De-identifying a public use microdata file from the Canadian national discharge abstract database

BMC Medical Informatics and Decision Making

Volumn 11, Issue 1, 2011, Pages

  Emam, Khaled El ^a,b   Paton, David ^c   Dankar, Fida ^a   Koru, Gunes ^d  

^a CHILDREN S HOSPITAL OF EASTERN ONTARIO   (Canada)

^b UNIVERSITY OF OTTAWA   (Canada)

^c CANADIAN INSTITUTE FOR HEALTH INFORMATION   (Canada)

^d Baltimore County   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

ALGORITHM; ARTICLE; CANADA; FACTUAL DATABASE; HOSPITAL DISCHARGE; HUMAN; INFORMATION RETRIEVAL; LENGTH OF STAY; STATISTICS;

ALGORITHMS; CANADA; DATABASES, FACTUAL; HUMANS; INFORMATION STORAGE AND RETRIEVAL; LENGTH OF STAY; PATIENT DISCHARGE;

EID: 80052038363     PISSN: None     EISSN: 14726947     Source Type: Journal    
DOI: 10.1186/1472-6947-11-53     Document Type: Article

References (140)

1. Sharing Research Data. Fienberg S, Martin M, Straf M, Committee on National Statistics, National Research Council 1985
2. Publishing raw data and real time statistical analysis on e-journals. Hutchon D, British Medical Journal 2001 322 3 530 11230070
3. Are journals doing enough to prevent fraudulent publication? Canadian Medical Association Journal 2006 174 4 431 16477045
4. Microdata access and labor market research: The US experience. Abraham K, Allegmeines Statistisches Archiv 2005 89 121 139 10.1007/s10182-005-0197-6 (Pubitemid 43152897)
5. Whose data set is it anyway? Vickers A, Sharing raw data from randomized trials. Trials 2006 7 15
6. Authors should make their data available. Altman D, Cates C, BMJ 2001 323 1069 11713749
7. Whose data are they anyway? Delamothe T, BMJ 1996 312 1241 1242 8634604 (Pubitemid 26147657)
8. Increasing the accessibility of data. Smith GD, BMJ 1994 308 1519 1520 8019302 (Pubitemid 24178445)
9. Commission of the European Communities. On scientific information in the digital age: Access, dissemination and preservation 2007
10. Access to collections of data and materials for health research: A report to the Medical Research Council and the Wellcome Trust. Lowrance W, Medical Research Council and the Wellcome Trust 2006
11. Obtaining access to data from government-sponsored medical research. Yolles B, Connors J, Grufferman S, NEJM 1986 315 26 1669 1672 10.1056/NEJM198612253152608 3785337 (Pubitemid 17052901)
12. Ethical issues in sharing epidemiologic data. Hogue C, Journal of Clinical Epidemiology 1991 44 Suppl I 103S 107S 1827649
13. Justifications for the sharing of social science data. Hedrick T, Law and Human Behavior 1988 12 2 163 171 10.1007/BF01073124
14. Improving access to and confidentiality of research data: Report of a workshop. Mackie C, Bradburn N, Washington: The National Academies Press 2000
15. Why disseminate microdata? Boyko E, United Nations Economic and social Commission for Asia and the Pacific Workshop on Census and Survey Microdata 2008
16. Producing Public-Use Microdata That Are Analytically Valid And Confidential. Winkler W, US Census Bureau 1997
17. 2001 Census Public Use Microdata File: Individuals file user documentation. Statistics Canada, 2001
18. Proposals for the 2001 samples of anonymized records: An assessment of disclosure risk. Dale A, Elliot M, Journal of the Royal Statistical Society 2001 164 3 427 447 10.1111/1467-985X.00212 (Pubitemid 33395632)
19. The case for samples of anonymized records from the 1991 census. Marsh C, Skinner C, Arber S, Penhale B, Openshaw S, Hobcraft J, Lievesley D, Walford N, Journal of the Royal Statistical Society, Series A (Statistics in Society) 1991 154 2 305 340 10.2307/2983043
20. Canadian Community Health Survey: Public Use Microdata File. Statistics Canada, 2009 http://www.statcan.gc.ca/bsolc/olc-cel/olc-cel?catno= 82M0013X&lang=eng
21. Safe data versus safe settings: Access to microdata from the British census. Marsh C, Dale A, Skinner C, International Statistical Review 1994 62 1 35 53 10.2307/1403544
