Risk Of Re-identification Research Articles

The risk of re-identification remains high even in country-scale location datasets

SummaryAlthough anonymous data are not considered personal data, recent research has shown how individuals can often be re-identified. Scholars have argued that previous findings apply only to small-scale datasets and that privacy is preserved in large-scale datasets. Using 3 months of location data, we (1) show the risk of re-identification to decrease slowly with dataset size, (2) approximate this decrease with a simple model taking into account three population-wide marginal distributions, and (3) prove that unicity is convex and obtain a linear lower bound. Our estimates show that 93% of people would be uniquely identified in a dataset of 60M people using four points of auxiliary information, with a lower bound at 22%. This lower bound increases to 87% when five points are available. Taken together, our results show how the privacy of individuals is very unlikely to be preserved even in country-scale location datasets.

Using Synthetic Data to Replace Linkage Derived Elements: A Case Study.

While record linkage can expand analyses performable from survey microdata, it also incurs greater risk of privacy-encroaching disclosure. One way to mitigate this risk is to replace some of the information added through linkage with synthetic data elements. This paper describes a case study using the National Hospital Care Survey (NHCS), which collects patient records under a pledge of protecting patient privacy from a sample of U.S. hospitals for statistical analysis purposes. The NHCS data were linked to the National Death Index (NDI) to enhance the survey with mortality information. The added information from NDI linkage enables survival analyses related to hospitalization, but as the death information includes dates of death and detailed causes of death, having it joined with the patient records increases the risk of patient re-identification (albeit only for deceased persons). For this reason, an approach was tested to develop synthetic data that uses models from survival analysis to replace vital status and actual dates-of-death with synthetic values and uses classification tree analysis to replace actual causes of death with synthesized causes of death. The degree to which analyses performed on the synthetic data replicate results from analysis on the actual data is measured by comparing survival analysis parameter estimates from both data files. Because synthetic data only have value to the degree that they can be used to produce statistical estimates that are like those based on the actual data, this evaluation is an essential first step in assessing the potential utility of synthetic mortality data.

Data Sharing Under the General Data Protection Regulation: Time to Harmonize Law and Research Ethics?

The General Data Protection Regulation (GDPR) became binding law in the European Union Member States in 2018, as a step toward harmonizing personal data protection legislation in the European Union. The Regulation governs almost all types of personal data processing, hence, also, those pertaining to biomedical research. The purpose of this article is to highlight the main practical issues related to data and biological sample sharing that biomedical researchers face regularly, and to specify how these are addressed in the context of GDPR, after consulting with ethics/legal experts. We identify areas in which clarifications of the GDPR are needed, particularly those related to consent requirements by study participants. Amendments should target the following: (1) restricting exceptions based on national laws and increasing harmonization, (2) confirming the concept of broad consent, and (3) defining a roadmap for secondary use of data. These changes will be achieved by acknowledged learned societies in the field taking the lead in preparing a document giving guidance for the optimal interpretation of the GDPR, which will be finalized following a period of commenting by a broad multistakeholder audience. In parallel, promoting engagement and education of the public in the relevant issues (such as different consent types or residual risk for re-identification), on both local/national and international levels, is considered critical for advancement. We hope that this article will open this broad discussion involving all major stakeholders, toward optimizing the GDPR and allowing a harmonized transnational research approach.

Toward a Framework for Assessing Privacy Risks in Multi-Omic Research and Databases

While the accumulation and increased circulation of genomic data have captured much attention over the past decade, privacy risks raised by the diversification and integration of omics have been largely overlooked. In this paper, we propose the outline of a framework for assessing privacy risks in multi-omic research and databases. Following a comparison of privacy risks associated with genomic and epigenomic data, we dissect ten privacy risk-impacting omic data properties that affect either the risk of re-identification of research participants, or the sensitivity of the information potentially conveyed by biological data. We then propose a three-step approach for the assessment of privacy risks in the multi-omic era. Thus, we lay grounds for a data property-based, ‘pan-omic’ approach that moves away from genetic exceptionalism. We conclude by inviting our peers to refine these theoretical foundations, put them to the test in their respective fields, and translate our approach into practical guidance.

Enabling realistic health data re-identification risk assessment through adversarial modeling.

