A systematic review of re-identification attacks on health data

PLoS ONE

Volumn 6, Issue 12, 2011, Pages

  El Emam, Khaled ^a,b   Jonker, Elizabeth ^a   Arbuckle, Luk ^a   Malin, Bradley ^c,d  

^a CHILDREN S HOSPITAL OF EASTERN ONTARIO   (Canada)

^b UNIVERSITY OF OTTAWA   (Canada)

^c VANDERBILT UNIVERSITY MEDICAL CENTER   (United States)

^d VANDERBILT UNIVERSITY   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

ACM DIGITAL LIBRARY; BIBLIOGRAPHIC DATABASE; CONFIDENCE INTERVAL; DATA ANALYSIS; IEEE XPLORE; MEDICAL INFORMATION SYSTEM; MEDICAL RECORD; MEDICAL RESEARCH; MEDLINE; PUBLISHING; REVIEW; ARTICLE; COMPUTER PROGRAM; COMPUTER SECURITY; CONFIDENTIALITY; ELECTRONIC MEDICAL RECORD; FACTUAL DATABASE; HEALTH INSURANCE; HUMAN; LEGAL ASPECT; PRIVACY; REPRODUCIBILITY; STATISTICAL MODEL; UNITED STATES;

COMPUTER SECURITY; CONFIDENTIALITY; DATABASES, FACTUAL; HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT; HUMANS; MEDICAL RECORDS SYSTEMS, COMPUTERIZED; MODELS, STATISTICAL; PRIVACY; REPRODUCIBILITY OF RESULTS; SOFTWARE; UNITED STATES;

EID: 82555187188     PISSN: None     EISSN: 19326203     Source Type: Journal    
DOI: 10.1371/journal.pone.0028071     Document Type: Review

References (76)

