Publishing data from electronic health records while preserving privacy: A survey of algorithms

Journal of Biomedical Informatics

Volumn 50, Issue , 2014, Pages 4-19

  Gkoulalas Divanis, Aris ^a   Loukides, Grigorios ^b   Sun, Jimeng ^c  

^a IBM RESEARCH   (Ireland)

^b CARDIFF UNIVERSITY   (United Kingdom)

^c IBM T J WATSON RESEARCH CENTER   (United States)

Author keywords

Algorithms; Anonymization; Electronic health records; Privacy; Survey

Indexed keywords

DATA PRIVACY; DISEASE CONTROL; HOSPITAL DATA PROCESSING; RECORDS MANAGEMENT; SURVEYING; SURVEYS;

ANONYMIZATION; CLINICAL TRIAL; ELECTRONIC HEALTH RECORD; ELECTRONIC HEALTH RECORD (EHRS); EPIDEMIC CONTROL; MEDICAL STUDIES; PRIVACY PRESERVING; PRIVACY THREATS;

ALGORITHMS;

ALGORITHM; ELECTRONIC MEDICAL RECORD; HEALTH CARE PERSONNEL; HEALTH CARE POLICY; HUMAN; IDENTITY; INTERPERSONAL COMMUNICATION; MEDICAL INFORMATICS; MOTIVATION; PATIENT CODING; PATIENT INFORMATION; PRIORITY JOURNAL; PRIVACY; PUBLISHING; REVIEW; THREAT;

ALGORITHMS; ELECTRONIC HEALTH RECORDS; PRIVACY; TRUTH DISCLOSURE;

EID: 84905223399     PISSN: 15320464     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.jbi.2014.06.002     Document Type: Review

References (131)

