A Globally Optimal k-Anonymity Method for the De-Identification of Health Data

Journal of the American Medical Informatics Association

Volumn 16, Issue 5, 2009, Pages 670-682

  El Emam, Khaled ^a,b   Dankar, Fida Kamal ^a   Issa, Romeo ^c   Jonker, Elizabeth ^a   Amyot, Daniel ^b   Cogo, Elise ^a   Corriveau, Jean Pierre ^c   Walker, Mark ^d   Chowdhury, Sadrul ^b   Vaillancourt, Regis ^a   Roffey, Tyson ^a   Bottomley, Jim ^a  

^a CHILDREN S HOSPITAL OF EASTERN ONTARIO   (Canada)

^b UNIVERSITY OF OTTAWA   (Canada)

^c CARLETON UNIVERSITY   (Canada)

^d OTTAWA HOSPITAL RESEARCH INSTITUTE   (Canada)

Author keywords

[No Author keywords available]

Indexed keywords

ARTICLE; CLASSIFICATION ALGORITHM; INFORMED CONSENT; MEDICAL INFORMATION SYSTEM; REGISTER;

ADOLESCENT; ADULT; ALGORITHMS; CONFIDENTIALITY; FEMALE; HUMANS; INFORMATION STORAGE AND RETRIEVAL; MALE; MEDICAL RECORDS SYSTEMS, COMPUTERIZED;

EID: 69549114557     PISSN: 10675027     EISSN: None     Source Type: Journal    
DOI: 10.1197/jamia.M3144     Document Type: Article

References (85)

