Estimating the re-identification risk of clinical data sets

BMC Medical Informatics and Decision Making

Volumn 12, Issue 1, 2012, Pages

  Dankar, Fida Kamal ^a   El Emam, Khaled ^a,b   Neisa, Angelica ^a   Roffey, Tyson ^a  

^a CHILDREN S HOSPITAL OF EASTERN ONTARIO   (Canada)

^b UNIVERSITY OF OTTAWA   (Canada)

Author keywords

[No Author keywords available]

Indexed keywords

ARTICLE; CONFIDENTIALITY; ELECTRONIC MEDICAL RECORD; FACTUAL DATABASE; HUMAN; INFORMATION RETRIEVAL; INFORMATION SYSTEM; LEGAL ASPECT; MEDICAL RECORD; ORGANIZATION AND MANAGEMENT;

CONFIDENTIALITY; DATABASES, FACTUAL; HUMANS; INFORMATION MANAGEMENT; INFORMATION STORAGE AND RETRIEVAL; MEDICAL RECORD LINKAGE; MEDICAL RECORDS SYSTEMS, COMPUTERIZED;

EID: 84863508974     PISSN: None     EISSN: 14726947     Source Type: Journal    
DOI: 10.1186/1472-6947-12-66     Document Type: Article

References (95)

1. Beyond the HIPAA Privacy Rule: Enhancing privacy, improving health through research National Academies Press, Washington, DC, Nass S, Levit L, Gostin L, 2009
2. Patients, privacy and trust: Patients' willingness to allow researchers to access their medical records. Damschroder L, Pritts J, Neblo M, Kalarickal R, Creswell J, Hayward R, Soc Sci Med 2007 64 223 235 10.1016/j.socscimed.2006.08. 045 17045717
3. Mayer TS, Privacy and Confidentiality Research and the US Census Bureau: Recommendations based on a review of the literature US Bureau of the Census, Washington, DC 2002
4. Attitudes and Behaviour: The impact of privacy and confidentiality concenrs on participation in the 2000 census. Singer E, van Hoewyk J, Neugebauer RJ, Public Opin Q 2003 67 368 384 10.1086/377465
5. Council.NR:Privacy and Confidentiality as Factors in Survey Response National Academy of Sciences, Washington 1979
6. Privacy Concerns and the Census Long Form: Some evidence from Census 2000. Martin E, Annual Meeting of the American Statistical Association, Washington, DC 2001
7. Privacy fear factor arises. Robeznieks A, Mod Healthc 2005 35 46 6 17899645
8. Technical difficulties: Recent health IT security breaches are unlikely to improve the public's perception about the safety of personal data. Becker C, Taylor M, Mod Healthc 2006 38 8 6 7
9. Office for Civil Rights: Annual report to congress on breaches of unsecured protected health information for calendar years 2009 and 2010 US Department of Health and Human Services, 2011
10. Fienberg S, Martin M, Straf M, Sharing Research Data Committee on National Statistics, National Research Council, 1985
11. Publishing raw data and real time statistical analysis on e-journals. Hutchon D, Br Med J 2001 322 3 530
12. Are journals doing enough to prevent fraudulent publication? Can Med Assoc J 2006 174 4 431
13. Microdata access and labor market research: The US experience. Abraham K, Allegmeines Stat Archiv 2005 89 121 139
14. Whose data set is it anyway ? Sharing raw data from randomized trials. Vickers A, Trials 2006 7 15 10.1186/1745-6215-7-15 16704733
15. Authors should make their data available. Altman D, Cates C, BMJ 2001 323 1069 11713749
16. Whose data are they anyway ? Delamothe T, BMJ 1996 312 1241 1242 10.1136/bmj.312.7041.1241 8634604
17. Increasing the accessibility of data. Smith GD, BMJ 1994 308 1519 1520 10.1136/bmj.308.6943.1519 8019302
18. On scientific information in the digital age: Access, dissemination and preservation, 2007
19. Lowrance W, Access to collections of data and materials for health research: A report to the Medical Research Council and the Wellcome Trust Medical Research Council and the Wellcome Trust, 2006
20. Obtaining access to data from government-sponsored medical research. Yolles B, Connors J, Grufferman S, NEJM 1986 315 26 1669 1672 10.1056/NEJM198612253152608 3785337
21. Ethical issues in sharing epidemiologic data. Hogue C, J Clin Epidemiol 1991 44 Suppl. I 103S 107S 1827649
22. Justifications for the sharing of social science data. Hedrick T, Law Hum Behav 1988 12 2 163 171
