Methods for the de-identification of electronic health records for genomic research

Genome Medicine

Volumn 3, Issue 4, 2011, Pages

  El Emam, Khaled ^a,b  

^a CHILDREN S HOSPITAL OF EASTERN ONTARIO   (Canada)

^b UNIVERSITY OF OTTAWA   (Canada)

Author keywords

[No Author keywords available]

Indexed keywords

ACT; DATA ANALYSIS; ELECTRONIC MEDICAL RECORD; GENOME; GOVERNMENT REGULATION; HEALTH INSURANCE; HUMAN; MEDICAL RESEARCH; MEDICOLEGAL ASPECT; PRIORITY JOURNAL; PRIVACY; REVIEW; RISK; STANDARD;

EID: 79955608859     PISSN: None     EISSN: 1756994X     Source Type: Journal    
DOI: 10.1186/gm239     Document Type: Review

References (87)

1. Prokosch H, Ganslandt T. Perspectives for medical informatics. Reusing the electronic medical record for clinical research. Methods Inf Med 2009, 48:38-44.
2. Tannen R, Weiner M, Xie D. Use of primary care electronic medical record database in drug efficacy research on cardiovascular outcomes: Comparison of database and randomized controlled trial findings. BMJ 2009, 338:b81. 10.1136/bmj.b81, 2769067, 19174434.
3. McCarty C, Chisholm R, Chute C, Kullo I, Jarvik G, Larson E, Li R, Masys D, Ritchie M, Roden D, Struewing JP, Wolf WA. The eMERGE Network: a consortium of biorepositories linked to electronic medical records data for conducting genomic studies. BMC Med Genomics 2011, 4:13. 10.1186/1755-8794-4-13, 3038887, 21269473.
4. Ness R. Influence of the HIPAA privacy rule on health research. JAMA 2007, 298:2164-2170. 10.1001/jama.298.18.2164, 18000200.
5. El Emam K, Dankar F, Issa R, Jonker E, Amyot D, Cogo E, Corriveau J-P, Walker M, Chowdhury S, Vaillancourt R, Roffey T, Bottomley J. A globally optimal k-anonymity method for the de-identification of health data. J Am Med Inform Assoc 2009, 16:670-682. 10.1197/jamia.M3144, 2744718, 19567795.
6. Kho M, Duffett M, Willison D, Cook D, Brouwers M. Written informed consent and selection bias in observational studies using medical records: systematic review. BMJ 2009, 338:b866. 10.1136/bmj.b866, 2769263, 19282440.
7. El Emam K, Jonker E, Fineberg A. The case for deidentifying personal health information. Social Sciences Research Network 2011, http://papers.ssrn.com/abstract=1744038
8. Harris ALAR, Teschke KE. Personal privacy and public health: potential impacts of privacy legislation on health research in Canada. Can J Public Health 2008, 99:293-296.
9. Kosseim P, Brady M. Policy by procrastination: secondary use of electronic health records for health research purposes. McGill J Law Health 2008, 2:5-45.
10. Lowrance W. Learning from experience: privacy and the secondary use of data in health research. J Health Serv Res Policy 2003, 8(Suppl 1):2-7.
11. Panel on Research Ethics Tri-Council Policy Statement: Ethical Conduct for Research Involving Humans. 2010, 2, Panel on Research Ethics., http://www.pre.ethics.gc.ca/pdf/eng/tcps2/TCPS_2_FINAL_Web.pdf
12. Willison D, Emerson C, Szala-Meneok K, Gibson E, Schwartz L, Weisbaum K. Access to medical records for research purposes: varying perceptions across Research Ethics Boards. J Med Ethics 2008, 34:308-314. 10.1136/jme.2006.020032, 18375687.
13. Murphy S, Weber G, Mendis M, Gainer V, Chueh H, Churchill S, Kohane I. Serving the enterprise and beyond with informatics for integrating biology and the bedside. J Am Med Inform Assoc 2010, 17:124-130. 10.1136/jamia.2009.000893, 3000779, 20190053.
14. Deshmukh V, Meystre S, Mitchell J. Evaluating the informatics for integrating biology and the bedside system for clinical research. BMC Med Res Methodol 2009, 9:70. 10.1186/1471-2288-9-70, 2779809, 19863809.
