Individual privacy versus public good: Protecting confidentiality in health research

Statistics in Medicine

Volumn 34, Issue 23, 2015, Pages 3081-3103

  O'Keefe, Christine M ^a   Rubin, Donald B ^b  

^a CSIRO   (Australia)

^b HARVARD UNIVERSITY   (United States)

Author keywords

Biostatistics; Confidentiality; Health care research; Medical research; Privacy

Indexed keywords

ACCESS TO INFORMATION; ARTICLE; AUSTRALIA; DATA ANALYSIS; EUROPE; INTERPERSONAL COMMUNICATION; MEDICAL INFORMATION; MEDICAL RESEARCH; PRACTICE GUIDELINE; PRIVACY; PROFESSIONAL SECRECY; RISK REDUCTION; SAMPLING; STATISTICAL ANALYSIS; STATISTICAL PARAMETERS; TAXONOMY; UNITED STATES; COMPUTER SECURITY; CONFIDENTIALITY; EUROPEAN UNION; EVIDENCE BASED MEDICINE; HEALTH CARE POLICY; HEALTH INSURANCE; HUMAN; LEGISLATION AND JURISPRUDENCE; PROCEDURES; STANDARDS; STATISTICS AND NUMERICAL DATA;

AUSTRALIA; BIOMEDICAL RESEARCH; COMPUTER SECURITY; CONFIDENTIALITY; DATA INTERPRETATION, STATISTICAL; EUROPEAN UNION; EVIDENCE-BASED MEDICINE; HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT; HEALTH POLICY; HUMANS; UNITED STATES;

EID: 84941025396     PISSN: 02776715     EISSN: 10970258     Source Type: Journal    
DOI: 10.1002/sim.6543     Document Type: Article

References (127)

