Practicing differential privacy in health care: A review

Transactions on Data Privacy

Volumn 6, Issue 1, 2013, Pages 35-67

  Dankar, Fida K ^a   El Emam, Khaled ^a,b  

^a CHILDREN S HOSPITAL OF EASTERN ONTARIO   (Canada)

^b UNIVERSITY OF OTTAWA   (Canada)

Author keywords

[No Author keywords available]

Indexed keywords

ANONYMIZATION; APPROPRIATE MODELS; DIFFERENTIAL PRIVACIES; GENERAL MODEL; HEALTH DATA; PERSONAL INFORMATION; PRIVACY BREACHES;

HEALTH CARE;

DATA PRIVACY;

EID: 84877081683     PISSN: 18885063     EISSN: 20131631     Source Type: Journal    
DOI: None     Document Type: Review

References (77)

1. B.-C. Chen, D. Kifer, K. LeFevre, and A. Machanavajjhala, "Privacy-Preserving Data Publishing," Found. Trends databases, vol. 2, no. 1-2, pp. 1-167, 2009.
2. T. Dalenius, "Towards a methodology for statistical disclosure control," Statistik Tidskrift, vol. 15, no. 429-444, pp. 2-1, 1977.
3. C. Dwork, "Differential Privacy," in Automata, Languages and Programming, vol. 4052, M. Bugliesi, B. Preneel, V. Sassone, and I. Wegener, Eds. Berlin, Heidelberg: Springer Berlin Heidelberg, 2006, pp. 1-12.
4. C. Dwork, F. Mcsherry, K. Nissim, and A. Smith, "Calibrating noise to sensitivity in private data analysis," in Lecture notes in computer science, pp. 265-284, 2006.
5. J. M. Abowd and L. Vilhuber, "How Protective Are Synthetic Data?," in Proceedings of the UNESCO Chair in data privacy international conference on Privacy in Statistical Databases, Berlin, Heidelberg, 2008, pp. 239-246.
6. C. Dwork, "Differential privacy: a survey of results," in Proceedings of the 5th international conference on Theory and applications of models of computation, Berlin, Heidelberg, 2008, pp. 1-19.
7. R. Sarathy and K. Muralidhar, "Evaluating Laplace Noise Addition to Satisfy Differential Privacy for Numeric Data," Transactions on Data Privacy, vol. 4, no. 1, pp. 1-17, 2011.
8. F. McSherry and K. Talwar, "Mechanism Design via Differential Privacy," in Proceedings of the 48th Annual IEEE Symposium on Foundations of Computer Science, Washington, DC, USA, 2007, pp. 94-103.
9. P. Kodeswaran and E. Viegas, "Applying Differential Privacy to Search Queries in a Policy Based Interactive Framework," in Proceedings of the ACM International Workshop on Privacy and Annonymity for Very Large Datasets, November 2009.
10. X. Xiao, G. Wang, and J. Gehrke, "Differential privacy via wavelet transforms," Knowledge and Data Engineering, IEEE Transactions on, vol. 23, no. 8, pp. 1200-1214, 2011.
11. N. Li, W. H. Qardaji, and D. Su, "Provably private data anonymization: Or, k-anonymity meets differential privacy," CoRR, abs/1101.2604, 2011.
12. A. Friedman and A. Schuster, "Data mining with differential privacy," in Proceedings of the 16th ACM SIGKDD international conference on Knowledge discovery and data mining, 2010, pp. 493-502.
13. J. Lee and C. Clifton, "How Much Is Enough? Choosing epsilon for Differential Privacy," in Information Security, vol. 7001, X. Lai, J. Zhou, and H. Li, Eds. Springer Berlin/Heidelberg, 2011, pp. 325-340.
14. S. P. Kasiviswanathan, M. Rudelson, A. Smith, and J. Ullman, "The price of privately releasing contingency tables and the spectra of random matrices with correlated rows," in Proceedings of the 42nd ACM symposium on Theory of computing, New York, NY, USA, 2010, pp. 775-784.
15. J. Lee and C. Clifton, "Differential identifiability," in Proceedings of the 18th ACM SIGKDD international conference on Knowledge discovery and data mining, New York, NY, USA, 2012, pp. 1041-1049.
16. S. P. Kasiviswanathan and A. Smith, "A Note on Differential Privacy: Defining Resistance to Arbitrary Side Information," arXiv:0803.3946, Mar. 2008.
17. A. Roth and T. Roughgarden, "Interactive privacy via the median mechanism," in Proceedings of the 42nd ACM symposium on Theory of computing, New York, NY, USA, 2010, pp. 765-774.