1. EU Data Protection Directive 95/46/ECK; 1995.
2. UK Data Protection Act; 1998.
3. Personal Information Protection and Electronic Documents Act; 2000.
4. Adam N.R., Worthmann J.C. Security-control methods for statistical databases: a comparative study. ACM Comput Surv 1989, 21(4):515-556.
5. Aggarwal C.C., Yu P.S. Privacy-preserving data mining: models and algorithms 2008, Springer.
6. Aggarwal G., Kenthapadi F., Motwani K., Panigrahy R., Thomasand D., Zhu A. Approximation algorithms for k-anonymity. Journal of Privacy Technology 2005.
7. Agrawal R, Srikant R. Fast algorithms for mining association rules in large databases. In: VLDB; 1994. p. 487-99.
8. Baldi P, Baronio R, De Cristofaro E, Gasti P, Tsudik G. Countering GATTACA: efficient and secure testing of fully-sequenced human genomes. In: Proceedings of the 18th ACM conference on computer and communications security, CCS '11; 2011. p. 691-702.
9. Bayardo RJ, Agrawal R. Data privacy through optimal k-anonymization. In: 21st ICDE; 2005. p. 217-28.
10. Benitez K, Loukides G, Malin B. Beyond safe harbor: automatic discovery of health information de-identification policy alternatives. In: ACM international health informatics symposium; 2010. p. 163-72.
11. Berchtold S, Keim DA, Kriegel H. The x-tree: an index structure for high-dimensional data. In: VLDB; 1996. p. 28-39.
12. Berman J.J. Concept-match medical data scrubbing. Arch Pathol Lab Med 2003, 127(6):680-686.
13. Bhagwan V, Grandison T, Maltzahn C. Recommendation-based de-identification: a practical systems approach towards de-identification of unstructured text in healthcare. In: Proceedings of the 2012 IEEE eighth world congress on services, SERVICES '12; 2012. p. 155-62.
14. Burges C.J.C. A tutorial on support vector machines for pattern recognition. Data Min Knowl Discov 1998, 2(2):121-167.
15. Byun J, Kamra A, Bertino E, Li N. Efficient k-anonymization using clustering techniques. In: DASFAA; 2007. p. 188-200.
16. Cao J., Karras P., Raïssi C., Tan K. rho-uncertainty: inference-proof transaction anonymization. Pvldb 2010, 3(1):1033-1044.
17. Cassa C.A., Schmidt B., Kohane I.S., Mandl K.D. My sister's keeper? Genomic research and the identifiability of siblings. BMC Med Genom 2008, 1:32.
18. Chakaravarthy VT, Gupta H, Roy P, Mohania MK. Efficient techniques for document sanitization. In: Proceedings of the 17th ACM conference on information and knowledge management; 2008. p. 843-52.
19. Chen B, Ramakrishnan R, LeFevre K. Privacy skyline: privacy with multidimensional adversarial knowledge. In: VLDB; 2007. p. 770-81.
20. Chen R., Mohammed N., Fung B.C.M., Desai B.C., Xiong L. Publishing set-valued data via differential privacy. Pvldb 2011, 4(11):1087-1098.
21. Cormode G. Personal privacy vs population privacy: learning to attack anonymization. In: KDD; 2011. p. 1253-61.
22. Dean B.B., Lam J., Natoli J.L., Butler Q., Aguilar D., Nordyke R.J. Use of electronic medical records for health outcomes research: a literature review. Med Care Res Rev 2010, 66(6):611-638.
23. De Capitani di Vimercati S., Foresti S., Livraga G., Samarati P. Data privacy: definitions and techniques. Int J Uncertainty, Fuzz Knowl-Based Syst 2012, 20(6):793-818.
24. Domingo-Ferrer J., Mateo-Sanz J.M. Practical data-oriented microaggregation for statistical disclosure control. IEEE Trans Knowl Data Eng 2002, 14(1):189-201.
25. Domingo-Ferrer J., Torra V. Ordinal, continuous and heterogeneous k-anonymity through microaggregation. Dmkd 2005, 11(2):195-212.
26. Domingo-Ferrer J., Martínez-Ballesté A., Mateo-Sanz J., Sebé F. Efficient multivariate data-oriented microaggregation. VLDB J 2006, 15(4):355-369.
27. Du W, Teng Z, Zhu Z. Privacy-maxent: integrating background knowledge in privacy quantification. In: SIGMOD; 2008. p. 459-72.