1. Fung BCM, Wang K, Chen R, Yu PS, (2010) Privacy-Preserving Data Publishing: A Survey of Recent Developments. ACM Computing Surveys 42.
2. Perun H, Orr M, Dimitriadis F, (2005) Guide to the Ontario Personal Health Information Protection Act: Irwin Law.
3. U.S. Department of Health and Human Services (2002) Standards for privacy of individually identifiable health information, final rule, 45 CFR, pt 160-164. U.S. Department of Health and Human Services.
4. Panel on Research Ethics (2010) Tri-Council Policy Statement: Ethical Conduct for Research Involving Humans (2nd ed).
5. Willison DJ, Emerson C, Szala-Meneok KV, Gibson E, Schwartz L, et al. (2008) Access to medical records for research purposes: varying perceptions across research ethics boards. J Med Ethics 34: 308-314.
6. McGuire AL, Gibbs RA, (2006) Genetics. No longer de-identified. Science 312: 370-371.
7. Ohm P, (2010) Broken Promises of Privacy: Responding to the Surprising Failure of Anonymization. UCLA Law Review 57: 1701-1777.
8. Brief of Amici Curiae: Electronic Privacy Information Center (EPIC) and Legal Scholars and Technical Experts in Support of the Petitioners (2011) William H. Sorrell, Attorney General of Vermont,et al. v. IMS Health Inc., et al.
9. Curfman GD, Morrissey S, Drazen JM, (2011) Prescriptions, privacy, and the First Amendment. N Engl J Med 364: 2053-2055.
10. Gellman R, (2011) The deidentification dilemma: a legislative and contractual proposal. Fordham Intellectual Property, Media & Entertainment Law Journal XXI.
11. Narayanan A, Shmatikov V, (2010) Myths and fallacies of "Personally Identifiable Information". Commun ACM 53: 24-26.
12. Rothstein MA, (2010) Is deidentification sufficient to protect health privacy in research? Am J Bioeth 10: 3-11.
13. Cavoukian A, El Emam K, (2011) Dispelling the myths about de-identfication: anonymization remains a strong tool. Office of the Information and Privacy Commissioner of Ontario.
14. Canadian Institutes of Health Research (2005) CIHR best practices for protecting privacy in health research Ottawa Canadian Institutes of Health Research.
15. Harris A, Levy AR, Teschke KE, (2008) Personal Privacy and Public Health: Potential impacts of privacy legislation on health research in Canada. Canadian Journal of Public Health July-August 2008: 293-296.
16. El Emam K, Dankar FK, Issa R, Jonker E, Amyot D, et al. (2009) A globally optimal k-anonymity method for the de-identification of health data. J Am Med Inform Assoc 16: 670-682.
17. Kho ME, Duffett M, Willison DJ, Cook DJ, Brouwers MC, (2009) Written informed consent and selection bias in observational studies using medical records: systematic review. BMJ 338.
18. Office for Civil Rights (2011) Annual report to congress on breaches of unsecured protected health information for calendar years 2009 and 2010. US Department of Health and Human Services.
19. Becker C, Taylor M, (2006) Technical difficulties: Recent health IT security breaches are unlikely to improve the public's perception about the safety of personal data. Modern Healthcare 38: 6-7.
20. Robeznieks A, (2005) Privacy fear factor arises. Modern Healthcare 35: 6.
21. Sweeney L, (1997) Weaving technology and policy together to maintain confidentiality. J Law Med Ethics 25: 98-9110.
22. Barbaro M, Zeller T Jr, (2006) A Face Is Exposed for AOL Searcher No. 4417749. New York Times.
23. Narayanan A, Shmatikov V, (2008) Robust de-anonymization of large datasets. Proc IEEE Security & Privacy Conference pp. 111-125.
24. U.S. Department of Health and Human Services (2011) Advanced Notice of Proposed Rulemaking for Revision to the Common Rule. U.S. Department of Health and Human Services.
25. Cohen J, (1960) A Coefficient of Agreement for Nominal Scales. Educational and Psychological Measurement XX: 37-46.
26. Flack V, Afifi A, Lachenbruch P, (1988) Sample size determinations for the two rater kappa statistic. Psychometrika 53: 321-325.
27. Sim J, Wright CC, (2005) The kappa statistic in reliability studies: use, interpretation, and sample size requirements. Phys Ther 85: 257-268.
28. Golle P, (2006) pp. 77-80 Revisiting the uniqueness of simple demographics in the US population; 2006.
29. Koot M, Noordende G, de Laat C, (2010) A study on the re-identifiability of Dutch citizens; Workshop on Privacy Enhancing Technologies (PET 2010).
30. Malin B, (2005) Betrayed by my shadow: Learning data identity via trail matching. Journal of Privacy Technology June: 20050609001.
31. Malin BA, Sweeney L, (2005) A secure protocol to distribute unlinkable health data. AMIA Annu Symp Proc pp. 485-489.
32. Homer N, Szelinger S, Redman M, Duggan D, Tembe W, et al. (2008) Resolving individuals contributing trace amounts of DNA to highly complex mixtures using high-density SNP genotyping microarrays. PLoS Genet 4.
33. Jacobs KB, Yeager M, Wacholder S, Craig D, Kraft P, et al. (2009) A new statistic and its power to infer membership in a genome-wide association study using genotype frequencies. Nat Genet 41: 1253-1257.
34. Lin Z, Owen AB, Altman RB, (2004) Genetics. Genomic research and human subject privacy. Science 305: 183-183.
35. Malin BA, (2005) An evaluation of the current state of genomic data privacy protection technology and a roadmap for the future. J Am Med Inform Assoc 12: 28-34.
36. Malin B, Loukides G, Benitez K, Clayton E, (2011) Identifiability in biobanks: models, measures, and mitigation strategies. Human Genetics 130: 383-392.
37. Benitez K, Malin B, (2010) Evaluating re-identification risks with respect to the HIPAA privacy rule. J Am Med Inform Assoc 17: 169-177.
38. The Canadian Internet Policy and Public Interest Clinic (2006) On the Data Trail: How detailed information about you gets into the hands of organizations with whom you have no relationship.
39. El Emam K, (2006) Data Anonymization Practices in Clinical Research: A Descriptive Study Ottawa Health Canada, Access to Information and Privacy Division.