18. C. Li and G. Miklau, "An adaptive mechanism for accurate query answering under differential privacy," Proceedings of the VLDB Endowment, vol. 5, no. 6, pp. 514-525, 2012.
19. A. Blum, K. Ligett, and A. Roth, "A learning theory approach to noninteractive database privacy," in Proceedings of the 40th annual ACM symposium on Theory of computing, New York, NY, USA, 2008, pp. 609-618.
20. Y. Xiao, L. Xiong, and C. Yuan, "Differentially private data release through multidimensional partitioning," Secure Data Management, pp. 150-168, 2010.
21. G. Cormode, M. Procopiuc, D. Srivastava, and T. T. L. Tran, "Differentially Private Publication of Sparse Data," ArXiv:1103.0825, Mar. 2011.
22. B. Ding, M. Winslett, J. Han, and Z. Li, "Differentially private data cubes: optimizing noise sources and consistency," in Proceedings of the 2011 ACM SIGMOD International Conference on Management of data, New York, NY, USA, 2011, pp. 217-228.
23. M. Hardt and K. Talwar, "On the geometry of differential privacy," in Proceedings of the 42nd ACM symposium on Theory of computing, 2010, pp. 705-714.
24. Y. D. Li, Z. Zhang, M. Winslett, and Y. Yang, "Compressive mechanism: Utilizing sparse representation in differential privacy," in Proceedings of the 10th annual ACM workshop on Privacy in the electronic society, 2011, pp. 177-182.
25. D. Leoni, "Non-Interactive Differential Privacy: a Survey," in Proc. of 1st Int. Workshop on Open Data, Nantes, France, 2012.
26. A. Roth, "New algorithms for preserving differential privacy," Microsoft Research, 2010.
27. A. Blum and A. Roth, "Fast Private Data Release Algorithms for Sparse Queries," CORD Conference Proceedings, Nov. 2011.
28. I. Dinur and K. Nissim, "Revealing information while preserving privacy," in Proceedings of the twenty-second ACM SIGMOD-SIGACTSIGART symposium on Principles of database systems, New York, NY, USA, 2003, pp. 202-210.
29. C. Dwork, M. Naor, O. Reingold, G. N. Rothblum, and S. Vadhan, "On the complexity of differentially private data release: efficient algorithms and hardness results," in Proceedings of the 41st annual ACM symposium on Theory of computing, New York, NY, USA, 2009, pp. 381-390.
30. C. Li, M. Hay, V. Rastogi, G. Miklau, and A. McGregor, "Optimizing linear counting queries under differential privacy," in Proceedings of the twenty-ninth ACM SIGMOD-SIGACT-SIGART symposium on Principles of database systems, New York, NY, USA, 2010, pp. 123-134.
31. M. Hardt and G. N. Rothblum, "A Multiplicative Weights Mechanism for Privacy-Preserving Data Analysis," in Foundations of Computer Science, IEEE Annual Symposium on, Los Alamitos, CA, USA, 2010, vol. 0, pp. 61-70.
32. N. Mohammed, R. Chen, B. C. M. Fung, and P. S. Yu, "Differentially private data release for data mining," in Proceedings of the 17th ACM SIGKDD international conference on Knowledge discovery and data mining, New York, NY, USA, 2011, pp. 493-501.
33. B. Barak, K. Chaudhuri, C. Dwork, S. Kale, F. McSherry, and K. Talwar, "Privacy, accuracy, and consistency too: a holistic solution to contingency table release," in Proceedings of the twenty-sixth ACM SIGMOD-SIGACTSIGART symposium on Principles of database systems, New York, NY, USA, 2007, pp. 273-282.
34. S. E. Fienberg, A. Rinaldo, and X. Yang, "Differential privacy and the riskutility tradeoff for multi-dimensional contingency tables," in Proceedings of the 2010 international conference on Privacy in statistical databases, Berlin, Heidelberg, 2010, pp. 187-199.
35. W. Winkler, "General Discrete-data Modeling Methods for Producing Synthetic Data with Reduced Re-identification Risk that Preserve Analytic Properties," Research Report Series Statistics 2010-02, 2008.
36. S. E. Fienberg and A. B. Slavkovic, "A Survey of Statistical Approaches to Preserving Confidentiality of Contingency Table Entries," in Privacy-Preserving Data Mining, vol. 34, C. C. Aggarwal and P. S. Yu, Eds. Boston, MA: Springer US, 2008, pp. 291-312.