22. Access to social security microdata files for research and statistical purposes. Alexander L, Jabine T, Social Security Bulletin 1978 41 8 3 17 741349 (Pubitemid 9024515)
23. Comparative Effectiveness Research Public Use Data Pilot Project. Department of Health and Human Services, 2010
24. CER-Public Use Data Pilot Project. Department of Health and Human Services, 2010
25. Consumer-Purchaser Disclosure Project. The state experience in health quality data collection 2004
26. Healthcare cost and utilization project: SID/SASD/SEDD Application Kit. Agency for Healthcare Research and Quality, 2010
27. Data Quality Documentation, Discharge Abstract Database. Canadian Institute for Health Information, 2009-2010: Executive Summary 2010
28. Privacy and security framework. Canadian Institute for Health Information, 2010
29. The value of hospital discharge databases. Schoenman J, Sutton J, Kintala S, Love D, Maw R, Agency for Healthcare Research and Quality 2005
30. Protecting respondents identities in microdata release. Samarati P, Knowledge and Data Engineering, IEEE Transactions on 2001 13 6 1010 1027 [10.1109/69.971193] 10.1109/69.971193 (Pubitemid 34035590)
31. k-anonymity: a model for protecting privacy. Sweeney L, International Journal on Uncertainty, Fuzziness and Knowledge-based Systems 2002 10 5 557 570 10.1142/S0218488502001648 (Pubitemid 35384857)
32. On identification dislcosure and prediction disclosure for microdata. Skinner C, Statistics Neerlandica 1992 46 1 21 32 10.1111/j.1467-9574.1992. tb01324.x
33. Subcommittee on Disclosure Limitation Methodology-Federal Committee on Statistical Methodology. Statistical Policy Working paper 22: Report on statistical disclosure control. Statistical Policy Office, Office of Information and Regulatory Affairs, Office of Management and Budget 1994
34. l-Diversity: Privacy Beyond k-Anonymity. Machanavajjhala A, Gehrke J, Kifer D, Transactions on Knowledge Discovery from Data 2007 1 1 1 47 10.1145/1217299.1217300 (Pubitemid 46712368)
35. AOL Removes Search Data on Group of Web Users. Hansell S, New York Times 2006
36. A Face Is Exposed for AOL Searcher No. 4417749. Barbaro M, Zeller T Jr, New York Times 2006
37. Zeller T Jr, AOL Moves to Increase Privacy on Search Queries New York Times 2006
38. Reidentification of individuals in Chicago's homicide database: A technical and legal study. Ochoa S, Rasmussen J, Robson C, Salib M, Massachusetts Institute of Technology 2001
39. Robust de-anonymization of large datasets (how to break anonymity of the Netflix prize dataset). Narayanan A, Shmatikov V, University of Texas at Austin 2008
40. Appellate Court of Illinois-Fifth District. The Southern Illinoisan v. Department of Public Health 2004
41. The Supreme Court of the State of Illinois. Southern Illinoisan vs. The Illinois Department of Public Health 2006 http://www.state.il.us/court/opinions/ supremecourt/2006/february/opinions/html/98712.htm Accessed on: February 1, 2011
42. Mike Gordon vs. The Minister of Health: Affidavit of Bill Wilson. Federal Court (Canada), 2006
43. Privacy Interests in Prescription Records, Part 2: Patient Privacy. El Emam K, Kosseim P, IEEE Security and Privacy 2009 7 2 75 78
44. The Safe Harbor method of de-identification: An empirical test. Lafky D, Fourth National HIPAA Summit West 2010
45. Privacy-Preserving Data Publishing: A Survey of Recent Developments. Fung BCM, Wang K, Chen R, Yu PS, ACM Computing Surveys 2010 42 4
46. Privacy preserving data publishing. Chen B-C, Kifer D, LeFevre K, Machanavajjhala A, Foundations and Trends in Databases 2009 2 1-2 1 167
47. Access to social security microdata files for research and statistical purposes. Alexander LA, Jabine TB, Social Security Bulletin 1978 41 8 3 17 741349 (Pubitemid 9024515)
48. A view on statistical disclosure control for microdata. de Waal T, Willenborg L, Survey Methodology 1996 22 1 95 103