28. Du Y, Xia T, Tao Y, Zhang D, Zhu F. On multidimensional k-anonymity with local recoding generalization. In: ICDE '07; 2007. p. 1422-4.
29. Dwork C. Differential privacy. In: ICALP; 2006. p. 1-12.
30. Dwork C. Differential privacy: a survey of results. In: TAMC; 2008. p. 1-19.
31. Dwork C, Kenthapadi K, McSherry F, Mironov I, Naor M. Our data, ourselves: privacy via distributed noise generation. In: Proceedings of the 24th annual international conference on the theory and applications of cryptographic techniques, EUROCRYPT'06; 2006. p. 486-503.
32. El Emam K., Dankar F., Issa R., Jonker E., et al. A globally optimal k-anonymity method for the de-identification of health data. J Am Med Informat Assoc 2009, 16(5):670-682.
33. El Emam K., Jonker E., Arbuckle L., Malin B. A systematic review of re-identification attacks on health data. PLoS ONE 2011, 6(12). [e28071, 12].
34. El Emam K., Dankar F.K. Protecting privacy using k-anonymity. J Am Med Informat Assoc 2008, 15(5):627-637.
35. El Emam K., Buckeridge D., Tamblyn R., Neisa A., Jonker E., Verma A. The re-identification risk of canadians from longitudinal demographics. BMC Med Informat Dec Mak 2011, 11(46).
36. Fernandez-Aleman J., Senor I., Oliver Lozoya P.A., Toval A. Security and privacy in electronic health records: a systematic literature review. J Biomed Informat 2013, 46(3):541-562.
37. Fienberg SE, Slavkovic A, Uhler C. Privacy preserving GWAS data sharing. In: IEEE ICDM worksops; 2011. p. 628-35.
38. Filho Y.V. Optimal choice of discriminators in a balanced k-d binary search tree. Inf Process Lett 1981, 13(2):67-70.
39. Fung B.C.M., Wang K., Chen R., Yu P.S. Privacy-preserving data publishing: a survey on recent developments. ACM Comput Surv 2010, 42.
40. Fung BCM, Wang K, Yu PS. Top-down specialization for information and privacy preservation. In: ICDE; 2005. p. 205-16.
41. Fung B.C.M., Wang K., Wang L., Hung P.C.K. Privacy-preserving data publishing for cluster analysis. Data Knowl Eng 2009, 68(6):552-575.
42. Gardner J.J., Xiong L., Xiao Y., Gao J., Post A.R., Jiang X., et al. Share: system design and case studies for statistical health information release. Jamia 2013, 20(1):109-116.
43. Handbook of database security - applications and trends 2008, Springer. M. Gertz, S. Jajodia (Eds.).
44. Ghinita G, Karras P, Kalnis P, Mamoulis N. Fast data anonymization with low information loss. In: Proceedings of the 33rd international conference on very large data bases, VLDB '07; 2007. p. 758-69.
45. Gionis A, Mazza A, Tassa T. k-Anonymization revisited. In: ICDE; 2008. p. 744-53.
46. Gkoulalas-Divanis A, Loukides G. PCTA: privacy-constrained clustering-based transaction data anonymization. In: EDBT PAIS; 2011. p. 5.
47. Gkoulalas-Divanis A, Loukides G. Revisiting sequential pattern hiding to enhance utility. In: KDD; 2011. p. 1316-24.
48. Gkoulalas-Divanis A., Verykios V.S. Hiding sensitive knowledge without side effects. Knowl Inf Syst 2009, 20(3):263-299.
49. Guha S, Rastogi R, Shim K. Cure: an efficient clustering algorithm for large databases. In: SIGMOD; 1998. p. 73-84.
50. Gupta D., Saul M., Gilbertson J. Evaluation of a deidentification (De-Id) software engine to share pathology reports and clinical documents for research. Am J Clin Pathol 2004, 121(2):176-186.
51. Gwadera R, Gkoulalas-Divanis A, Loukides G. Permutation-based sequential pattern hiding. In: IEEE international conference on data mining (ICDM); 2013. p. 241-50.
52. He Y., Naughton J.F. Anonymization of set-valued data via top-down, local generalization. Pvldb 2009, 2(1):934-945.
53. Hettich S, Merz CJ. UCI repository of machine learning databases; 1998.