Re-identification risk methods for biomedical data often assume a worst case, in which attackers know all identifiable features (eg, age and race) about a subject. Yet, worst-case adversarial modeling can overestimate risk and induce heavy editing of shared data. The objective of this study is to introduce a framework for assessing the risk considering the attacker's resources and capabilities. We integrate 3 established risk measures (ie, prosecutor, journalist, and marketer risks) and compute re-identification probabilities for data subjects. This probability is dependent on an attacker's capabilities (eg, ability to obtain external identified resources) and the subject's decision on whether to reveal their participation in a dataset. We illustrate the framework through case studies using data from over 1000000 patients from Vanderbilt University Medical Center and show how re-identification risk changes when attackers are pragmatic and use 2 known resources for attack: (1) voter registration lists and (2) social media posts. Our framework illustrates that the risk is substantially smaller in the pragmatic scenarios than in the worst case. Our experiments yield a median worst-case risk of 0.987 (where 0 is least risky and 1 is most risky); however, the median reduction in risk was 90.1% in the voter registration scenario and 100% in the social media posts scenario. Notably, these observations hold true for a wide range of adversarial capabilities. This research illustrates that re-identification risk is situationally dependent and that appropriate adversarial modeling may permit biomedical data sharing on a wider scale than is currently the case.

Aligning Legal Definitions of Personal Information with the Computer Science of Identifiability

The computer science literature on identification of people using personal information paints a wide spectrum, from aggregate information that doesn’t contain information about individual people, to information that itself identifies a person. However, privacy laws and regulations often distinguish between only two types, often called personally identifiable information and de-identified information. We show that the collapse of this technological spectrum of identifiability into only two legal definitions results in the failure to encourage privacy-preserving practices. We propose a set of legal definitions that spans the spectrum. We start with anonymous information. Computer science has created anonymization algorithms, including differential privacy, that provide mathematical guarantees that a person cannot be identified. Although the California Consumer Privacy Act (CCPA) defines aggregate information, it treats aggregate information the same as de-identified information. We propose a definition of anonymous information based on the technological possibility of logical association of the information with other information. We argue for the exclusion of anonymous information from notice and consent requirements. We next consider de-identified information. Computer science has created de-identification algorithms, including generalization, that minimize (but not eliminate) the risk of re-identification. GDPR defines anonymous information but not de-identified information, and CCPA defines de-identified information but not anonymous information. The definitions do not align. We propose a definition of de-identified information based on the reasonableness of association with other information. We propose legal controls to protect against re-identification. We argue for the inclusion of de-identified information in notice requirements, but the exclusion of de-identified information from choice requirements. We next address the distinction between trackable and non-trackable information. Computer science has shown how one-time identifiers can be used to protect reasonably linkable information from being tracked over time. Although both GDPR and CCPA discuss profiling, neither formally defines it as a form of personal information, and thus both fail to adequately protect against it. We propose definitions of trackable information and non-trackable information based on the likelihood of association with information from other contexts. We propose a set of legal controls to protect against tracking. We argue for requiring stronger forms of user choice for trackable information, which will encourage the use of non-trackable information. Finally, we address the distinction between pseudonymous and reasonably identifiable information. Computer science has shown how pseudonyms can be used to reduce identification. Neither GDPR nor CCPA makes a distinction between pseudonymous and reasonable identifiable information. We propose definitions based on the reasonableness of identifiability of the information, and we propose a set of legal controls to protect against identification. We argue for requiring stronger forms of user choice for reasonably identifiable information, which will encourage the use of pseudonymous information. Our definitions of anonymous information, de-identified information, non-trackable information, trackable information, and reasonably identifiable information can replace the over-simplified distinction between personally identifiable information versus de-identified information. We hope that this full spectrum of definitions can be used in a comprehensive privacy law to tailor notice and consent requirements to the characteristics of each type of information.