15. Roden D, Pulley J, Basford M, Bernard G, Clayton E, Balser J, Masys D. Development of a large-scale de-identified DNA biobank to enable personalized medicine. Clin Pharmacol Ther 2008, 84:362-369. 10.1038/clpt.2008.89, 18500243.
16. Malin B, Karp D, Scheuermann R. Technical and policy approaches to balancing patient privacy and data sharing in clinical and translational research. J Investig Med 2010, 58:11-18. 2836827, 20051768.
17. The Supreme Court of the State of Illinois Southern Illinoisan vs. The Illinois Department of Public Health. Docket No. 98712 2006, The Supreme Court of the State of Illinois., http://www.state.il.us/court/opinions/supremecourt/2006/february/opinions/html/98712.htm
18. Hansell S. AOL removes search data on group of web users. 2006, New York Times., http://www.nytimes.com/2006/08/08/business/media/08aol.html
19. Barbaro M, Zeller T. A face is exposed for AOL searcher No. 4417749. 2006, New York Times., http://www.nytimes.com/2006/08/09/technology/09aol.html
20. Zeller T. AOL moves to increase privacy on search queries. 2006, New York Times., http://www.nytimes.com/2006/08/22/technology/22aol.html
21. Ochoa S, Rasmussen J, Robson C, Salib M. Reidentification of individuals in Chicago's homicide database: A technical and legal study. 2001, Archived at http://www.webcitation.org/5xyAv7j6M., http://groups.csail.mit.edu/mac/classes/6.805/student-papers/spring01-papers/reidentification.doc
22. Narayanan A, Shmatikov V. Robust de-anonymization of large sparse datasets. Proceedings of the 2008 IEEE Symposium on Security and Privacy 2008, 111-125., http://doi.ieeecomputersociety.org/10.1109/SP.2008.33
23. Sweeney L. Computational disclosure control: A primer on data privacy protection. PhD thesis 2001, Massachusetts Institute of Technology, Electrical Engineering and Computer Science department.
24. Appellate Court of Illinois - Fifth District The Southern Illinoisan v. Department of Public Health. 2004, Appellate Court of Illinois - Fifth District., http://law.justia.com/cases/illinois/court-of-appeals-fifth-appellate-district/2004/5020836.html
25. Federal Court (Canada) Mike Gordon vs. The Minister of Health: Affidavit of Bill Wilson. Court File No. T-347-06 2006, Federal Court (Canada).
26. El Emam K, Kosseim P. Privacy interests in prescription records, part 2: patient privacy. IEEE Security Privacy 2009, 7:75-78.
27. Lowrance W, Collins F. Ethics. Identifiability in genomic research. Science 2007, 317:600-602. 10.1126/science.1147699, 17673640.
28. Malin B, Sweeney L. Determining the identifiability of DNA database entries. Proc AMIA Symp 2000, 2000:537-541.
29. Wjst M. Caught you: threats to confidentiality due to the public release of large-scale genetic data sets. BMC Med Ethics 2010, 11:21. 10.1186/1472-6939-11-21, 3022540, 21190545.
30. Uzuner O, Luo Y, Szolovits P. Evaluating the state-of-the-art in automatic de-identification. J Am Med Inform Assoc 2007, 14:550-563. 10.1197/jamia.M2444, 1975792, 17600094.
31. El Emam K. Data anonymization practices in clinical research: a descriptive study. 2006, Health Canada, Access to Information and Privacy Division., http://www.ehealthinformation.ca/documents/HealthCanadaAnonymizationReport.pdf
32. Canadian Medical Association (CMA) Holdings Incorporated Deidentification/Anonymization Policy 2009, Ottawa CMA Holdings, Canadian Medical Association (CMA) Holdings Incorporated.