1. Ness R. Influence of the HIPAA privacy rule on health research. J Am Med Assoc 298 18 (2007) 2164-2170
2. Institute of Medicine. Health research and the privacy of health information-The HIPAA privacy rule, 2008. http://www.iom.edu/CMS/3740/43729.aspx Accessed August 4, 2009
3. Institute of Medicine (2006) Effect of the HIPAA privacy rule on health research: Proceedings of a workshop presented to the National Cancer Policy Forum
4. Association of Academic Health Centers. HIPAA creating barriers to research and discovery (2008)
5. Wilson J. Health insurance portability and accountability Act privacy rule causes ongoing concerns among clinicians and researchers. Ann Intern Med 145 4 (2006) 313-316
6. Walker D. Impact of the HIPAA Privacy Rule on Health Services Research, Abt Associates, Inc for the Agency for Healthcare Research and Quality (2005)
7. Hanna K. The privacy rule and research: Protecting privacy at what cost?. Res Pract 8 1 (2007) 4-11
8. Association of American Medical Colleges. Testimony on behalf of the Association of American Medical Colleges before the National Committee on Vital and Health Statistics Subcommittee on Privacy (2003)
9. Friedman D. HIPAA and research: How have the first two years gone?. Am J Opthalmol 141 3 (2006) 543-546
10. Nosowsky R., and Giordano T. The health insurance portability and accountability Act of 1996 (HIPAA) privacy rule: Implications for clinical research. Am Med Rev 57 (2006) 575-590
11. Hiatt R. HIPAA: The end of epidemiology, or a new social contract?. Epidemiology 14 6 (2003) 637-639
12. Erlen J. HIPAA-Implications for research. Orthop Nurs 24 2 (2005) 139-142
13. Kulynych J., and Korn D. The effect of the new federal medical privacy rule on research. N Engl J Med 346 3 (2002) 201-204
14. O'Herrin J., Fost N., and Kudsk K. Health insurance portability and accountability Act (HIPAA) regulations: Effect on medical record research. Ann Surg 239 6 (2004) 772-778
15. National Cancer Institute. National Cancer Advisory Board. The HIPAA Privacy Rule: Feedback from NCI Cancer Centers, Cooperative Groups and Specialized Programs of Research Excellence, SPOREs (2003)
16. Shalowitz D. Informed consent for research and authorization under the Health Insurance Portability and Accountability Act Privacy Rule: An integrated approach. Ann Intern Med 144 9 (2006) 685-688
17. The Academy of Medical Sciences. Personal data for public good: using health information in medical research (2006)
18. Steinberg M., and RUbin E. The HIPAA Privacy Rule: Lacks Patient Benefit, Impedes Patient Growth (2009), Association of Academic Health Centers
19. Harris AL A.R., and Teschke K.E. Personal privacy and public health: Potential impacts of privacy legislation on health research in Canada. Can J Pub Health (2008) 293-296 July-August, 2008
20. Kosseim P., and Brady M. Policy by procrastination: Secondary use of electronic health records for health research purposes. McGil. J Law Health (2008) 2
21. Lowrance W. Learning from experience: Privacy and the secondary use of data in health research. J Health Serv Res Policy 8 S1 (2003) 2-7
22. Willison D., Emerson C., Szala-Meneok K., et al. Access to medical records for research purposes: Varying perceptions across Research Ethics Boards. J Med Ethics 34 (2008) 308-314
23. Samarati P., and Sweeney L. Protecting Privacy When Disclosing Information: k-anonymity and its enforcement through generalisation and suppression (1998), SRI International
24. Samarati P. Protecting respondents' identities in microdata release. IEEE Trans Knowl Data Eng 13 6 (2001) 1010-1027
25. Sweeney L. Achieving k-anonymity privacy protection using generalization and suppression. Int J Uncertainty, Fuzziness and Knowl-Based Syst 10 5 (2002) 571-588
26. Ciriani V., De Capitani di Vimercati S.S.F., and Samarati P. k-anonymity. Secure Data Management in Decentralized Systems (2007), Springer
27. st International Conference on Data Engineering
28. Iyengar V. Transforming data to satisfy privacy constraints (2002) Proceedings of the ACM SIGKDD International Conference on Data Mining and Knowledge Discovery
29. rd International Conference on Data Engineering
30. Xu J., Wang W., Pei J., et al. Utility-based anonymization using local recoding (2006) ACM SIGKDD International Conference on Knowledge Discovery and Data Mining
31. Wong R., Li J., Fu A., and Wang K. (Alpa, k)-anonymity: An enhanced k-anonymity model for privacy-preserving data publishing (2006) ACM SIGKDD International Conference on Knowledge Discovery and Data Mining
32. Aggarwal G., Feder T., Kenthapadi K., et al. Approximation algorithms for k-anonymity. Journal of Privacy Technology (2005)
33. Dalenius T. Finding a needle in a haystack or identifying anonymous census records. J Off Stat 2 3 (1986) 329-336
34. El Emam K., Brown A., and Abdelmalik P. Evaluating predictors of geographic area population size cutoffs to manage re-identification risk. J Am Med Inform Assoc 16 2 (2009) 256-266
35. El Emam K., Jabbouri S., Sams S., Drouet Y., and Power M. Evaluating common de-identification heuristics for personal health information. J Med Internet Res 8 4 (2006) e28
36. El Emam K., Jonker E., Sams S., et al. Pan-Canadian de-identification guidelines for Personal health information (report prepared for the office of the privacy commissioner of Canada), 2007. Archived at: http://www.webcitation.org/5Ow1Nko5C]. http://www.ehealthinformation.ca/documents/OPCReportv11.pdf Accessed August 4, 2009
37. Canadian Institutes of Health Research. CIHR Best Practices for Protecting Privacy in Health Research (2005), Canadian Institutes of Health Research
38. ISO/TS 25,237. Health Informatics: Pseudonymization (2008)
39. El Emam K., and Dankar F. Protecting privacy using k-anonymity. J Am Med Inform Assoc 15 (2008) 627-637
40. Trottini M. Assessing Disclosure Risk and Data Utility: A Multiple Objectives Decision Problem. Joint, ECE/Eurostat work session on statistical data confidentiality (2003)