1. Safran C, Bloomrosen M, Hammond W, Labkoff S, Markel-Fox S, Tang P, Detmer D, Toward a national framework for the secondary use of health data: an American medical informatics association white paper, Journal of the American Medical Informatics Association (2007); 14:1-9.
2. Weiner M, Embi P, Toward reuse of clinical data for research and quality improvement: the end of the beginning?Annals of Internal Medicine (2009); 151:359-360.
3. Jablensky A, Morgan V, Zubrick S, Bower C, Yellachich L, Pregnancy, delivery, and neonatal complications in a population cohort of women with schizophrenia and major affective disorders, The American Journal of Psychiatry (2005); 162:79-91.
4. Hauck Y, Rock D, Jackiewicz T, Jablensky A, Healthy babies for mothers with serious mental illness: a case management framework for clinicians, International Journal of Mental Health Nursing (2008); 17:383-391.
5. Framingham Heart Study, National Heart, Lung and Blood Institute and Boston University. http://www.framinghamheartstudy.org [Accessed on 23 October 2014].
6. Roos LL, Wajda A, Record linkage strategies: part 1: estimating information and evaluating approaches. Technical Report 28, University of Manitoba, Winnipeg, (1990).
7. Gill L, OX-LINK: The Oxford Medical Rrecord Linkage System. Record linkage techniques. Technical Report 19, University of Oxford, Oxford, (1997).
8. Kendrick S, Clarke JA, The Scottish medical record linkage system, Health Bulletin (Edinburgh) (1979); 51:72-79.
9. Holman CDJ, Bass AJ, Rouse IL, Hobbs MS, Population-based linkage of health records in Western Australia: development of a health services research linked database, Australian and New Zealand Journal of Public Health (1999); 23:453-459.
10. Ford DV, Jones KH, Verplancke JP, Lyons RA, John G, Brown G, Brooks CJ, Thompson S, O Bodger, Couch T, Leake K, The SAIL Databank: building a national architecture for e-health research and evaluation, BioMed Central Health Services Research (2009); 9:157.
11. National Insititutes of Health, Final NIH Statement on Sharing Research Data. Notice: NOT-OD-03-032 February 26 2003. http://grants.nih.gov/grants/guide/notice-files/NOT-OD-03-032.html [Accessed on 23 October 2014].
12. National Institutes of Health, NIH genomic data sharing policy. Technical Report, NIH 27, August 2014, http://grants.nih.gov/grants/guide/notice-files/NOT-OD-14-124.html [Accessed on 23 October 2014].
13. Samet J, Data: to share or not to share, Epidemiology (2009); 20:172-174.
14. Hernán M, Wilcox A, Epidemiology, data sharing, and the challenge of scientific replication, Epidemiology (2009); 20:167-168.
15. Sweeney L. Matching known patients to health records in Washington State data, Harvard University. Data Privacy Lab, June 2013.
16. Johnson AD, Leslie R, O'Donnell CJ, Temporal trends in results availability from genome-wide association studies, Public Library of Science Genetics (2011);7(9):e1002269. DOI: 10.1371/journal.pgen.1002269.
17. Gymrek M, McGuire AL, Golan D, Halperin E, Erlich Y, Identifying personal genomes by surname inference, Science (2013); 339:6117, 321-324.
18. Carl K, It's personal: Privacy concerns associated with personal health records, ISJLP (2010); 5:533-603.
19. El Emam K A Guide to the De-identification of Health Information, CRC Press, New York, NY (2013).
20. US Government, Health Insurance Portability and Accountability Act (HIPAA), 1996. http://www.gpo.gov/fdsys/pkg/PLAW-104publ191/content-detail.html [Accessed on 1 June 2015].
21. Office for Civil Rights, Guidance regarding methods for de-identification of protected health information in accordance with the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule.U.S. Department of Health and Human Services September 4 2012, Washington, DC.
22. McGraw D, Building public trust in uses of Health Insurance Portability and Accountability Act de-identified data, Journal of the American Medical Informatics Association (2013); 20(1):29-34.
23. European Union, Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data 1995. http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:31995L0046:en:HTML [Accessed on 23 October 2014].
24. European Parliament, Draft Report. http://www.europarl.europa.eu/meetdocs/2009_2014/documents/libe/pr/922/922387/922387en.pdf [Accessed on 23 October 2014].
25. Holman C, Anonymity & Research: Health Data and Biospecimen Law in Australia, Uniprint, The University of WA, Perth, (2012).
26. O'Keefe CM, Connolly C, Privacy and the use of health data for research, Medical Journal of Australia (2010); 193:537-541.