33. UBC Clinical Research Ethics Board, Providence Health Care Research Ethics Board Interim Guidance to Clinical Researchers Regarding Compliance with the US Health Insurance Portability and Accountability Act (HIPAA) 2003, Vancouver: University of British Columbia, UBC Clinical Research Ethics Board, Providence Health Care Research Ethics Board.
34. Hryanszkiewicz I, Norton M, Vickers A, Altman D. Preparing raw clinical data for publications: tuidance for journal editors, authors, and peer reviewers. BMJ 2010, 340:c181. 10.1136/bmj.c181, 2813427, 20110312.
35. Clause S, Triller D, Bornhorst C, Hamilton R, Cosler L. Conforming to HIPAA regulations and compilation of research data. Am J Health Syst Pharm 2004, 61:1025-1031.
36. Lin Z, Owen A, Altman R. Genomic research and human subject privacy. Science 2004, 305:183. 10.1126/science.1095019, 15247459.
37. Homer N, Szelinger S, Redman M, Duggan D, Tembe W, Muehling J, Pearson J, Stephan D, Nelson S, Craig D. Resolving individuals contributing trace amounts of DNA to highly complex mixtures using high-density SNP genotyping microarrays. PLoS Genet 2008, 4:e1000167. 10.1371/journal.pgen.1000167, 2516199, 18769715.
38. Jacobs K, Yeager M, Wacholder S, Craig D, Kraft P, Hunter D, Paschal J, Manolio T, Tucker M, Hoover R, Thomas GD, Chanock SJ, Chatterjee N. A new statistic and its power to infer membership in a genome-wide association study using genotype frequencies. Nat Genet 2009, 41:1253-1257. 10.1038/ng.455, 2803072, 19801980.
39. Loukides G, Denny J, Malin B. The disclosure of diagnosis codes can breach research participants' privacy. J Am Med Inform Assoc 2010, 17:322-327.
40. Willenborg L, de Waal T. Statistical Disclosure Control in Practice 1996, New York: Springer-Verlag.
41. Willenborg L, de Waal T. Elements of Statistical Disclosure Control 2001, New York: Springer-Verlag.
42. Skinner CJ. On identification disclosure and prediction disclosure for microdata. Statistica Neerlandica 1992, 46:21-32.
43. Marsh C, Skinner C, Arber S, Penhale B, Openshaw S, Hobcraft J, Lievesley D, Walford N. The case for samples of anonymized records from the 1991 census. J R Stat Soc A (Statistics in Society) 1991, 154:305-340.
44. Dale A, Elliot M. Proposals for 2001 samples of anonymized records: an assessment of disclosure risk. J R Stat Soc A (Statistics in Society) 2001, 164:427-447.
45. Flora Felso JT, Wagner GG. Disclosure limitation methods in use: results of a survey. Confidentiality, Disclosure and Data Access: Theory and Practical Applications for Statistical Agencies 2003, 1:17-38. Washington, DC: Elsevier, Doyle P, Lane J, Theeuwes J, Zayatz L.
46. Jabine T. Statistical disclosure limitation practices of United States statistical agencies. J Official Stat 1993, 9:427-454.
47. Pulley J, Brace M, Bernard G, Masys D. Evaluation of the effectiveness of posters to provide information to patients about a DNA database and their opportunity to opt out. Cell Tissue Banking 2007, 8:233-241.
48. El Emam K. Risk-based de-identification of health data. IEEE Security Privacy 2010, 8:64-67.
49. Subcommittee on Disclosure Limitation Methodology - Federal Committee on Statistical Methodology Working paper 22: Report on statistical disclosure control. 1994, Statistical Policy Office, Office of Information and Regulatory Affairs, Office of Management and Budget, Subcommittee on Disclosure Limitation Methodology - Federal Committee on Statistical Methodology., http://www.fcsm.gov/working-papers/wp22.html
50. Manitoba Center for Health Policy Manitoba Center for Health Policy Privacy code. 2002, Manitoba Center for Health Policy., http://umanitoba.ca/faculties/medicine/units/mchp/media_room/media/MCHP_privacy_code.pdf