Practitioners’ Corner ∙ Anonymisation and Re-Identification Risk for Voice Data

Practitioners’ Corner ∙ Anonymisation and Re-Identification Risk for Voice Data

Privacy-preserving IoT Framework for Activity Recognition in Personal Healthcare Monitoring

The increasing popularity of wearable consumer products can play a significant role in the healthcare sector. The recognition of human activities from IoT is an important building block in this context. While the analysis of the generated datastream can have many benefits from a health point of view, it can also lead to privacy threats by exposing highly sensitive information. In this article, we propose a framework that relies on machine learning to efficiently recognise the user activity, useful for personal healthcare monitoring, while limiting the risk of users re-identification from biometric patterns characterizing each individual. To achieve that, we show that features in temporal domain are useful to discriminate user activity while features in frequency domain lead to distinguish the user identity. We then design a novel protection mechanism processing the raw signal on the user’s smartphone to select relevant features for activity recognition and normalise features sensitive to re-identification. These unlinkable features are then transferred to the application server. We extensively evaluate our framework with reference datasets: Results show an accurate activity recognition (87%) while limiting the re-identification rate (33%). This represents a slight decrease of utility (9%) against a large privacy improvement (53%) compared to state-of-the-art baselines.

Using Reproducible Data Visualizations to Augment Decision-Making During Suppression of Small Counts

IntroductionWhen reporting disease rates to the public, a health system must take precaution to protect released data from re-identification risks. While specific guidelines and methods vary across data systems and governances 1 , redaction of cells with small values is a key component in any approach for preparing data for public release. These preparations, when conducted manually, have proven to be arduous, time consuming, and prone to human error. Although finding a “small” value (e.g. “< 5 ” ) is straightforward, detecting conditions in which suppressed values could be recalculated from related cells involves human judgement.
 Objectives and ApproachGuided by the real-world objective to reports the rates of chronic diseases in British Columbia, we aimed to design a reproducible workflow that would augment human decision-making and offer a nimble quality control tool, approachable by epidemiologists without technical background. Our workflow (1) splits data into disease-by-year data frames of a specific form, (2) applies a sequence of algorithms trained to recognize conditions that made recalculation of suppressed values possible and (3) prints a graph for each case of suggested automatic redaction to be confirmed by a human.
 ResultsThe augmented suppression system was successfully integrated into the maintenance of Chronic Disease Dashboard, an online reporting tool of the Observatory for Population and Public Health designed to address the gap in surveillance of chronic diseases in British Columbia. Anticipating the evolution of suppression logic, we isolated the logical tests responsible for redaction and provided several options to vary the degree of preserved information.
 Conclusion / ImplicationsInstead of employing a complex generalizable solution, we make a case for organizing the procedure for small cell redaction as a data visualization task, allowing for straightforward quality control of suppression decision and thus more approachable to a non-technical audience, as well as for employing such learning devices as workflow maps and function dependency trees for structuring applied projects and ensuring their reproducibility.

Re-identification of Health Data through Machine Learning

Startups and large technology companies are working with companies in healthcare to research, create, and deploy machine learning healthcare solutions. The growth of machine learning healthcare solutions is increasing the risk of re-identification of health data, raising concerns for individual privacy. Differential privacy is one of the latest and most popular anonymization techniques used on machine learning data to guarantee data privacy but is presenting challenges when applied to health data. The Health Insurance Portability and Accountability Act (HIPAA) has loopholes and does not address the use of machine learning on health data. This paper will explain why HIPAA needs to be amended to reduce the risk of re-identification due to the growth of machine learning in healthcare and the challenges presented in applying differential privacy. The paper will also discuss three possible proposals to amend HIPAA to reduce the risk of re-identification.

Proposal and Assessment of a De-Identification Strategy to Enhance Anonymity of the Observational Medical Outcomes Partnership Common Data Model (OMOP-CDM) in a Public Cloud-Computing Environment: Anonymization of Medical Data Using Privacy Models.