23. Mackie C, Bradburn N, Improving access to and confidentiality of research data: Report of a workshop The National Academies Press, Washington 2000
24. Pullman D, Sorry, you can't have that information: Stakeholder awareness, perceptions and concerns regarding the disclosure and use of personal health information. e-Health 2006, 2006 22860355
25. Highlights Report, 2003
26. Alternatives to project-specific consent for access to personal information for health research: What is the opinion of the Canadian public ? Willison D, Schwartz L, Abelson J, Charles C, Swinton M, Northrup D, Thabane L, J Am Med Inform Assoc 2007 14 706 712 10.1197/jamia.M2457 17712084
27. Patients' consent preferences regarding the use of their health information for research purposes: A qualitative study. Nair K, Willison D, Holbrook A, Keshavjee K, J Health Serv Res Policy 2004 9 1 22 27 10.1258/135581904322716076 15006236
28. The use of medical records in research: what do patients want? Kass N, Natowicz M, Hull S, et al. J Law Med Ethics 2003 31 429 433 10.1111/j.1748-720X. 2003.tb00105.x 14626550
29. Patients' attitudes towards sharing their health information. Whiddett R, Hunter I, Engelbrecht J, Handy J, Int J Med Inf 2006 75 530 541 10.1016/j.ijmedinf.2005.08.009
30. Pritts J, The importance and value of protecting the privayc of health information: Roles of HIPAA Privacy Rule and the Common Rule in health research, 2008 Available from: [http://iom.edu/Object.File/Master/53/160/ Pritts%20Privacy%20Final%20Draft%20web.pdf]. Accessed on: July 15, 2009
31. Disclosure control of microdata. Bethlehem J, Keller W, Pannekoek J, J Am Stat Assoc 1990 85 409 38 45 10.1080/01621459.1990.10475304
32. Sweeney L, Uniqueness of Simple Demographics in the US Population Carnegie Mellon University, Laboratory for International Data Privacy, 2000
33. Evaluating Predictors of Geographic Area Population Size Cutoffs to Manage Re-identification Risk. El Emam K, Brown A, Abdelmalik P, J Am Med Inform Assoc 2009 16 2 256 266 [PMID: 19074299] 10.1197/jamia.M2902 19074299
34. Golle P, Revisiting the uniqueness of simple demographics in the US population Workshop on Privacy in the Electronic Society, 2006
35. A method for managing re-identification risk from small geographic areas in Canada. El Emam K, Brown A, AbdelMalik P, Neisa A, Walker M, Bottomley J, Roffey T, BMC Med Inform Decis Mak 2010 10 18 10.1186/1472-6947-10-18 20361870
36. Koot M, Noordende G, de Laat C, A study on the re-identifiability of Dutch citizens. Workshop on Privacy Enhancing Technologies (PET 2010), 2010
37. Standards for privacy of individually identifiable health information Federal Register, 2000 Available from: [http://aspe.hhs.gov/admnsimp/final/ PvcFR06.txt]. Archived at: [http://www.webcitation.org/5tqU5GyQX]
38. Standards for privacy of individually identifiable health information Federal Register, 2000 Available from: [http://aspe.hhs.gov/admnsimp/final/ PvcFR05.txt]. Archived at: [http://www.webcitation.org/5tqULb7hT]
39. Evaluating re-identification risks with respect to the HIPAA privacy rule. Benitez K, Malin B, J Am Med Inform Assoc 2010 17 2 169 177 10.1136/jamia.2009.000026 20190059
40. Canadian Community Health Survey (CCHS) Cycle 3.1 (2005) Public Use Microdata File (PUMF) User Guide, 2006
41. Canadian Community Health Survey: Public Use Microdata File, 2009 Available from: [http://www.statcan.gc.ca/bsolc/olc-cel/olc-cel?catno= 82M0013X&lang=eng]
42. -2001 Census Public Use Microdata File: Individuals file user documentation, 2001
43. Proposals for the 2001 samples of anonymized records: An assessment of disclosure risk. Dale A, Elliot M, J R Stat Soc 2001 164 3 427 447 10.1111/1467-985X.00212
44. The case for samples of anonymized records from the 1991 census. Marsh C, Skinner C, Arber S, Penhale B, Openshaw S, Hobcraft J, Lievesley D, Walford N, J R Stat Soc A Stat Soc 1991 154 2 305 340 10.2307/2983043