37. A. Dobra, S. E. Fienberg, A. Rinaldo, A. Slavkovic, and Y. Zhou, "Albebraic Statistics and Contingency Table Problems: Log-Linear Models, Likelihood Estimation, and Disclosure Limitation," Emerging applications of algebraic geometry, pp. 1-26, 2009.
38. R. Chen, N. Mohammed, B. C. M. Fung, B. C. Desai, and L. Xiong, "Publishing Set-Valued Data via Differential Privacy.," PVLDB, vol. 4, no. 11, pp. 1087-1098, 2011.
39. B. C. M. Fung, K. Wang, and P. S. Yu, "Anonymizing classification data for privacy preservation," IEEE Transactions on Knowledge and Data Engineering, vol. 19, p. 2007, 2007.
40. H. Zang and J. Bolot, "Anonymization of Location Data Does Not Work: A Large-Scale Measurement Study," presented at the Proc. of ACM Mobicom, 2011.
41. M. Goetz, A. Machanavajjhala, G. Wang, X. Xiao, and J. Gehrke, "Privacy in Search Logs," ArXiv:0904.0682, Apr. 2009.
42. A. Korolova, K. Kenthapadi, N. Mishra, and A. Ntoulas, "Releasing search queries and clicks privately," in Proceedings of the 18th international conference on World wide web, 2009, pp. 171-180.
43. F. McSherry and I. Mironov, "Differentially private recommender systems: building privacy into the net," in Proceedings of the 15th ACM SIGKDD international conference on Knowledge discovery and data mining, 2009, pp. 627-636.
44. Y. Wang, X. Wu, J. Zhu, and Y. Xiang, "On Learning Cluster Coefficient of Private Networks," in Proceedings of the IEEE/ACM International Conference on Advances in Social Networks Analysis and Mining (ASONAM).
45. A. Inan, M. Kantarcioglu, G. Ghinita, and E. Bertino, "Private record matching using differential privacy," in Proceedings of the 13th International Conference on Extending Database Technology, New York, NY, USA, 2010, pp. 123-134.
46. D. Feldman, A. Fiat, H. Kaplan, and K. Nissim, "Private coresets," in Proceedings of the 41st annual ACM symposium on Theory of computing, 2009, pp. 361-370.
47. C. Dwork, "An ad omnia approach to defining and achieving private data analysis," in Proceedings of the 1st ACM SIGKDD international conference on Privacy, security, and trust in KDD, 2007, pp. 1-13.
48. K. Muralidhar and R. Sarathy, "Does Differential Privacy Protect Terry Gross' Privacy?," in Privacy in Statistical Databases, vol. 6344, J. Domingo-Ferrer and E. Magkos, Eds. Springer Berlin/Heidelberg, 2011, pp. 200-209.
49. M. M. Baig, J. Li, J. Liu, and H. Wang, "Cloning for privacy protection in multiple independent data publications," in Proceedings of the 20th ACM international conference on Information and knowledge management, New York, NY, USA, 2011, pp. 885-894.
50. J. Domingo-Ferrer, "Risk-Utility Paradigms for Statistical Disclosure Limitation: How to Think, But Not How to Act-Discussion: A Science of Statistical Disclosure Limitation," International Statistical Review, vol. 79, no. 2, pp. 184-186, 2011.
51. R. Sarathy and K. Muralidhar, "Some Additional Insights on Applying Differential Privacy for Numeric Data," in Privacy in Statistical Databases, vol. 6344, J. Domingo-Ferrer and E. Magkos, Eds. Berlin, Heidelberg: Springer Berlin Heidelberg, 2010, pp. 210-219.
52. M. yin, "http://blog.myplaceinthecrowd.org/2010/05/26/recap-and-proposal-955-the-statistically-insignificant-privacy-guarantee/." 2010.
53. G. Cormode, C. Procopiuc, D. Srivastava, E. Shen, and T. Yu, "Differentially private spatial decompositions," in Data Engineering (ICDE), 2012 IEEE 28th International Conference on, 2012, pp. 20-31.
54. D. Kifer and A. Machanavajjhala, "No free lunch in data privacy," in Proceedings of the 2011 international conference on Management of data, 2011, pp. 193-204.
55. V. Rastogi and S. Nath, "Differentially private aggregation of distributed time-series with transformation and encryption," in Proceedings of the 2010 international conference on Management of data, 2010, pp. 735-746.