BackgroundDe-identifying personal information is critical when using personal health data for secondary research. The Observational Medical Outcomes Partnership Common Data Model (CDM), defined by the nonprofit organization Observational Health Data Sciences and Informatics, has been gaining attention for its use in the analysis of patient-level clinical data obtained from various medical institutions. When analyzing such data in a public environment such as a cloud-computing system, an appropriate de-identification strategy is required to protect patient privacy.ObjectiveThis study proposes and evaluates a de-identification strategy that is comprised of several rules along with privacy models such as k-anonymity, l-diversity, and t-closeness. The proposed strategy was evaluated using the actual CDM database.MethodsThe CDM database used in this study was constructed by the Anam Hospital of Korea University. Analysis and evaluation were performed using the ARX anonymizing framework in combination with the k-anonymity, l-diversity, and t-closeness privacy models.ResultsThe CDM database, which was constructed according to the rules established by Observational Health Data Sciences and Informatics, exhibited a low risk of re-identification: The highest re-identifiable record rate (11.3%) in the dataset was exhibited by the DRUG_EXPOSURE table, with a re-identification success rate of 0.03%. However, because all tables include at least one “highest risk” value of 100%, suitable anonymizing techniques are required; moreover, the CDM database preserves the “source values” (raw data), a combination of which could increase the risk of re-identification. Therefore, this study proposes an enhanced strategy to de-identify the source values to significantly reduce not only the highest risk in the k-anonymity, l-diversity, and t-closeness privacy models but also the overall possibility of re-identification.ConclusionsOur proposed de-identification strategy effectively enhanced the privacy of the CDM database, thereby encouraging clinical research involving multiple centers.

Generating high-fidelity synthetic patient data for assessing machine learning healthcare software

There is a growing demand for the uptake of modern artificial intelligence technologies within healthcare systems. Many of these technologies exploit historical patient health data to build powerful predictive models that can be used to improve diagnosis and understanding of disease. However, there are many issues concerning patient privacy that need to be accounted for in order to enable this data to be better harnessed by all sectors. One approach that could offer a method of circumventing privacy issues is the creation of realistic synthetic data sets that capture as many of the complexities of the original data set (distributions, non-linear relationships, and noise) but that does not actually include any real patient data. While previous research has explored models for generating synthetic data sets, here we explore the integration of resampling, probabilistic graphical modelling, latent variable identification, and outlier analysis for producing realistic synthetic data based on UK primary care patient data. In particular, we focus on handling missingness, complex interactions between variables, and the resulting sensitivity analysis statistics from machine learning classifiers, while quantifying the risks of patient re-identification from synthetic datapoints. We show that, through our approach of integrating outlier analysis with graphical modelling and resampling, we can achieve synthetic data sets that are not significantly different from original ground truth data in terms of feature distributions, feature dependencies, and sensitivity analysis statistics when inferring machine learning classifiers. What is more, the risk of generating synthetic data that is identical or very similar to real patients is shown to be low.

Canadian Association of Radiologists White Paper on De-Identification of Medical Imaging: Part 1, General Principles.

The application of big data, radiomics, machine learning, and artificial intelligence (AI) algorithms in radiology requires access to large data sets containing personal health information. Because machine learning projects often require collaboration between different sites or data transfer to a third party, precautions are required to safeguard patient privacy. Safety measures are required to prevent inadvertent access to and transfer of identifiable information. The Canadian Association of Radiologists (CAR) is the national voice of radiology committed to promoting the highest standards in patient-centered imaging, lifelong learning, and research. The CAR has created an AI Ethical and Legal standing committee with the mandate to guide the medical imaging community in terms of best practices in data management, access to health care data, de-identification, and accountability practices. Part 1 of this article will inform CAR members on principles of de-identification, pseudonymization, encryption, direct and indirect identifiers, k-anonymization, risks of reidentification, implementations, data set release models, and validation of AI algorithms, with a view to developing appropriate standards to safeguard patient information effectively.

Performance of Intensive Care Unit Severity Scoring Systems Across Different Ethnicities