51. Cancer Care Ontario: Cancer Care Ontario Data Use and Disclosure Policy. 2005,Updated 2008. , http://www.cancercare.on.ca/common/pages/UserFile.aspx?fileId=13234
52. Health Quality Council Security and Confidentiality Policies and Procedures 2004, Saskatoon Health Quality Council, Health Quality Council.
53. Health Quality Council Privacy code 2004, Saskatoon Health Quality Council, Health Quality Council.
54. Statistics Canada Therapeutic abortion survey. 2007, Archived at http://www.webcitation.org/5VkcHLeQw, Statistics Canada., http://www.statcan.ca/cgi-bin/imdb/p2SV.pl?Function=getSurvey&SDDS=3209&lang=en&db=IMDB&dbg=f&adm=8&dis=2#b9
55. Office of the Information and Privacy Commissioner of British Columbia: Order No. 261-1998. 1998, http://www.oipc.bc.ca/orders/1998/Order261.html
56. Office of the Information and Privacy Commissioner of Ontario Order P-644. 1994, Archived at http://www.webcitation.org/5inrVJyQp, Office of the Information and Privacy Commissioner of Ontario., http://www.ipc.on.ca/images/Findings/Attached_PDF/P-644.pdf
57. Alexander L, Jabine T. Access to social security microdata files for research and statistical purposes. Social Security Bulletin 1978, 41:3-17.
58. Ministry of Health and Long Term care (Ontario) Corporate Policy 3-1-21. 1984, [Available on request], Ministry of Health and Long Term care (Ontario).
59. Duncan G, Jabine T, de Wolf S. Private Lives and Public Policies: Confidentiality and Accessibility of Government Statistics. 1993, Washington DC: National Academies Press.
60. de Waal A, Willenborg L. A view on statistical disclosure control for microdata. Survey Methodol 1996, 22:95-103.
61. Office of the Privacy Commissioner of Quebec (CAI) Chenard v. Ministere de l'agriculture, des pecheries et de l'alimentation (141). CAI 141 1997, [Available on request], Office of the Privacy Commissioner of Quebec (CAI).
62. National Center for Education Statistics NCES Statistical Standards 2003, Washington DC US Department of Education, National Center for Education Statistics.
63. National Committee on Vital and Health Statistics Report to the Secretary of the US Department of Health and Human Services on Enhanced Protections for Uses of Health Data: A Stewardship Framework for "Secondary Uses" of Electronically Collected and Transmitted Health Data. V.101907(15) 2007, National Committee on Vital and Health Statistics.
64. Sweeney L. Data sharing under HIPAA: 12 years later. 2010, Workshop on the HIPAA Privacy Rule's De-Identification Standard., http://www.hhshipaaprivacy.com/
65. Lafky D. The Safe Harbor method of de-identification: an empirical test. 2010, Fourth National HIPAA Summit West, Archived at http://www.webcitation.org/5xA2HIOmj., http://www.ehcca.com/presentations/HIPAAWest4/lafky_2.pdf
66. Jabine T. Procedures for restricted data access. J Official Stat 1993, 9:537-589.
67. El Emam K, Brown A, AbdelMalik P, Neisa A, Walker M, Bottomley J, Roffey T. A method for managing re-identification risk from small geographic areas in Canada. BMC Med Inform Decis Mak 2010, 10:18. 10.1186/1472-6947-10-18, 2858714, 20361870.
68. El Emam K, Dankar F, Vaillancourt R, Roffey T, Lysyk M. Evaluating patient re-identification risk from hospital prescription records. Can J Hospital Pharmacy 2009, 62:307-319.
69. Murphy S, Chueh H. A security architecture for query tools used to access large biomedical databases. Proc AMIA Symp 2002, 552-556., http://www.ncbi.nlm.nih.gov/pmc/articles/PMC2244204/pdf/procamiasymp00001-0593.pdf