54. Homer N., Szelinger S., Redman M., et al. Resolving individuals contributing trace amounts of dna to highly complex mixtures using high-density SNP genotyping microarrays. PLoS Genet 2008, 4(8):e1000167.
55. Hore B, Jammalamadaka RC, Mehrotra S. Flexible anonymization for privacy preserving data publishing: a systematic search based approach. In: SDM; 2007.
56. Hsiao CJ, Hing E. Use and characteristics of electronic health record systems among office-based physician practices: United States, 2001-2012. NCHS data brief; 2012. p. 1-8.
57. Iwuchukwu T, Naughton JF. k-Anonymization as spatial indexing: toward scalable and incremental anonymization. In: VLDB; 2007. p. 746-57.
58. Iyengar VS. Transforming data to satisfy privacy constraints. In: KDD; 2002. p. 279-88.
59. Jiang W, Murugesan M, Clifton C, Si L. t-Plausibility: semantic preserving text sanitization. In: CSE '09. International conference on computational science and engineering, 2009. vol. 3; 2009. p. 68-75.
60. Koudas N, Zhang Q, Srivastava D, Yu T. Aggregate query answering on anonymized tables. In: ICDE '07; 2007. p. 116-25.
61. Lafferty JD, McCallum A, Pereira FCN. Conditional random fields: probabilistic models for segmenting and labeling sequence data. In: Proceedings of the eighteenth international conference on machine learning, ICML '01; 2001. p. 282-9.
62. Laszlo M., Mukherjee S. Minimum spanning tree partitioning algorithm for microaggregation. IEEE Trans Knowl Data Eng 2005, 17(7):902-911.
63. Lau E.C., Mowat F.S., Kelsh M.A., Legg J.C., Engel-Nitz N.M., Watson H.N., et al. Use of electronic medical records (EMR) for oncology outcomes research: assessing the comparability of EMR information to patient registry and health claims data. Clin Epidemiol 2011, 3(1):259-272.
64. LeFevre K., DeWitt D.J., Ramakrishnan R. Workload-aware anonymization techniques for large-scale datasets. Tods 2008, 33(3).
65. LeFevre K, DeWitt DJ, Ramakrishnan R. Incognito: efficient full-domain k-anonymity. In: SIGMOD; 2005. p. 49-60
66. LeFevre K, DeWitt DJ, Ramakrishnan R. Mondrian multidimensional k-anonymity. In: ICDE; 2006. p. 25.
67. LeFevre K, DeWitt DJ, Ramakrishnan R. Workload-aware anonymization. In: KDD; 2006. p. 277-86.
68. Li J, Wong R, Fu A, Pei J, Achieving -anonymity by clustering in attribute hierarchical structures. In: DaWaK; 2006. p. 405-416.
69. Li N, Li T, Venkatasubramanian S. t-Closeness: privacy beyond k-anonymity and l-diversity. In: ICDE; 2007. p. 106-15.
70. Li N., Li T., Venkatasubramanian S. Closeness: a new privacy measure for data publishing. IEEE Trans Knowl Data Eng 2010, 22(7):943-956.
71. Li N., Tripunitara M.V. Security analysis in role-based access control. ACM Trans Inf Syst Secur 2006, 9(4):391-420.
72. Li T, Li N. Injector: mining background knowledge for data anonymization. In: ICDE; 2008. p. 446-55.
73. Lindell Y, Pinkas B. Privacy preserving data mining. 2000. p. 36-54.
74. Liu J, Wang K. Anonymizing transaction data by integrating suppression and generalization. In: Proceedings of the 14th Pasific-Asia conference on advances in knowledge discovery and data mining, PAKDD '10; 2010. p. 171-80.
75. Loukides G., Denny J.C., Malin B. The disclosure of diagnosis codes can breach research participants' privacy. J Am Med Informat Assoc 2010, 17:322-327.
76. Loukides G., Gkoulalas-Divanis A., Malin B. Anonymization of electronic medical records for validating genome-wide association studies. Proc Nat Acad Sci 2010, 17(107):7898-7903.
77. Loukides G., Gkoulalas-Divanis A., Malin B. An integrative framework for anonymizing clinical and genomic data. Database technology for life sciences and medicine 2010, World Scientific, p. 65-89 [chapter 8].
78. Loukides G., Gkoulalas-Divanis A., Malin B. COAT: constraint-based anonymization of transactions. Knowl Inf Syst 2011, 28(2):251-282.