Background: Despite wide utilisation of severity scoring systems for case-mix determination and benchmarking in the intensive care unit, the possibility of scoring bias across ethnicities has not been examined. Recent guidelines on the use of illness severity scores to inform triage decisions for allocation of scarce resources such as mechanical ventilation during the current COVID-19 pandemic warrant examination for possible bias in these models. We investigated the performance of three severity scoring systems (APACHE IVa, OASIS, SOFA) across ethnic groups in two large ICU databases in order to identify possible ethnicity-based bias.Method: Data from the eICU Collaborative Research Database and the Medical Information Mart for Intensive Care were analysed for score performance in Asians, African Americans, Hispanics and Whites after appropriate exclusions. Discrimination and calibration were determined for all three scoring systems in all four groups.Finding: While measurements of discrimination - area under the receiver operating characteristic curve (AUROC) - were significantly different among the groups, they did not display any discernible systematic patterns of bias. In contrast, measurements of calibration - standardised mortality ratio (SMR) - indicated persistent, and in some cases significant, patterns of difference between Hispanics and African Americans versus Asians and Whites. The differences between African Americans and Whites were consistently statistically significant. While calibrations were imperfect for all groups, the scores consistently demonstrated a pattern of over-predicting mortality for African Americans and Hispanics.Interpretation:The systematic differences in calibration across ethnic groups suggest that illness severity scores reflect bias in their predictions of mortality.Funding Statement: Funding: LAC is funded by the National Institute of Health through NIBIB R01 EB017205. There was no specific funding for this study.Declaration of Interests: RS received writing fees for healthcare reports from Crystallise UK Ltd. None of the other authors declare any conflict of interest.Ethics Approval Statement: Research using the eICU-CRD is exempt from institutional review board (IRB) approval due to the retrospective design, lack of direct patient intervention, and the security schema, for which the re-identification risk was certified as meeting safe harbour standards by an independent privacy expert (Privacert, Cambridge, MA) (Health Insurance Portability and Accountability Act Certification no. 1031219-2). The data in MIMIC-III has been previously de-identified, and the IRBs of the Massachusetts Institute of Technology (No. 0403000206) and BIDMC (2001-P-001699/14) both approved the use of the database for research.

Linking pre- and post-adoption records for research in anonymised form in a data safe haven: legal implications and support for a social licence.

IntroductionThe long-term health and wellbeing of adoptees is under-researched. One reason for this has been limited data accessibility regarding the adoption process, and another is a practice common in some UK jurisdictions of changing the National Health Service (NHS) number (or equivalent) at adoption, as part of creating the new identity. The SAIL Databank holds data on child and family court cases from Cafcass Cymru, together with children’s social care data, and can link these with routine health and administrative data in anonymised form. However, because the linkage key at SAIL is based on an encryption of the NHS number, working with pre- and post-adoption records for longitudinal research remains a major challenge. We set out to explore the legal implications of, and social support for, linking these records for use in anonymised form for longitudinal research.MethodsWe reviewed the main legislation and regulations governing the use of data about adoptees in England and Wales. We gauged support for a social licence in Wales by carrying out interviews with individuals who had been involved in the adoptions process, and by engaging with general public groups for their views. We drew out the main emerging themes and, in combination with the review, propose a way forward.ResultsThe legal review indicated that there are provisions in the Family Procedure Rules (England and Wales) and the General Data Protection Regulation that can be relied upon for the lawful processing of adoption data into anonymised form for research. The main points of concern about linking pre- and post-adoption records were privacy, data security, the need to limit the number of organisations involved in data sharing, and re-identification risk. The over-riding message was favourable with longitudinal research seen as strongly beneficial.ConclusionThis study has indicated that in Wales, there is no legal impediment, nor major objection from individuals involved in the adoptions process, or members of the general public, for the use of adoption data in anonymised form in a data safe haven. This includes the linkage of pre- and post-adoption records to enable novel longitudinal research to take place. The provisos were that robust safeguards must be in place, and that the research should aim to benefit adoptees and to improve policy and practice. We conclude that it is reasonable to proceed with caution to develop practical ways to link pre- and post-adoption records in a data safe haven.

UTM: A trajectory privacy evaluating model for online health monitoring

A huge amount of sensitive personal data is being collected by various online health monitoring applications. Although the data is anonymous, the personal trajectories (e.g., the chronological access records of small cells) could become the anchor of linkage attacks to re-identify the users. Focusing on trajectory privacy in online health monitoring, we propose the User Trajectory Model (UTM), a generic trajectory re-identification risk predicting model to reveal the underlying relationship between trajectory uniqueness and aggregated data (e.g., number of individuals covered by each small cell), and using the parameter combination of aggregated data to further mathematically derive the statistical characteristics of uniqueness (i.e., the expectation and the variance). Eventually, exhaustive simulations validate the effectiveness of the UTM in privacy risk evaluation, confirm our theoretical deductions and present counter-intuitive insights.