49. Elements of Statistical Disclosure Control. Willenborg L, de Waal T, Lecture Notes in Statistics 2001 155 Springer
50. Theory and Practical Applications for Statistical Agencies. Domingo-Ferrer J, Torra Vc, North-Holland: Amsterdam 2002 113 134
51. A measure of disclosure risk for microdata. Skinner C, Elliot M, Journal of the Royal Statistical Society Series B-Statistical Methodology 2002 64 855 -867 10.1111/1467-9868.00365
52. Ordinal, Continuous and Heterogeneous k-Anonymity Through Microaggregation. Domingo-Ferrer J, Torra Vc, Data Min Knowl Discov 2005 11 195 212 [10.1007/s10618-005-0007-5] 10.1007/s10618-005-0007-5 (Pubitemid 41476765)
53. Statistical Disclosure Control for Microdata Using the R-Package sdcMicro. Templ M, Trans Data Privacy 2008 1 67 -85
54. Cost effective implementation of synthetic tabulation (a.k.a. controlled tabular adjustments) in legacy and new statistical data publication systems. Dandekar RA, Joint ECE/Eurostat Work Session on Statistical Data Confidentiality, Luxembourg 2003
55. Maximum Utility-Minimum Information Loss Table Server Design for Statistical Disclosure Control of Tabular Data. Dandekar RA, Privacy in statistical databases, Josep Domingo-Ferrer, Vicen\cc Torra, 2004
56. Minimum-distance controlled perturbation methods for large-scale tabular data protection. Castro J, European Journal of Operational Research 2004 171
57. Balancing quality and confidentiality for multivariate tabular data. Cox LH, Kelly JP, Patil R, Privacy in statistical databases, Josep Domingo-Ferrer, Torra V, 2004
58. Confidentiality, Disclosure, and Data Access: Theory and Practical Applications for Statistical Agencies. Doyle P, Lane JI, Theeuwes JJM, Zayatz LM, Elsevier Science 1 2001
59. Disclosure Control Methods and Information Loss for Microdata. Domingo-Ferrer J, Torra Vc, Confidentiality, Disclosure, and Data Access: Theory and Practical Applications for Statistical Agencies, P. Doyle, et al, 2001 Elsevier Science
60. A method for limiting disclosure in microdata based on random noise and transformation. Kim JJ, Proceedings of the ASA Section on Survey Research Methodology American Statistical Association: Alexandria, Virginia 1986 370 375
61. Statistical Analysis of Masked Data. Little RJA, Journal of Official Statistics 1993 9 2 407 426
62. The use of measurement error to avoid disclosure. Sullivan G, Fuller WA, Proceedings of the American Statistical Association, Survey Methods Section American Statistical Association: Alexandria, Virginia 1989 802 808
63. The construction of masking error for categorical variables. Sullivan G, Fuller WA, Proceedings of the American Statistical Association, Survey Methods Section American Statistical Association: Alexandria, Virginia 1990 435 440
64. Random data perturbation techniques and privacy preserving data mining. Kargupta H, Datta S, Wang Q, Sivakumar K, Knowledge and Information Systems 2005 7 387 414 10.1007/s10115-004-0173-6 (Pubitemid 41166792)
65. A Data Distortion by Probability Distribution. Liew CK, Choi UJ, Liew CJ, ACM Transactions on Database Systems 1985 10 3 395 411 10.1145/3979.4017 (Pubitemid 15578789)
66. Panels of enterprises and confidentiality: The small aggregates method. Defays D, Nanopoulos P, Proceedings of the 1992 Symposium on Design and Analysis of Longitudinal Surveys Statistics Canada: Ottowa, Canada 1993
67. Confidentiality In The European Statistical System. Nanopoulos P, Qüestiiá 1997 21 1 i 2 219 220 21874539
68. Masking data using micro-aggregation. Defays D, Anwar M, Journal of Official Statistics 1998 14 449 461
69. Practical data-oriented microaggregation for statistical disclosure control. Domingo-Ferrer J, Mateo-Sanz J, IEEE Transactions on Knowledge and Data Engineering 2002 14 1 189 201 [10.1109/69.979982] 10.1109/69.979982 (Pubitemid 34198203)