41. Canadian Institutes for Health Research. Guidelines for protecting privacy and confidentiality in the design, conduct and evaluation of health research (2004), Canadian Institutes for Health Research
42. Gionis A.Tassa.T. k-Anonymization with minimal loss of information. IEEE Trans Knowl Data Eng 21 2 (2009) 206-219
43. Kim J., and Curry J. The treatment of missing data in multivariate analysis. Soc Methods and Res 6 (1977) 215-240
44. Little R., and Rubin D. Statistical Analysis with Missing Data (1987), John Wiley & Sons
45. Domingo-Ferrer J., and Vicenc T. Risk assessment in statistical microdata protection via advanced record linkage. J Stat Comput 13 4 (2003)
46. Sweeney L. Achieving k-anonymity privacy protection using generalization and suppression. Int. J Uncertainty, Fuzziness and Knowl-Based Syst 10 5 (2002) 18
47. Sweeney L. Computational Disclosure Control: A Primer on Data Privacy Protection (2001), Massachusetts Institute of Technology
48. nd International Conference on Data Engineering
49. Hore B., Jammalamadaka R., and Mehrotra S. Flexible anonymization for privacy preserving data publishing: A systematic search based approach (2007) Proceedings of the SIAM International Conference on Data Mining
50. Xu J., Wang W., Pei J., et al. Utility-based anonymization for privacy preservation with less information loss. ACM SIGKDD Explor Newsl 8 2 (2006) 21-30
51. Nergiz M., and Clifton C. Thoughts on k-anonymization. Second international workshop on privacy (2006), Data Manag
52. Polettini S. A Note on the Individual Risk of Disclosure (2003), Istituto Nazionale di Statistica [Italy]
53. Machanavajjhala A., Gehrke J., Kifer D., and Venkitasubramaniam M. L-diversity: Privacy beyond k-anonymity (2006) Proceedings of the International Conference on Data Engineering
54. st International Conference on Data Engineering
55. Li T., and Li N. Data privacy through optimal k-Anonymization (2006) Proceedings of the Sixth IEEE International Conference on Data Mining
56. de Waal T., and Willenborg L. Information loss through global recoding and local suppression. Neth Off Statistics 14 (1999) 17-20
57. Willenborg L., and de Waal T. Elements of Statistical Disclosure Control (2001), Springer-Verlag
58. Domingo-Ferrer J., and Vicenc T. Disclosure control methods and information loss for microdata. In: Doyle P., et al. (Ed). Confidentiality, Disclosure, and Data Access: Theory and Practical Applications for Statistical Agencies (2001), Elsevier
59. Sweeney L. Computational Disclosure Control for Medical Microdata: The Datafly System. Record Linkage Techniques (1997), National Academy Press
60. Sweeney L. Guaranteeing anonymity when sharing medical data: The Datafly system (1997) Proceedings of the American Medical Informatics Association Symposium
61. Ciriani V., De Capitani di Vimercati S., Foresti S., and Samarati P. k-Anonymity. Secure Data Management in Decentralized Systems (2007), Springer
62. LeFevre K., DeWitt D., and Ramakrishnan R. Incognito: Efficient full domain k-anonymity (2005) International Conference of the ACM Special Interest Group on Management of Data
63. Sweeney L. Uniqueness of Simple Demographics in the US Population (2000), Carnegie Mellon University, Laboratory for International Data Privacy
64. Ochoa S., Rasmussen J., Robson C., and Salib M. Reidentification of Individuals in Chicago's Homicide Database: A Technical and Legal Study (2001), Massachusetts Institute of Technology
65. El Emam K., Dankar F., Vaillancourt R., Roffey T., and Lysyk M. Evaluating patient re-identification risk from hospital prescription records. Can J Hosp Pharm 62 4 (2009) 307-319
66. Duncan G., Jabine T., and de Wolf S. Private Lives and Public Policies: Confidentiality and accessibility of Government Statistics (1993), National Academies
67. de Waal A., and Willenborg L. A view on statistical disclosure control for microdata. Surv Methodol 22 1 (1996) 95-103
68. Office of the Privacy Commissioner of Quebec (CAI). Chenard v. Ministere de L'Agriculture, des Pecheries et de L'Alimentation (1997) vol 141
69. National Center for Education Statistics. NCES Statistical Standards (2003), US Department of Education
70. Cancer Care Ontario Data Use and Disclosure Policy. Cancer Care Ont. http://www.cancercare.on.ca/common/pages/UserFile.aspx?fileId=13234 Accessed August 4, 2009
71. Security and confidentiality policies and procedures (2004), Health Quality Council
72. Privacy code (2004), Health Quality Council
73. Privacy Code (2002), Manitoba Center for Health Policy
74. Subcommittee on Disclosure Limitation Methodology. Federal Committee on Statistical Methodology. Working Paper 22, Report on statistical disclosure control (1994), Office of Management and Budget
75. Statistics Canada. Therapeutic abortion survey, 2007. Archived at: http://www.webcitation.org/5VkcHLeQw. http://www.statcan.ca/cgi-bin/imdb/p2SV.pl?Function=getSurvey&SDDS=3209&lang=en&db=IMDB&dbg=f&adm=8&dis=2#b9 Accessed August 4, 2008
76. Office of the Information and Privacy Commissioner of British Columbia. Order (1998) 261-1998
77. Office of the Information and Privacy Commissioner of Ontario. Order P-644 (1994). http://www.ipc.on.ca/images/Findings/Attached_PDF/P-644.pdf Accessed August 4, 2009
78. Alexander L., and Jabine T. Access to social security microdata files for research and statistical purposes. Soc Sec Bull 41 8 (1978) 3-17
79. Ministry of Health. And Long term care (Ontario). Corporate Policy 3/1/2021 (1984)
80. Goldreich O. Computational Complexity (2008), Cambridge University Press
81. El Emam K. Software Inspection Best Practices, Cutter Consortium (2001) (E-Project Management Advisory Service)
82. El Emam K. The ROI from Software Quality, CRC Press (2005) (Auerbach)
83. th, International Conference on Database Theory (ICDT05)
84. Adam N., and Wortman J. Security-control methods for statistical databases: A comparative study. ACM Comput Surv 21 4 (1989) 515-556
85. Federal Committee on Statistical Methodology. Report on Statistical Disclosure Limitation Methodology (2005), Office of Management and Budget