40. UBC Clinical Research Ethics Board, Providence Health Care Research Ethics Board (2003) Interim guidance to clinical researchers regarding compliance with the US Health Insurance Portability and Accountability Act (HIPAA). University of British Columbia.
41. Hryanszkiewicz I, Norton M, Vickers A, Altman D, (2010) Preparing raw clinical data for publications: Guidance for journal editors, authors, and peer reviewers. BMJ 340: c181.
42. Laird N, Mosteller F, (1990) Some statistical Methods for Combining Experimental Results. International Journal of Technology Assessment In Health Care 6: 5-30.
43. Marsh C, Skinner C, Arber S, Penhale B, Openshaw S, et al. (1991) The case for samples of anonymized records from the 1991 census. Journal of the Royal Statistical Society, Series A (Statistics in Society) 154: 305-340.
44. Elliot M, Dale A, (1999) Scenarios of attack: the data intruders perspective on statistical disclosure risk. Netherlands Official Statistics 14: 6-10.
45. Bartlett E, (1993) RMS need to safeguard computerized patient records to protect hospitals. Hospital Risk Management 15.
46. Rosenthal R, (1979) The 'file drawer' problem and tolerance for null results. Phsycological Bulletin 86: 638-641.
47. Mullen B, Muellerleile P, Bryant B, (2001) Cumulative meta-analysis: A consideration of indicators of sufficiency and stability. Personality and Social Psychology Bulletin 27: 1450-1462.
48. Sterne J, Becker B, Egger M, (2005) The funnel plot. In: Rothstein H, Sutton A, Borenstein M, editors. Publication bias in meta-analysis Wiley.
49. Sterne J, Egger M, (2001) Funnel plots for detecting bias in meta-analysis: Guidelines on choice of axis. Journal of Clinical Epidemiology 54: 1046-1055.
50. Liberati A, Altman DG, Tetzlaff J, Mulrow C, Gotzsche PC, et al. (2009) The PRISMA statement for reporting systematic reviews and meta-analyses of studies that evaluate health care interventions: explanation and elaboration. J Clin Epidemiol 62: 1-34.
51. Moher D, Liberati A, Tetzlaff J, Altman DG, (2009) Preferred reporting items for systematic reviews and meta-analyses: the statement. PLoS Med 6: e1000097.
52. The Supreme Court of the State of Illinois (2006) Southern Illinoisan vs. The Illinois Department of Public Health.
53. Federal Court: Canada (2007) Mike Gordon v. the Minister of Health and the Privacy Commissioner of Canada: Memorandum of Fact and Law of the Privacy Commissioner of Canada. Federal Court.
54. Hansell S, (2006) AOL Removes Search Data on Group of Web Users New York Times.
55. Zeller T Jr, (2006) AOL Moves to Increase Privacy on Search Queries. New York Times.
56. Elliot M, (2003) The Evaluation of Risk from Identification Attempts Manchester University of Manchester pp. 1-29.
57. Kwok P, Davern M, Hair E, Lafky D, (2011) Harder than you think: a case study of re-identification risk of HIPAA-compliant records Chicago NORC at The University of Chicago. Abstract #302255.
58. Lafky D, (2010) The Safe Harbor method of de-identification: An empirical test. Fourth National HIPAA Summit West.
59. Gan Q, Attenberg J, Markowetz A, Suel T, (2008) Analysis of geographic queries in a search engine log. Proceedings of the first international workshop on Location and the web Beijing, China ACM.
60. Hassan A, Jones R, Diaz F, (2009) Geographic features in web search retrieval; 2009 ACM.
61. Jones R, Hassan A, Diaz F, (2008) Geographic features in web search retrieval. International Journal of Geographical Information Science 22: 229-246.
62. Jones R, Kumar R, Pang B, Tomkins A, (2007) "I know what you did last summer": query logs and user privacy. Proceedings of the sixteenth ACM conference on Conference on information and knowledge management Lisbon, Portugal ACM.
63. Sanderson M, Kohler J, (2004) Analyzing geographic queries. Workshop on Geographic Information Retrieval SIGIR.
64. Marsh C, Dale A, Skinner C, (1994) Safe data versus safe settings: Access to microdata from the British census. International Statistical Review 62: 35-53.
65. Sweeney L, Data sharing under HIPAA: 12 years later. Workshop on the HIPAA Privacy Rule's De-Identification Standard, March 8-9, 2010 Washington, D.C. U.S. Department of Health and Human Services.
66. National Committee on Vital and Health Statistics (2007) Report to the Secretary of the U.S. Department of Health and Human Services on Enhanced Protections for Uses of Health Data: A Stewardship Framework for "Secondary Uses" of Electronically Collected and Transmitted Health Data.
67. Sweeney L, (2002) k-anonymity: a model for protecting privacy. International Journal on Uncertainty, Fuzziness and Knowledge-based Systems 10: 557-570.
68. Poole C, Greenland S, (1999) Random-effects meta-analyses are not always conservative. American Journal of Epidemiology pp. 469-475.
69. El Emam K, (2010) Methods for the de-identification of electronic health records. Genome Medicine 3: 25.
70. Bender S, Brand R, Bacher J, (2001) Re-identifying register data by survey data: An empirical study. Statistical Journal of the United Nations ECE 18: 373-381.
71. Ochoa S, Rasmussen J, Robson C, Salib M, (2001) Reidentification of individuals in Chicago's homicide database: A technical and legal study. Massachusetts Institute of Technology.
72. Brownstein JS, Cassa CA, Mandl KD, (2006) No place to hide-reverse identification of patients from published maps. N Engl J Med 355: 1741-1742.
73. Frankowski D, Cosley D, Sen S, Terveen L, Riedl J, (2006) You are what you say: Privacy risks of public mentions. SIGIR '06 Seattle ACM.
74. Backstrom, Dwork, Kleinberg, (2007) Wherefore Art Thou R3579X? Anonymized social networks, hidden patterns, and structural steganography. WWW 2007 Banff ACM.
75. El Emam K, Kosseim P, (2009) Privacy Interests in Prescription Data, Part 2: Patient Privacy. Security & Privacy, IEEE 7: 75-78.
76. Narayanan A, Shmatikov V, (2009) De-anonymizing Social Networks. Proc 30th IEEE Symposium on Security and Privacy pp. 173-187.