45. Safe data versus safe settings: Access to microdata from the British census. Marsh C, Dale A, Skinner C, Int Stat Rev 1994 62 1 35 53 10.2307/1403544
46. De-identifying a Public Use Microdata File from the Canadian National Discharge Abstract Database. El Emam K, Paton D, Dankar F, Koru G, BMC Med Inform Decis Mak 2011 11 53 10.1186/1472-6947-11-53 21861894
47. Protecting privacy using k-anonymity. El Emam K, Dankar F, J Am Med Inform Assoc 2008 15 627 637 10.1197/jamia.M2716 18579830
48. Finding a needle in a haystack or identifying anonymous census records. Dalenius T, J Official Stat 1986 2 3 329 336
49. Evaluating common de-identification heuristics for personal health information. El Emam K, Jabbouri S, Sams S, Drouet Y, Power M, J Med Internet Res 2006 8 4 28 [PMID: 17213047] 10.2196/jmir.8.4.e28 17213047
50. El Emam K, Jonker E, Sams S, Neri E, Neisa A, Gao T, Chowdhury S, Pan-Canadian De-Identification Guidelines for Personal Health Information Privacy Commissioner of Canada, Ottawa 2007
51. CIHR best practices for protecting privacy in health research Canadian Institutes of Health Research, Ottawa 2005
52. Health Informatics: Pseudonymization International Organization for Standardization, Geneva 2008
53. Tragedy of the Commons. Yakowitz J, Harvard J Law Technol 2011 25 1 2 66
54. A measure of disclosure risk for microdata. Skinner G, Elliot M, J R Stat Soc Ser B 2002 64 Part 4 855 867
55. Report to the Secretary of the US Department of Health and Human Services on Enhanced Protections for Uses of Health Data: A Stewardship Framework for "Secondary Uses" of Electronically Collected and Transmitted Health Data, 2007
56. Sweeney L, Data sharing under HIPAA: 12 years later. Workshop on the HIPAA Privacy Rule's De-Identification Standard Department of Health and Human Services, Washington 2010
57. Lafky D, The Safe Harbor method of de-identification: An empirical test. Fourth National HIPAA Summit West, 2010
58. Modeling population uniqueness. Skinner C, Holmes D, Proceedings of the International Seminar on Statistical Confidentiality, 1993
59. Johnson N, Kotz S, Kemp A, Univariate discrete distributions Wiley, Hoboken 2005
60. Some superpopulation models for estimating the number of population uniques. Takemara A, Proceedings of the Conference on Statistical Data Protection, 1999
61. Population genetics theory-the past and the future. Ewens W, Mathematical and statistical development of evolutionary theory New York, Springer, Lessard Kluwer S, 1990 177 227
62. Random discrete distribution invariant under size based permutation. Pitman J, Adv Appl Probability 1996 28 525 539 10.2307/1428070
63. Applying Pitman's sampling formula to microdata disclosure risk assessment. Hoshino N, J Official Stat 2001 17 4 499 520
64. Estimation of identification disclosure risk in microdata. Chen G, Keller-McNulty S, J Official Stat 1998 14 1 79 95
65. Statistical and technological solutions for controlled data dissemination. Benedetti R, Franconi L, Proceedings of New Techniques and Technologies for Statistics (vol. 1), 1998
66. Zayatz L, Estimation of the percent of unique population elements on a microdata file using the sample US Bureau of the Census, Washington 1991
67. Evaluating patient re-identification risk from hospital prescription records. El Emam K, Dankar F, Vaillancourt R, Roffey T, Lysyk M, Can J Hospital Pharm 2009 62 4 307 319
68. Method to assess identifiability in electronic data files. Howe H, Lake A, Shen T, Am J Epidemiol 2007 165 5 597 601 17182982
69. Howe H, Lake A, Lehnherr M, Roney D, Unique record identification on public use files as tested on the 1994-1998 CINA analytic file North American Association of Central Cancer Registries, 2002
70. Heuristics for de-identifying health data. El Emam K, IEEE Security and Privacy 2008 6 4 58 61
71. Seni G, Elder J, Ensemble methods in data mining Morgan & Claypool, San Rafael 2010