27. Duncan GT, Keller-McNulty SA, Stokes SL, Disclosure risk vs data utility: the R-U confidentiality map. Technical Report LA-UR-01-6428, Los Alamos National Laboratory.(2001).
28. Duncan G, Elliot M, Salazar-Gonzàlez JJ, Statistical Confidentiality, Springer, New York, (2011).
29. Cox L, Overview of statistical disclosure limitation. DIMACS Working Group on Challenges for Cryptographers in Health Data Privacy 10-12 December 2003. Rutgers University.
30. Fienberg S, Confidentiality and disclosure limitation, Encyclopedia of Social Measurement (2005); 1:463-469.
31. Skinner C, Shlomo N, Assessing identification risk in survey microdata using log-linear models, Journal of the American Statistical Association (2008); 103:989-1001.
32. Cox L, Karr A, Kinney S, Risk-utility paradigms for statistical disclosure limitation: how to think, but not how to act, International Statistical Review (2011); 79:160-183.
33. Elliot M, Purdam K, A case study of the impact of statistical disclosure control on data quality in the individual UK samples of anonymized records, Environment and Planning A (2007); 39:1101-1118.
34. Winkler W, Examples of easy-to-implement, widely used methods of masking for which analytic properties are not justified. Technical Report, U.S. Bureau of the Census.(2007).
35. Dwork C, McSherry F, Nissim K, Smith A. Calibrating noise to sensitivity in private data analysis. 3rd IACR Theory of Cryptography Conference, New York, USA, 2006; 265-284.
36. Dwork C, Smith A, Differential privacy for statistics: what we know and what we want to learn, Journal of Privacy and Confidentiality (2009); 1:135-154.
37. Kifer D, Machanavajjhala A. Nofree lunch in data privacy. Proceedings of the SIGMOD '11, Athens, Greece, 2011; 193-204.
38. Kinney SK, Reiter JP, Reznek AP, Miranda J, Jarmin RS, Abowd JM, Towards unrestricted public use business microdata: the synthetic longitudinal business database, International Statistical Review (2011); 79(3)362-384.
39. Steinberg J, Pritzker L, Some experiences with and reflections on data linkage in the United States. International Statistical Institute, 1967.
40. Bachi R, Baron R, Confidentiality problems related to data banks, Bulletin of the International Statistical Institute (1969); 43:225-241.
41. Fuller WA, Masking procedures for microdata disclosure limitation, Journal of Official Statistics (1993); 9:383-383.
42. Dalenius T, Towards a methodology for statistical disclosure control, Statistik Tidskrift (1977); 15:429-444.
43. Duncan GT, Lambert D, Disclosure-limited data dissemination, Journal of the American Statistical Association (1986); 81(393):10-18.
44. Duncan G, Lambert D, The risk of disclosure for microdata, Journal of Business and Economic Statistics (1989); 7:207-217.
45. Adam N, Wortmann J, Security-control methods for statistical databases: a comparative study, ACM Computing Surveys (1989); 21:515-556.
46. Fellegi IP, On the question of statistical confidentiality, Journal of the American Statistical Association (1972); 67(337):7-18.
47. Duncan G, Preface, special issue, Journal of Official Statistics (1993); 9:269-270.
48. Hundepool A, Domingo-Ferrer J, Franconi L, Giessing S, Nordholt E, Spicer K, de WolfWolf PP, Statistical Disclosure Control, Wiley Series in Survey Methodology, John Wiley & Sons, United Kingdom (2012).
49. Malin BA, El Emam K, O'Keefe CM, Biomedical data privacy: problems, perspectives, and recent advances, Journal of the American Medical Informatics Association (2013); 20:2-6.
50. Fienberg S, Statistical perspectives in confidentiality and data access in public health, Statistics in Medicine (2001); 20: 1347-1356.
51. O'Keefe CM, Privacy and the use of health data - reducing disclosure risk, Electronic Journal of Health Informatics (2008); 3(1):E5 (9pp).
52. Reiter J, Kinney S, Commentary: Sharing confidential data for research purposes: a primer, Epidemiology (2011); 22:632-635.
53. Duncan G, Pearson R, Enhancing access to microdata while protecting confidentiality: prospects for the future, Statistical Science (1991); 6:219-239.
54. O'Keefe CM, Good N, Regression output from a remote analysis system, Data and Knowledge Engineering (2009); 68:1175-1186.
55. Marsh C, Skinner C, Arber S, Penhale B, Openshaw S, Hobcraft J, Lievesley D, Walford N, The case for samples of anonymized records from the 1991 census, Journal of the Royal Statistical Society Series A (1991); 154:305-340.