70. Exact and approximate methods for data directed microaggregation in one or more dimensions. Sande G, International Journal of Uncertainty, Fuziness, and Knowledge-Based Systems 2002 10 5 459 476 10.1142/S0218488502001582 (Pubitemid 35384851)
71. Microaggregation for categorical variables: A median based approach. Torra V, Privacy in Statistical Databases 2004 Springer LNCS
72. Resampling for statistical confidentiality in contingency tables. Domingo-Ferrer J, Mateo-Sanz JM, Computers and Mathematics with Applications 1999 38 11-12 13 32 10.1016/S0898-1221(99)00281-3 (Pubitemid 129304032)
73. Disclosure Control Methods and Information Loss for Microdata. Domingo-Ferrer J, Torra V, Confidentiality, Disclosure, and Data Access: Theory and Practical Applications for Statistical Agencies, P. Doyle, et al, 2001
74. Utility and Risk of JPEG-based Continuous Microdata Protection Methods. Jimenez J, Torra V, International Conference on Availability, Reliability and Security 2009
75. Discussion Statistical Disclosure Limitation (also cited as: Satisfying confidentiality constraints through the use of synthetic multiply-imputed microdata). Rubin DB, Journal of Official Statistics 1996 9 2 461 -468
76. A Bootstrap Procedure to Preserve Statistical Confidentiality in Contingency Tables. Heer GR, International Seminar on Statistical Confidentiality Luxembourg, D. Lievesley, 1993 261 271
77. Confidentiality via Camouflage: The CVC Approach to Disclosure Limitation When Answering Queries to Databases. Gopal R, Garfinkel R, Goes P, OPERATIONS RESEARCH 2002 50 3 501 516 10.1287/opre.50.3.501.7745
78. dW. Post Randomisation for Statistical Disclosure Control: Theory and Implementation. Gouweleeuw JP, Kooiman P, Willenborg LCRJ, P.-P dW, Journal of Official Statistics 1998 14 4 463 -478
79. Statistical Disclosure Control in Practice. Willenborg L, de Waal T, 1 1996 Springer
80. $\mu$- and $\tau$-argus: Software for Statistical Disclosure Control. Hundepool A, Willenborg L, 3rd International Seminar on Statistical Confidentiality 1996 Bled
81. Protecting privacy when disclosing information: k-anonymity and its enforcement through generalisation and suppression. Samarati P, Sweeney L, SRI International 1998
82. Protecting respondents' identities in microdata release. Samarati P, IEEE Transactions on Knowledge and Data Engineering 2001 13 6 1010 1027 10.1109/69.971193 (Pubitemid 34035590)
83. Achieving k-anonymity privacy protection using generalization and suppression. Sweeney L, International Journal of Uncertainty, Fuzziness and Knowledge-Based Systems 2002 10 5 571 588 10.1142/S021848850200165X (Pubitemid 35384858)
84. k-Anonymity. Ciriani V, De Capitani di Vimercati SSF, Samarati P, Secure Data Management in Decentralized Systems 2007 Springer
85. Data Privacy through Optimal k-Anonymization Proceedings of the 21st International Conference on Data Engineering. Bayardo R, Agrawal R, 2005
86. Transforming data to satisfy privacy constraints. Iyengar V, Proceedings of the ACM SIGKDD International Conference on Data Mining and Knowledge Discovery 2002
87. A Globally Optimal k-Anonymity Method for the De-identification of Health Data Journal of the American Medical Informatics Association. El Emam K, Dankar F, Issa R, Jonker E, Amyot D, Cogo E, Corriveau J-P, Walker M, Chowdhury S, Vaillancourt R, Roffey T, Bottomley J, 2009
88. Handbook on Statistical Disclosure Control (Version 1.2). Hundepool A, Domingo-Ferrer J, Franconi L, Giessing S, Lenz R, Naylor J, Nordholt ES, Seri G, Wolf P-PD, A Network of Excellence in the European Statistical System in the field of Statistical Disclosure Control 2010
89. Re-identification methods for evaluating the confidentiality of analytically valid microdata. Winkler WE, Research in Official Statistics 1998 1 2 50 -69
90. Comparing SDC Methods for Microdata on the Basis of Information Loss and Disclosure. Domingo-Ferrer J, Mateo-sanz JM, Torra Vc, Proceedings of ETK-NTTS 2001 Luxemburg: Eurostat 2001 807 826 Eurostat