79. Loukides G, Gkoulalas-Divanis A, Shao J. Anonymizing transaction data to eliminate sensitive inferences. In: DEXA; 2010. p. 400-415.
80. Loukides G., Gkoulalas-Divanis A., Shao J. Efficient and flexible anonymization of transaction data. Knowl Inf Syst 2013, 36(1):153-210.
81. Loukides G, Shao J. Capturing data usefulness and privacy protection in k-anonymisation. In: SAC; 2007. p. 370-4.
82. Loukides G, Shao J. Clustering-based k-anonymisation algorithms. In: DEXA; 2007. p. 761-71.
83. Loukides G., Shao J. An efficient clustering algorithm for - anonymisation. J Comput Sci Technol 2008, 23(2):188-202.
84. Loukides G., Shao J. Preventing range disclosure in k-anonymised data. Expert Syst Appl 2011, 38(4):4559-4574.
85. Loukides G, Tziatzios A, Shao J. Towards preference-constrained -anonymisation. In: DASFAA international workshop on privacy-preserving data analysis (PPDA); 2009. p. 231-45.
86. Loukides G., Gkoulalas-Divanis A. Utility-preserving transaction data anonymization with low information loss. Expert Syst Appl 2012, 39(10):9764-9777.
87. Loukides G., Gkoulalas-Divanis A. Utility-aware anonymization of diagnosis codes. IEEE J Biomed Health Informat 2013, 17(1):60-70.
88. Machanavajjhala A, Gehrke J, Kifer D, Venkitasubramaniam M. l-Diversity: privacy beyond k-anonymity. In: ICDE; 2006. p. 24.
89. Mailman M.D., Feolo M., Jin Y., Kimura M., Tryka K., Bagoutdinov R., et al. The NCBI dbGaP database of genotypes and phenotypes. Nat Genet 2007, 39:1181-1186.
90. Makoul G., Curry R.H., Tang P.C. The use of electronic medical records communication patterns in outpatient encounters. J Am Med Informat Assoc 2001, 8(6):610-615.
91. Malin B., Karp D., Scheuermann R.H. Technical and policy approaches to balancing patient privacy and data sharing in clinical and translational research. J Invest Med: Off Pub Am Fed Clin Res 2010, 58(1):11-18.
92. Malin B., Loukides G., Benitez K., Clayton E.W. Identifiability in biobanks: models, measures, and mitigation strategies. Hum Genet 2011, 130(3):383-392.
93. Malin B., Loukides G., Benitez K., Clayton E.W. Identifiability in biobanks: models, measures, and mitigation strategies. Hum Genet 2011, 130(3):383-392.
94. Meystre S.M., Friedlin F.J., South B.R., Shen S., Samore M.H. Automatic de-identification of textual documents in the electronic health record: a review of recent research. BMC Med Res Methodol 2010, 10(70).
95. Mironov I, Pandey O. Reingold O, Vadhan S. Computational differential privacy. In: Proceedings of the 29th annual international cryptology conference on advances in cryptology, CRYPTO '09; 2009. p. 126-42.
96. Mohammed N, Chen R, Fung BCM, Yu PS. Differentially private data release for data mining. In: KDD; 2011. p. 493-501.
97. Moon B., Jagadish H.v., Faloutsos C., Saltz J.H. Analysis of the clustering properties of the hilbert space-filling curve. IEEE Trans Knowl Data Eng 2001, 13(1):124-141.
98. Ruffolo M, Angiulli F, Pizzuti C. Descry: a density based clustering algorithm for very large dataset. In: 5th International conference on intelligent data engineering and automated learning (IDEAL'04); 2004. p. 25-7.
99. Narayanan A, Shmatikov V. Robust de-anonymization of large sparse datasets. In: IEEE S&P, 2008, p. 111-125.
100. Nergiz ME, Atzori M, Clifton C. Hiding the presence of individuals from shared databases. In: SIGMOD '07; 2007. p. 665-676.
101. Nergiz M.E., Clifton C. d-presence without complete world knowledge. Tkde 2010, 22(6):868-883.
102. Nergiz M.E., Clifton C. Thoughts on k-anonymization. Dke 2007, 63(3):622-645.
103. Nergiz M.E., Clifton C. δ-presence without complete world knowledge. IEEE Trans Knowl Data Eng 2010, 22(6):868-883.
104. Ollier W.E.R., Sprosen T., Peakman T. UK biobank: from concept to reality. Pharmacogenomics 2005, 6(6):639-646.