56. Australian Bureau of Statistics, About CURF microdata. http://www.abs.gov.au/websitedbs/D3310114.nsf/home/About+CURF+Microdata [Accessed on 23 October 2014].
57. Centers for Disease Control and Prevention. Public-use data files and documentation. http://www.cdc.gov/nchs/data_access/ftp_data.htm [Accessed on 23 October 2014].
58. Minnesota Population Center UniversityofMinnesota, IPUMS International. https://international.ipums.org/international/ [Accessed on 23 October 2014].
59. Gomatam S, Karr A, Reiter J, Sanil A, Data dissemination and disclosure limitation in a world without microdata: a risk-utility framework for remote access systems, Statistical Science (2005); 20:163-177.
60. Sparks R, Carter C, Donnelly J, O'Keefe CM, Duncan J, Keighley T, McAullay D, Remote access methods for exploratory data analysis and statistical modelling: privacy-preserving analytics™, Computer Methods and Programs in Biomedicine (2008); 91:208-222.
61. Karr A, Lee J, Sanil A, Hernandez J, Karimi S, Litwin K, Web-based systems that disseminate information but protect confidentiality., in Advances in Digital Government: Technology, Human Factors and Public Policy, edited by W McIver, A Elmagarmid, Kluwer, Amsterdam, (2002); 181-196.
62. Karr AF, Dobra A, Sanil AP, Table servers protect confidentiality in tabular data releases, Communications of the ACM (2003); 46(1):57-58.
63. Australian Bureau of Statistics, Remote Access Data Laboratory (RADL). http://www.abs.gov.au [Accessed on 23 October 2014].
64. Thompson G, Broadfoot S, Elazar D, Methodology for automatic confidentialisation of statistical outputs from remote servers at the Australian Bureau of Statistics. Joint UNECE/Eurostat work session on statistical data confidentiality (Ottawa, Canada, 28-30 October 2013). 37pp.
65. Lucero J, Zayatz L, Singh L, You J, DePersio M, Freiman M. The current stage of the microdata analysis system at the U.S. Census Bureau. Proceedings of the 58th Congress of the International Statistical Institute, ISI 2011, Dublin, Ireland, 2011.
66. Sarathy R, Muralidhar K, Evaluating Laplace noise addition to satisfy differential privacy for numeric data, Transactions in Data Privacy (2011); 4:1-17.
67. Yang X, Fienberg SE, Rinaldo A, Differential privacy for protecting multi-dimensional contingency table data: extensions and applications, Journal of Privacy and Confidentiality (2012); 4(1):101-125.
68. O'Keefe CM, Westcott M, Ickowicz A, O'Sullivan M, Churches T, Protecting confidentiality in statistical analysis outputs from a virtual data centre. Working Paper 29-30 October 2013. Joint UNECE/Eurostat work session on statistical data confidentiality.Ottawa, Canada, 10pp. http://www.unece.org/stats/documents/2013.10.confidentiality.html [Accessed on 23 October 2014].
69. University of Chicago, NORC website. http://www.norc.org [Accessed on 23 October 2014].
70. Sax Institute . Secure Unified Research Environment (SURE). http://www.sure.org.au [Accessed on 23 October 2014].
71. O'Keefe CM, Gould P, Churches T, Comparison of two remote access systems recently developed and implemented in Australia., in Privacy in Statistical Databases PSD2014, LNCS, vol.8744, edited by J Domingo-Ferrer, Springer, Heidelberg, (2014); 299-311.
72. Office for National Statistics. http://www.statistics.gov.uk [Accessed on 23 October 2014].
73. UK Data Archive. Secure data service website. http://ukdataservice.ac.uk/get-data/how-toaccess/accesssecurelab.aspx [Accessed on 23 October 2014].
74. United States Census Bureau. http://www.census.gov [Accessed on 23 October 2014].
75. Australian Bureau of Statistics. http://www.abs.gov.au [Accessed on 23 October 2014].
76. Skinner C, Elliot M, A measure of disclosure risk for microdata, Journal of the Royal Statistical Society Series B (2002); 64:855-867.
77. Australian Government National Health and Medical Research Council, National statement on ethical conduct in human research 2007 - updated 2014. Online publication Reference Number E72, 2007. http://www.nhmrc.gov.au/guidelines/publications/e72 [Accessed on 23 October 2014].
78. McGuire A, Genetics GibbsR., No longer de-identified, Science (2006); 312:370-371.
79. Ohm P, Broken promises of privacy: responding to the surprising failure of anonymization, UCLA Law Review (2010);57:1701-1777.
80. Rothstein M, Is deidentification sufficient to protect health privacy in research?American Journal of Bioethics (2010); 10:3-11.
81. El Emam K, Methods for de-identification of electronic health records for genomic research, Genome Medicine (2011);3(2011), 25. DOI: 10.1186/gm239.
