transparent method for de-identifying clinical free-text data enables informed-decision making by data custodians and the safe re-use of clinical free-text data for research and public benefit.

Research Goal-Driven Data Model and Harmonization for De-Identifying Patient Data in Radiomics.

There are various efforts in de-identifying patient's radiation oncology data for their uses in the advancement of research in medicine. Though the task of de-identification needs to be defined in the context of research goals and objectives, existing systems lack the flexibility of modeling data and normalization of names of attributes for accomplishing them. In this work, we describe a de-identification process of radiation and clinical oncology data, which is guided by a data model and a schema of dynamically capturing domain ontology and normalization of terminologies, defined in tune with the research goals in this area. The radiological images are obtained in DICOM format. It consists of diagnostic, radiation therapy (RT) treatment planning, RT verification, and RT response images. During the DICOM de-identification, a few crucial pieces of information are taken about the dataset. The proposed model is generic in organizing information modeling in sync with the de-identification of a patient's clinical information. The treatment and clinical data are provided in the comma-separated values (CSV) format, which follows a predefined data structure. The de-identified data is harmonized throughout the entire process. We have presented four specific case studies on four different types of cancers, namely glioblastoma multiforme, head-neck, breast, and lung. We also present experimental validation on a few patients' data in these four areas. A few aspects are taken care of during de-identification, such as preservation of longitudinal date changes (LDC), incremental de-identification, referential data integrity between the clinical and image data, de-identified data harmonization, and transformation of the data to an underlined database schema.

Attacker models with a variety of background knowledge to de-identified data

De-identification is a process to prevent individuals from being identified from original transaction data by processing personal identification information. For de-identifying data, we should consider the risk of attackers that try to infer personal information from given de-identified datasets. However, the characteristics of attackers are not known. Attackers could find the weakest records to identify the user who owns them. In the case of big data, there are too many attributes to identify the weakest parts to be protected. To address these issues, we propose a new model of attackers that gain background knowledge from an attribute of the transaction data and estimate the risk of re-identification from the statistics of the dataset, such as the number of records and the background number of users. We present empirical results on evaluating the risks of actual transaction data using our proposed risk model.

Use and Understanding of Anonymization and De-Identification in the Biomedical Literature: Scoping Review.

BackgroundThe secondary use of health data is central to biomedical research in the era of data science and precision medicine. National and international initiatives, such as the Global Open Findable, Accessible, Interoperable, and Reusable (GO FAIR) initiative, are supporting this approach in different ways (eg, making the sharing of research data mandatory or improving the legal and ethical frameworks). Preserving patients’ privacy is crucial in this context. De-identification and anonymization are the two most common terms used to refer to the technical approaches that protect privacy and facilitate the secondary use of health data. However, it is difficult to find a consensus on the definitions of the concepts or on the reliability of the techniques used to apply them. A comprehensive review is needed to better understand the domain, its capabilities, its challenges, and the ratio of risk between the data subjects’ privacy on one side, and the benefit of scientific advances on the other.ObjectiveThis work aims at better understanding how the research community comprehends and defines the concepts of de-identification and anonymization. A rich overview should also provide insights into the use and reliability of the methods. Six aspects will be studied: (1) terminology and definitions, (2) backgrounds and places of work of the researchers, (3) reasons for anonymizing or de-identifying health data, (4) limitations of the techniques, (5) legal and ethical aspects, and (6) recommendations of the researchers.MethodsBased on a scoping review protocol designed a priori, MEDLINE was searched for publications discussing de-identification or anonymization and published between 2007 and 2017. The search was restricted to MEDLINE to focus on the life sciences community. The screening process was performed by two reviewers independently.ResultsAfter searching 7972 records that matched at least one search term, 135 publications were screened and 60 full-text articles were included. (1) Terminology: Definitions of the terms de-identification and anonymization were provided in less than half of the articles (29/60, 48%). When both terms were used (41/60, 68%), their meanings divided the authors into two equal groups (19/60, 32%, each) with opposed views. The remaining articles (3/60, 5%) were equivocal. (2) Backgrounds and locations: Research groups were based predominantly in North America (31/60, 52%) and in the European Union (22/60, 37%). The authors came from 19 different domains; computer science (91/248, 36.7%), biomedical informatics (47/248, 19.0%), and medicine (38/248, 15.3%) were the most prevalent ones. (3) Purpose: The main reason declared for applying these techniques is to facilitate biomedical research. (4) Limitations: Progress is made on specific techniques but, overall, limitations remain numerous. (5) Legal and ethical aspects: Differences exist between nations in the definitions, approaches, and legal practices. (6) Recommendations: The combination of organizational, legal, ethical, and technical approaches is necessary to protect health data.ConclusionsInterest is growing for privacy-enhancing techniques in the life sciences community. This interest crosses scientific boundaries, involving primarily computer science, biomedical informatics, and medicine. The variability observed in the use of the terms de-identification and anonymization emphasizes the need for clearer definitions as well as for better education and dissemination of information on the subject. The same observation applies to the methods. Several legislations, such as the American Health Insurance Portability and Accountability Act (HIPAA) and the European General Data Protection Regulation (GDPR), regulate the domain. Using the definitions they provide could help address the variable use of these two concepts in the research community.