Access to data from clinical trials in the COVID-19 crisis: open, flexible, and time-sensitive

- There is a great need to swiftly develop vaccines and treatments against COVID-19 in the current pandemic. Yet, the time pressure and difficult circumstances to conduct clinical trials increases the risk of incomplete data sets, suboptimal study designs, and thus spurious results and reversals of decisions. - Open access to clinical trial and other patient-relevant data is necessary in order to provide transparency, and the possibility for validating clinical-trial analyses, and fully exploiting the information emerging from clinical trials. Thus, open access is critical in order to enable the successful and swift development of an effective intervention.

Ethical, Legal, and Social Issues (ELSI) of Responsible Data Sharing Involving Children in Genomics: A Systematic Literature Review of Reasons

Background Progress in precision medicine relies on the access to, use of, and exchange of genomic and associated clinical data, including from children. The ethical, legal, and social issues (ELSI) of such data access, use, and exchange may be accentuated in the pediatric context due in part to the highly sensitive nature of genomic data, children’s consent-related vulnerabilities, and uncertain risks of reidentification. Systematic analyses of the ELSI and scientific reasons for why and how genomic data may be shared responsibly are, however, limited. Methods: We conducted a modified systematic review of reasons according to Sofaer and Strech to examine the ELSI and scientific reasons for “responsible” sharing of children’s genomic and associated clinical data. Empirical articles, commentaries, and data-sharing policies indexed in Medline, Scopus, Web of Science, and BIOSIS were included in the analysis if they discussed ELSI and were published between 2003 and 2017 in English. Results: One hundred and fifty-one records met our inclusion criteria. We identified 11 unique reasons and 8 subreasons for why children’s genomic data should or should not be shared. Enhancing the prospect of direct and indirect benefits and maximizing the utility of children’s data were top reasons why data should be shared. Inadequate data privacy protection was the leading reason why it should not. We furthermore identified 8 reasons and 30 subreasons that support conditional data sharing, in which recontact for the continued use of children’s data once they reach the age of majority was the most frequently endorsed condition. Conclusions: The complete list of ELSI reasons and responsible conditions provides an evidentiary basis upon which institutions can develop data-sharing policies. Institutions should encourage the sharing of children’s data to advance genomic research, while heeding special reconsent and data protection mechanisms that may help mitigate uncertain longitudinal risks for children and families.

Media content analysis of general practitioners’ reactions to care.data expressed in the media: what lessons can be learned for future NHS data-sharing initiatives?

ObjectivesCare.data was a 2013 UK government initiative to extract patient data from general practices in England to form a centralised whole-population database for service planning and health research. After a...

Participation in patient support forums may put rare disease patient data at risk of re-identification

BackgroundRare disease patients often struggle to find both medical advice and emotional support for their diagnosis. Consequently, many rare disease patient support forums have appeared on hospital webpages, social media sites, and on rare disease foundation sites. However, we argue that engagement in these groups may pose a healthcare data privacy threat to many participants, since it makes a series of patient indirect identifiers ‘readily available’ in combination with rare disease conditions. This information produces a risk of re-identification because it may allow a motivated attacker to use the unique combination of a patient’s identifiers and disease condition to re-identify them in anonymized data.ResultsTo assess this risk of re-identification, patient direct and indirect identifiers were mined from patient support forums for 80 patients across eight rare diseases. This data mining consisted of scanning patient testimonials, social media sites, and public records for the collection of identifiers linked to a rare disease patient. The number of people in the United States that may share each patient’s combination of marital status, 3-digit ZIP code, age, and sex, as well as their rare disease condition, was then estimated, as such information is commonly found in health records which have undergone de-identification by HIPAA’s ‘Safe Harbor.’ The study showed that by these estimations, nearly 75% of patients could be at high risk for re-identification in healthcare datasets in which they appear, due to their unique combination of identifiers.ConclusionsThe results of this study show that these rare disease patients, due to their choice to provide support for their community, are putting all their healthcare data at risk of re-identification. This paper demonstrates how simple adjustments to participation guidelines in such support forums, in combination with improved privacy measures at the organizational level, could mitigate this risk of re-identification. Additionally, this paper suggests the potential for future investigation into consideration of certain ‘risky’ International Classification of Diseases (ICD) codes as quasi-identifiers in de-identified datasets to further protect patients’ privacy, while maintaining the utility of such rare disease support groups.