72. Hastie T, Tibshirani R, Friedman J, The Elements of Statistical Learning: Data Mining, Inference, and Prediction Springer, New York 2009
73. Breiman L, Friedman J, Olshen R, Stone C, Classification and Regression Trees Wadsworth and Brooks/Cole, Belmont 1984
74. The state experience in health quality data collection National Partnership for Women & Families, Washington DC 2004 Available from http://healthcaredisclosure.org/links/files/DataCollection.pdf
75. Physician privacy concerns when disclosing patient data to public health authorities for disease outbreak surveillance. El Emam K, Mercer J, Moreau K, Grava-Gubins I, Buckeridge D, Jonker E, BMC Public Health 2011 11 454 10.1186/1471-2458-11-454 21658256
76. Alleged LTTE front had voter lists. Bell S, National Post, 2006
77. Privacy chief probes how group got voter lists. Bell S, National Post, 2006
78. Freeze C, Clark C, Voters lists 'most disturbing' items seized in Tamil raids, documents say. Globe and Mail, 2008 Available from: [http://www. theglobeandmail.com/servlet/story/RTGAM.20080507.wxtamilssb07/BNStory/National/ home]. Archived at: [http://www.webcitation.org/5Xe4UWJKP] 11454497
79. The Application of Differential Privacy to Health Data. Dankar F, El Emam K, Proceedings of he 5th International Workshop on Privacy and Anonymity in the Information Society (PAIS), 2012
80. Office of Civil Rights. Breaches Affecting 500 or More Individuals 2010 Available from: [http://www.hhs.gov/ocr/privacy/hipaa/administrative/ breachnotificationrule/postedbreaches.html]
81. A Globally Optimal k-Anonymity Method for the De-identification of Health Data. El Emam K, Dankar F, Issa R, Jonker E, Amyot D, Cogo E, Corriveau J-P, Walker M, Chowdhury S, Vaillancourt R, Roffey T, Bottomley J, J Am Med Inf Assoc 2009 16 5 670 682 10.1197/jamia.M3144
82. Risk-based de-identification of health data. El Emam K, IEEE Security and Privacy 2010 8 3 64 67
83. El Emam K, Method and Experiences of Risk-Based De-identification of Health Information. Workshop on the HIPAA Privacy Rule's De-Identification Standard Department of Health and Human Services, 2010
84. Cavoukian A, El Emam K, A Positive-Sum Paradigm in Action in the Health Sector Office of the Information and Privacy Commissioner of Ontario, 2010
85. Dwork C, McSherry F, Nissim K, Smith A, Calibrating Noise to Sensitivity in Private Data Analysis. 3rd theory of cryptography conference, 2006
86. Differential privacy: A survey of results. Dwork C, Proceedings of the 5th International Conference on Theory and Applications of Models of Computation, 2008
87. Dwork C, Differential Privacy. Automata, Languages and Programming, 2006
88. The Application of Differential Privacy to Health Data. Dankar F, El Emam K, The 5th International Workshop on Privacy and Anonymity in the Information Society (PAIS), 2012
89. Lee J, Clifton C, How Much Is Enough? Choosing epsilon for Differential Privacy Information Security, 2011
90. Sarathy R, Muralidhar K, Some Additional Insights on Applying Differential Privacy for Numeric Data Privacy in Statistical Databases, 2010 210 219
91. Samarati P, Sweeney L, Protecting privacy when disclosing information: k-anonymity and its enforcement through generalisation and suppression SRI International, 1998
92. Protecting respondents' identities in microdata release. Samarati P, IEEE Transactions on Knowledge and Data Engineering 2001 13 6 1010 1027 10.1109/69.971193
93. k-anonymity: a model for protecting privacy. Sweeney L, International Journal on Uncertainty, Fuzziness and Knowledge-based Systems 2002 10 5 557 570 10.1142/S0218488502001648
94. Ciriani V, di Vimercati SSF DC, Samarati P, k-Anonymity, in Secure Data Management in Decentralized Systems Springer, New York 2007
95. Estimating the number of classes in a finite population. Haas P, Stokes L, J Am Stat Assoc 1998 93 444 1475 1487 10.1080/01621459.1998.10473807