Dating and Sexual Violence Research in the Schools: Balancing Protection of Confidentiality with Supporting the Welfare of Survivors.

Rigorous research and program evaluation are needed to understand the experience of dating and sexual violence among youth and the impact of prevention and intervention efforts. Our dilemma in doing this work occurred when youth disclosed dating and sexual violence on a research survey. What responsibility do researchers have to protect survivors' confidentiality as a research participant versus taking steps to ensure the student has the opportunity to access help? In our evaluation of a pilot dating violence prevention program, our protocols employed widely used procedures for providing resources to participants upon their completion of the survey and de-identifying survey data. Upon reviewing preliminary survey results, we became concerned that these establishedprocedures were not sufficient to support research participants who were adolescent survivors of dating and sexual violence. We followed a structured ethical decision-making process to examine legal and ethical considerations, consult with colleagues, consider impacts and alternative solutions, and ultimately find a solution. Through this process, we developed procedures that balance participant confidentiality and the desire to support the welfare of survivors, which other researchers may want to employ when conducting youth sexual and dating violence research in school and community settings.

Clinical trial transparency: many gains but access to evidence for new medicines remains imperfect.

Although selective and incomplete publication is widely acknowledged to be a problem, full access to clinical trial data remains illusive. Authors' personal files, key documents from Food and Drug Administration and European Medicines Agency and focussed searches of PubMed. Existing sources of information provide an incomplete overview of scientific research. Persistent arguments about commercial confidentiality and the potential difficulties in de-identifying raw data can block important progress. Current industry efforts are voluntary and only partially satisfy the need for complete data. Requirements for trial registration are increasing. Important regulatory changes in particular in Europe have the potential to result in the release of more information. Documenting the effects of prospective trial registration and requirements for proactive clinical trial publication on healthcare decisions, public health and rational resource allocation.

An approach for de-identification of point locations of livestock premises for further use in disease spread modeling

We describe a method for de-identifying point location data used for disease spread modeling to allow data custodians to share data with modeling experts without disclosing individual farm identities. The approach is implemented in an open-source software program that is described and evaluated here. The program allows a data custodian to select a level of de-identification based on the K-anonymity statistic. The program converts a file of true farm locations and attributes into a file appropriate for use in disease spread modeling with the locations randomly modified to prevent re-identification based on location. Important epidemiological relationships such as clustering are preserved to as much as possible to allow modeling similar to those using true identifiable data. The software implementation was verified by visual inspection and basic descriptive spatial analysis of the output. Performance is sufficient to allow de-identification of even large data sets on desktop computers available to any data custodian.