56. T.-H. H. C. Elaine Shi, "Privacy-Preserving Aggregation of Time-Series Data.," NDSS, 2011.
57. E. Rieffel, J. Biehl, W. van Melle, and A. J. Lee, "Secured histories: computing group statistics on encrypted data while preserving individual privacy," ArXiv preprint arXiv:1012.2152, 2010.
58. F. Dankar, K. E. Emam, A. Neisa, and T. Roffey, "Estimating the reidentification risk of clinical data sets," BMC Medical Informatics and Decision Making, vol. 12, no. 1, p. 66, Jul. 2012.
59. K. El Emam, D. Paton, F. Dankar, and G. Koru, "De-identifying a Public Use Microdata File from the Canadian National Discharge Abstract Database," BMC Medical Informatics and Decision Making, vol. 11, no. 53, 2011.
60. K. El Emam, F. Dankar, R. Issa, E. Jonker, D. Amyot, E. Cogo, J.-P. Corriveau, M. Walker, S. Chowdhury, R. Vaillancourt, T. Roffey, and J. Bottomley, "A Globally Optimal k-Anonymity Method for the Deidentification of Health Data," Journal of the American Medical Informatics Association, vol. 16, no. 5, pp. 670-682, 2009.
61. K. El Emam, F. Dankar, R. Vaillancourt, T. Roffey, and M. Lysyk, "Evaluating Patient Re-identification Risk from Hospital Prescription Records," Canadian Journal of Hospital Pharmacy, vol. 62, no. 4, pp. 307-319, 2009.
62. F. Dankar and K. El Emam, "A Method for Evaluating Marketer Reidentification Risk," in Proceedings of the 3rd International Workshop on Privacy and Anonymity in the Information Society, 2010.
63. K. El Emam, J. Hu, S. Samet, L. Peyton, C. Earle, G. Jayaraman, T. Wong, M. Kantarcioglu, and F. Dankar, "A Protocol for the Secure Linking of Registries for HPV Surveillance," PLoS ONE, vol. 7, no. 7, 2012.
64. K. El Emam and F. K. Dankar, "Protecting Privacy Using k-Anonymity," J Am Med Inform Assoc, vol. 15, no. 5, pp. 627-637, 2008.
65. K. E. Emam, J. Mercer, K. Moreau, I. Grava-Gubins, D. Buckeridge, and E. Jonker, "Physician privacy concerns when disclosing patient data for public health purposes during a pandemic influenza outbreak," BMC Public Health, vol. 11, no. 1, p. 454, Jun. 2011.
66. K. El Emam, A. Brown, and P. AbdelMalik, "Evaluating predictors of geographic area population size cut-offs to manage re-identification risk," Journal of the American Medical Informatics Association, vol. 16, no. 2, pp. 256-266, 2009.
67. K. El Emam, "Heuristics for de-identifying health data," IEEE Security and Privacy, pp. 72-75, 2008.
68. F. K. Dankar and K. El Emam, "The application of differential privacy to health data," in Proceedings of the 2012 Joint EDBT/ICDT Workshops, 2012, pp. 158-166.
69. K. El Emam, Guidelines for the de-identification of health information. CRC Press, 2013.
70. M. Allison, "Reinventing clinical trials," Nature Biotechnology, vol. 30, no. 1, pp. 41-49, Jan. 2012.
71. OFFICE OF INSPECTOR GENERAL, "Recruiting Human Subjects: Pressures in Industry-Sponsored Clinical Research," Department of Health and Human Services, 2003.
72. A. Silversides, "Clinical Trials: The Muddled Canadian Landscape," CMAJ, vol. 180, no. 1, pp. 20-22, Jan. 2009.
73. OFFICE OF INSPECTOR GENERAL, "The Globalization of Clinical Trials: A Growing Challenge in Protecting Human Subjects," Department of Health and Human Services, 2001.
74. F. A. Thiers, A. J. Sinskey, and E. R. Berndt, "Trends in the globalization of clinical trials," Nature Reviews Drug Discovery, vol. 7, no. 1, pp. 13-14, Jan. 2008.
75. S. N. Murphy, M. E. Mendis, D. A. Berkowitz, I. Kohane, and H. C. Chueh, "Integration of Clinical and Genetic Data in the i2b2 Architecture," AMIA Annu Symp Proc, vol. 2006, p. 1040, 2006.
76. H. J. Lowe, T. A. Ferris, P. M. Hernandez, and S. C. Weber, "STRIDE - An Integrated Standards-Based Translational Research Informatics Platform," AMIA Annu Symp Proc, vol. 2009, pp. 391-395, 2009.
77. S. A. Vinterbo, A. D. Sarwate, and A. A. Boxwala, "Protecting Count Queries in Study Design," J Am Med Inform Assoc, Apr. 2012.