91. A Mathematical Theory of Communication. Shannon CE, The Bell System Technical Journal 1948 27
92. Communication Theory of Secrecy Systems. Shannon CE, The Bell System Technical Journal 1949
93. Information loss through global recoding and local suppression. de Waal T, Willenborg L, Netherlands Official Statistics 1999 Spring Special Issue 17 20
94. PRAM: a method for disclosure limitation of microdata. Kooiman P, Willenborg L, Gouweleeuw J, Statistics Netherlands, Division Research and Development, Department of Statistical Methods 1997
95. k-Anonymization with Minimal Loss of Information. Gionis A, Tassa T, Knowledge and Data Engineering, IEEE Transactions on 2009 21 2 206 219
96. A globally optimal k-anonymity method for the de-identification of health data. El Emam K, Dankar FK, Issa R, Jonker E, Amyot D, Cogo E, Corriveau J-P, Walker M, Chowdhury S, Vaillancourt R, Roffey T, Bottomley J, Journal of the American Medical Informatics Association 2009 16 5 670 82 [10.1197/jamia.M3144] 10.1197/jamia.M3144 19567795
97. Computational disclosure control: A primer on data privacy protection. Sweeney L, Massachusetts Institute of Technology 2001
98. Data privacy through optimal k-anonymization. Bayardo RJ, Agrawal R, Proceedings of the 21st International Conference on Data Engineering 2005 217 228 (Pubitemid 41731133)
99. Protecting privacy using k-anonymity. El Emam K, Dankar FK, Journal of the American Medical Informatics Association 2008 15 5 627 37 [10.1197/jamia.M2716] 10.1197/jamia.M2716 18579830
100. Mondrian Multidimensional K-Anonymity. LeFevre K, DeWitt DJ, Ramakrishnan R, Proceedings of the 22nd International Conference on Data Engineering IEEE Computer Society: Washington, DC, USA 2006 25 (Pubitemid 44539817)
101. Flexible Anonymization For Privacy Preserving Data Publishing: A Systematic Search Based Approach. Hore B, Jammalamadaka RC, Mehrotra S, SIAM International Conference on Data Mining (SDM) 2007
102. Utility-based anonymization for privacy preservation with less information loss. Xu J, Wang W, Pei J, Wang X, Shi B, Fu AW-C, SIGKDD Explorations Newsletter 2006 8 21 -30 http://doi.acm.org/10.1145/1233321.1233324 10.1145/1233321.1233324
103. Thoughts on k-anonymization. Nergiz ME, Clifton C, Data Knowl Eng 2007 63 622 645 http://dx.doi.org/10.1016/j.datak.2007.03.009 10.1016/j.datak.2007.03. 009 (Pubitemid 47418332)
104. note on the individual risk of disclosure A. Silvia Polettini. Istituto Nazionale di Statistica 2003
105. L-diversity: Privacy beyond k-anonymity. Machanavajjhala A, Kifer D, Gehrke J, Venkitasubramaniam M, ACM Trans Knowl Discov Data 2007 1 http://doi.acm.org/10.1145/1217299.1217302
106. Datafly: A system for providing anoinymity to medical data. Sweeney L, Proceedings of the IFIP TC11 WG11.3 Eleventh International Conference on Database Securty XI: Status and Prospects 1997
107. Introduction to Privacy-Preserving Data Publishing: Concepts and Techniques. Fung BCM, Wang K, Fu AW-C, Yu PS, Chapman and Hall/CRC 1 2010
108. Personalized privacy preservation. Xiao X, Tao Y, Proceedings of the 2006 ACM SIGMOD international conference on Management of data ACM: New York, NY, USA 2006 229 240 (Pubitemid 46946516)
109. Transforming data to satisfy privacy constraints. Iyengar VS, Proceedings of the eighth ACM SIGKDD international conference on Knowledge discovery and data mining ACM: New York, NY, USA 2002 279 288
110. Top-down specialization for information and privacy preservation. Fung BCM, Wang K, Yu PS, ICDE 2005. Proceedings. 21st International Conference on Data Engineering 2005 205 216 (Pubitemid 41731132)
111. Anonymizing Classification Data for Privacy Preservation. Fung BCM, Wang K, Yu PS, IEEE Transactions on Knowledge and Data Engineering (TKDE) 2007 19 5 711 -725 (Pubitemid 46509408)
112. Risk-based de-identification of health data. El Emam K, IEEE Security and Privacy 2010 8 3 64 67