105. Poulis G, Loukides G, Gkoulalas-Divanis A, Skiadopoulos S. Anonymizing data with relational and transaction attributes. In: Machine learning and knowledge discovery in databases - european conference (ECML/PKDD) (3); 2013. p. 353-69.
106. Press W.H., Teukolsky S.A., Vetterling W.T., Flannery B.P. Numerical recipes in C the art of scientific computing. Cambridge University Press. 2nd ed. Cambridge University Press 1992.
107. Reis B.Y., Kohane I.S., Mandl K.D. Longitudinal histories as predictors of future diagnoses of domestic abuse: modelling study. Bmj 2009, 339(9).
108. Rothstein M., Epps P. Ethical and legal implications of pharmacogenomics. Nat Rev Genet 2001, 2:228-231.
109. Samarati P. Protecting respondents identities in microdata release. Tkde 2001, 13(9):1010-1027.
110. Sandhu R.S., Coyne E.J., Feinstein H.L., Youman C.E. Role-based access control models. IEEE Comput 1996, 29(2):38-47.
111. Sweeney L. Replacing personally-identifying information in medical records, the scrub system. In: Proceedings of the AMIA annual fall symposium; 1996. p. 333-7.
112. Sweeney L. k-anonymity: a model for protecting privacy. Ijufks 2002, 10:557-570.
113. Sweeney L. Computational disclosure control: a primer on data privacy protection. PhD thesis, AAI0803469; 2001.
114. Tao Y, Xiao X, Li J, Zhang D. On anti-corruption privacy preserving publication. In: Proceedings of the 2008 IEEE 24th international conference on data engineering, ICDE '08; 2008. p. 725-34.
115. Terrovitis M., Mamoulis N., Kalnis P. Privacy-preserving anonymization of set-valued data. Pvldb 2008, 1(1):115-125.
116. Terrovitis M., Mamoulis N., Kalnis P. Local and global recoding methods for anonymizing set-valued data. VLDB J 2011, 20(1):83-106.
117. Tildesley M.J., House T.A., Bruhn M.C., Curry R.J., ONeil M., Allpress J.L.E., et al. Impact of spatial clustering on disease transmission and optimal control. Proc Nat Acad Sci 2010, 107(3):1041-1046.
118. Truta TM, Vinay B. Privacy protection: p-sensitive k-anonymity property. In: ICDE workshops; 2006. p. 94.
119. United States Census American Community Survey. Public Use Microdata; 2003.
120. U.S. Department of Health and Human Services Office for Civil Rights. HIPAA administrative simplification regulation text; 2006.
121. Vaidya J, Clifton C. Privacy-preserving k-means clustering over vertically partitioned data. In: KDD; 2003. p. 206-15.
122. Van Rijsbergen C.J. Information retrieval 1979, Butterworth-Heinemann, Newton, MA, USA. 2nd ed.
123. Wang R, Li YF, Wang X, Tang H, Zhou X. Learning your identity and disease from research papers: information leaks in genome wide association study. In: CCS; 2009. p. 534-44.
124. Wang R, Wang X, Li Z, Tang H, Reiter MK, Dong Z. Privacy-preserving genomic computation through program specialization. In: Proceedings of the 16th ACM conference on computer and communications security, CCS '09; 2009. p. 338-47.
125. Wong RC, Fu A, Wang K, Pei J. Minimality attack in privacy preserving data publishing. In: VLDB; 2007. p. 543-54.
126. Wong RC, Li J, Fu A, Wang K. alpha-k-Anonymity: an enhanced k-anonymity model for privacy-preserving data publishing. In: KDD; 2006. p. 754-59.
127. Xiao X, Tao Y. Anatomy: simple and effective privacy preservation. In: VLDB; 2006. p. 139-50.
128. Xiao X, Tao Y. Personalized privacy preservation. In: SIGMOD; 2006. p. 229-40.
129. Xu J, Wang W, Pei J, Wang X, Shi B, Fu AW-C. Utility-based anonymization using local recoding. In: KDD; 2006. p. 785-90.
130. Xu Y, Wang K, Fu AW-C, Yu PS. Anonymizing transaction databases for publication. In: KDD; 2008. p. 767-75.
131. Zhang R., Kalnis P., Ooi B., Tan K. Generalized multidimensional data mapping and query processing. ACM Trans Database Syst 2005, 30(3):661-697.