The project data sphere initiative: accelerating cancer research by sharing data.

Background. Inthispaper,weprovidebackgroundandcontext regarding the potential for a new data-sharing platform, the ProjectDataSphere(PDS)initiative,fundedbyfinancialandinkind contributions from the CEO Roundtable on Cancer, to transform cancer research and improve patient outcomes. Giventherelativelymodestdeclineincancerdeath ratesover the past several years, a new research paradigm is needed to accelerate therapeutic approaches for oncologic diseases. Phase III clinical trials generate large volumes of potentially usable information, often on hundreds of patients, including patientstreatedwithstandardofcaretherapies(i.e.,controls). Both nationally and internationally, a variety of stakeholders have pursued data-sharing efforts to make individual patientlevel clinical trial data available to the scientific research community.

Building public trust in uses of Health Insurance Portability and Accountability Act de-identified data

ObjectivesThe aim of this paper is to summarize concerns with the de-identification standard and methodologies established under the Health Insurance Portability and Accountability Act (HIPAA) regulations, and report some potential policies to address those concerns that were discussed at a recent workshop attended by industry, consumer, academic and research stakeholders.Target audienceThe target audience includes researchers, industry stakeholders, policy makers and consumer advocates concerned about preserving the ability to use HIPAA de-identified data for a range of important secondary uses.ScopeHIPAA sets forth methodologies for de-identifying health data; once such data are de-identified, they are no longer subject to HIPAA regulations and can be used for any purpose. Concerns have been raised about the sufficiency of HIPAA de-identification methodologies, the lack of legal accountability for unauthorized re-identification of de-identified data, and insufficient public transparency about de-identified data uses. Although there is little published evidence of the re-identification of properly de-identified datasets, such concerns appear to be increasing. This article discusses policy proposals intended to address de-identification concerns while maintaining de-identification as an effective tool for protecting privacy and preserving the ability to leverage health data for secondary purposes.

SIG 13 Perspectives Vol. 20, No. 2, June 2011

SIG 13 Perspectives Vol. 20, No. 2, June 2011

An integrated framework for de-identifying unstructured medical data

While there is an increasing need to share medical information for public health research, such data sharing must preserve patient privacy without disclosing any information that can be used to identify a patient. A considerable amount of research in data privacy community has been devoted to formalizing the notion of identifiability and developing techniques for anonymization but are focused exclusively on structured data. On the other hand, efforts on de-identifying medical text documents in medical informatics community rely on simple identifier removal or grouping techniques without taking advantage of the research developments in the data privacy community. This paper attempts to fill the above gaps and presents a framework and prototype system for de-identifying health information including both structured and unstructured data. We empirically study a simple Bayesian classifier, a Bayesian classifier with a sampling based technique, and a conditional random field based classifier for extracting identifying attributes from unstructured data. We deploy a k-anonymization based technique for de-identifying the extracted data to preserve maximum data utility. We present a set of preliminary evaluations showing the effectiveness of our approach.

Needs Assessment for Functionalities in Electronic Health Record Systems in General Hospitals

As an electronic health record system is implementing in Korean health care sectors, concerns about key functionalities of electronic health record systems are increasing. The purpose of this study was to identify core functions and set the priority in electronic health record systems under the Korean contexts in order to assure and improve the quality of the systems. Methods: A survey was conducted using questionnaire developed by the study team based on literature review. The subjects were medical record administrators working at medical record department in general hospitals. Results: The response rate was 59.8%(55/92). The functions which more than ninety percent of subjects responded as necessary right now and/or in near future related to 'drug alert', 'clinical guideline', 'chronic disease management', 'automated real-time surveillance', 'coded data', 'result reporting', 'de-identifying data', 'disease registry', and 'provider-provider communication and connectivity'. Conclusion: The results showed the high prioritized functions were decision support and health information/data management.