113. Handbook for creating public use microdata files. Statistics Canada, 2006
114. Cancer Care Ontario Data Use and Disclosure Policy. Cancer Care Ontario 2005
115. Security and confidentiality policies and procedures. Health Quality Council 2004
116. Privacy code. Health Quality Council 2004
117. Privacy code. Manitoba Center for Health Policy 2002
118. Subcommittee on Disclosure Limitation Methodology-Federal Committee on Statistical Methodology. Working paper 22: Report on statistical disclosure control 1994 Office of Management and Budget
119. Therapeutic abortion survey. Statistics Canada, 2007
120. Office of the Information and Privacy Commissioner of British Columbia. 1998 Order No. 261-1998
121. Office of the Information and Privacy Commissioner of Ontario.
122. Ministry of Health and Long Term care (Ontario). Corporate Policy 1984 3-1-21
123. Private Lives and Public Policies: Confidentiality and Accessibility of Government Statistics. Duncan G, Jabine T, de Wolf S, National Academies Press 1993
124. A view on statistical disclosure control for microdata. de Waal A, Willenborg L, Survey Methodology 1996 22 1 95 103
125. Office of the Privacy Commissioner of Quebec (CAI). Chenard v. Ministere de l'agriculture, des pecheries et de l'alimentation (141) 1997
126. National Center for Education Statistics. NCES Statistical Standards US Department of Education 2003
127. National Committee on Vital and Health Statistics, Report to the Secretary of the US Department of Health and Human Services on Enhanced Protections for Uses of Health Data: A Stewardship Framework for "Secondary Uses" of Electronically Collected and Transmitted Health Data 2007
128. Data sharing under HIPAA: 12 years later. Sweeney L, Workshop on the HIPAA Privacy Rule's De-Identification Standard 2010 Department of Health and Human Services 20094831
129. Evaluating common de-identification heuristics for personal health information. El Emam K, Jabbouri S, Sams S, Drouet Y, Power M, Journal of Medical Internet Research 2006 8 4 28 [PMID: 17213047 ] 10.2196/jmir.8.4.e28 17213047 (Pubitemid 47450199)
130. De-Identification Guidelines for Personal Health Information. El Emam K, Jonker E, Sams S, Neri E, Neisa A, Gao T, Chowdhury S, Report produced for the Office of the Privacy Commissioner of Canada: Ottawa 2007
131. Evaluating re-identification risks with respect to the HIPAA privacy rule. Benitez K, Malin B, Journal of the American Medical Informatics Association 2010 17 2 169 177 10.1136/jamia.2009.000026 20190059
132. Record linkage methods for multidatabase data mining. Torra V, Domingo-Ferrer J, Information Fusion in Data Mining 2003 101 132
133. Using Mahalanobis distance-based record linkage for dislcosure risk assessment. Torra V, Abowd J, Domingo-Ferrer J, 2006 233 242 Springer LNCS
134. Protecting privacy using k-anonymity. El Emam K, Dankar F, Journal of the American Medical Informatics Association 2008 15 627 637 10.1197/jamia.M2716 18579830
135. International Classification of Diseases. World Health Organization, http://www.who.int/classifications/icd/en/
136. The disclosure of diagnosis codes can breach research participants' privacy. Loukides G, Denny J, Malin B, Journal of the American Medical Informatics Association 2010 17 322 327 20442151
137. Methods for the de-identification of electronic health records for genomic research. El Emam K, Genome Medicine 2011 3 25
138. On the complexity of optimal k-anonymity. Meyerson A, Williams R, Proceedings of the 23rd Conference on the Principles of Database Systems 2004
139. Anonymizing Tables. Aggarwal G, Feder T, Kenthapadi K, Motwani R, Panigrahy R, Thomas D, Zhu A, Proceedings of the 10th International Conference on Database Theory (ICDT05) 2005
140. Evaluating patient re-identification risk from hospital prescription records. El Emam K, Dankar F, Vaillancourt R, Roffey T, Lysyk M, Canadian Journal of Hospital Pharmacy 2009 62 4 307 319