70. Kargupta H, Datta S, Wang Q, Sivakumar K. Random data perturbation techniques and privacy preserving data mining. Knowledge Information Systems 2005, 7:387-414.
71. Malin B, Cassa C, Kantarcioglu M. A survey of challenges and solutions for privacy in clinical genomics data mining. Privacy-Preserving Knowledge Discovery 2011, New York: Chapman & Hall/CRC Press, Bonchi F, Ferrari E.
72. El Emam K, Fineberg A. An overview of techniques for de-identifying personal health information. 2009, Access to Information and Privacy Division of Health Canada., http://papers.ssrn.com/sol3/papers.cfm?abstract_id=1456490
73. Tu K, Klein-Geltink J, Mitiku T, Mihai C, Martin J. De-identification of primary care electronic medical records free-text data in Ontario, Canada. BMC Med Inform Decis Mak 2010, 10:35. 10.1186/1472-6947-10-35, 2907300, 20565894.
74. El Emam K, Jonker E, Sams S, Neri E, Neisa A, Gao T, Chowdhury S. Pan-Canadian de-identification guidelines for personal health information. 2007, Privacy Commissioner of Canada., http://www.ehealthinformation.ca/documents/OPCReportv11.pdf
75. Lin Z, Hewett M, Altman R. Using binning to maintain confidentiality of medical data. Proc AMIA Symp 2002, 454-458., http://www.ncbi.nlm.nih.gov/pmc/articles/PMC2244360/pdf/procamiasymp00001-0495.pdf
76. Malin B. Protecting genomic sequence anonymity with generalization lattices. Methods Inf Med 2005, 44:687-692.
77. Loukides G, Gkoulalas-Divanis A, Malin B. Anonymization of electronic medical records for validating genome-wide association studies. Proc Natl Acad Sci USA 2010, 107:7898-7903. 10.1073/pnas.0911686107, 2867915, 20385806.
78. Aggarwal G, Feder T, Kenthapadi K, Motwani R, Panigrahy R, Thomas D, Zhu A. Anonymizing tables. Proceedings of the 10th International Conference on Database Theory (ICDT05) 2005, 246-258. Springer.
79. Fraser R, Willison D. Tools for De-Identification of Personal Health Information. 2009, Canada Health Infoway, Archived at http://www.webcitation.org/5xA2KBoMm., http://www2.infoway-inforoute.ca/Documents/Tools_for_De-identification_EN_FINAL.pdf
80. Health System Use Technical Advisory Committee - Data De-Identification Working Group 'Best Practice' Guidelines for Managing the Disclosure of De-Identified Health Information. 2011, Archived at http://www.webcitation.org/5x9w6635d, Health System Use Technical Advisory Committee - Data De-Identification Working Group., http://www.ehealthinformation.ca/documents/Data%20De-identification%20Best%20Practice%20Guidelines.pdf
81. Meystre S, Friedlin F, South B, Shen S, Samore M. Automatic de-identification of textual documents in the electronic health record: a review of recent research. BMC Med Res Methodol 2010, 10:70. 10.1186/1471-2288-10-70, 2923159, 20678228.
82. Aggarwal C. On k-anonymity and the curse of dimensionality. Proceedings of the 31st International Conference on Very Large Data Bases 2005, 901-909. VLDB Endowment.
83. Nyhold D, Yu C, Visscher P. On Jim Watson's APOE status: genetic information is hard to hide. Eur J Hum Genet 2008, 17:147-149. 2986051, 18941475.
84. Malin B. Re-identification of familial database records. Proc AMIA Symp 2006, 524-528., http://www.ncbi.nlm.nih.gov/pmc/articles/PMC1839550/pdf/AMIA2006_0524.pdf
85. Cassa C, Schmidt B, Kohane I, Mandl K. My sister's keeper ? Genomic research and the identifiability of siblings. BMC Med Genomics 2008, 1:32. 10.1186/1755-8794-1-32, 2503988, 18655711.
86. Bieber F, Brenner C, Lazer D. Finding criminals through DNA of their relatives. Science 2006, 312:1315-1316. 10.1126/science.1122655, 16690817.
87. Pabrai U. Getting Started with HIPAA 2003, Boston: Premier Press.