82. Population Health Research Network. http://www.phrn.org.au/ [Accessed on 23 October 2014].
83. British Columbia Linked Health Database (BCHLD). http://riskfactor.cancer.gov/tools/pharmaco/epi/british_columbia.html [Accessed on 23 October 2014].
84. Lin Z, Hewett M, Altman R. Using binning to maintain confidentiality of medical data. Annual Symposium Proceedings, American Medical Informatics Association, San Antonio, USA, 2002, 454-458.
85. Fienberg S, Makov U, Confidentiality, uniqueness and disclosure limitation for categorical data, Journal of Official Statistics (1998); 14:385-397.
86. Rubin D, Discussion: statistical disclosure limitation, Journal of Official Statistics (1993); 9:462-468.
87. Little R, Statistical analysis of masked data, Journal of Official Statistics (1993); 9:407-426.
88. Reiter J, Using CART to generate partially synthetic public use microdata, Journal of Official Statistics (2005);21:441-462.
89. Iacus S, Porro G, Missing data imputation, matching and other applications of random recursive partitioning, Computational Statistics and Data Analysis (2007); 52:773-789.
90. Burgette L, Reiter J, Multiple imputation for missing data via sequential regression trees, American Journal of Epidemiology (2010); 172:1070-1076.
91. Drechsler J, Reiter J., An empirical evaluation of easily implemented, nonparametric methods for generating synthetic datasets, Computational Statistics and Data Analysis (2011); 55:3232-3243.
92. National Institute of Statistical Sciences. NISSWebSwap, Version 1.1, 2003. http://nisla05.niss.org/WebServices/dg/ WebSwap.html [Accessed on 23 October 2014].
93. Abowd JM, Stinson M, Benedetto G, Final report to the Social Security Administration on the SIPP/SSA/IRS public use file project. Technical Report (2006).
94. Hawala S. Producing partially synthetic data to avoid disclosure. Proceedings of the Joint Statistical Meetings, American Statistical Association, Alexandria, VA, 2008.
95. An D, Little R, Multiple imputation: an alternative to top coding for statistical disclosure control, Journal of the Royal Statistical Society Series A (2007); 170:923-940.
96. An D, Little R, McNally J, A multiple imputation approach to disclosure limitation for high-age individuals in longitudinal studies, Statistics in Medicine (2009); 29:1769-1778.
97. Lochner K, Hummer R, Bartee S, Wheatcroft G, Cox C, The public-use national health interview survey linked mortality files: methods of reidentification risk avoidance and comparative analysis, American Journal of Epidemiology (2008); 168:336-344.
98. Boulos MN, Curtis AJ, AbdelMalik P, Musings on privacy issues in health research involving disaggregate geographic data about individuals, International Journal of Health Geographics (2009); 8(1): 46.
99. VanWey L, Rindfuss R, Gutmann M, Entwisle B, Balk D, Confidentiality and spatially explicit data: Concerns and challenges, Proceedings of the National Academy of Sciences of the United States of America (2005); 102:15337-15342.
100. Curtis A, Mills J, Agustin L, Cockburn M, Confidentiality risks in fine scale aggregations of health data, Computers, Environment and Urban Systems (2011), 35:57-64.
101. Cassa C, Grannis S, Overhage J, Mandl K, A context-sensitive approach to anonymizing spatial surveillance data: impact on outbreak detection, Journal of the American Medical Informatics Association (2006); 13:160-165.
102. Leitner M, Curtis A., Cartographic guidelines for geographically masking the locations of confidential point data, Cartographic Perspectives (2004); 49:22-39.
103. Olson K, Grannis S, Mandl K, Privacy protection versus cluster detection in spatial epidemiology, American Journal of Public Health (2006); 96:2002-2008.
104. Zhou Y, Dominici F, Louis TA, A smoothing approach for masking spatial data, The Annals of Applied Statistics (2010); 4(3) 1451-1475.
105. Wang H, Reiter JP, Multiple imputation for sharing precise geographies in public use data, The Annals of Applied Statistics (2012); 6:1, 229-252.
106. Dalenius T, Reiss SP, Data-swapping: a technique for disclosure control, Journal of Statistical Planning and Inference (1982); 673-85.
107. Cox L, Linear sensitivity measures in statistical disclosure control, Journal of Statistical Planning and Inference (1981); 5:153-164.
108. Robertston D, Ethier R, Cell suppression: experience and theory., in Inference Control in Statistical Databases, vol.2316, edited by J Domingo-Ferrer, Lecture Notes in Computer Science, Springer-Verlag, Berlin Heidelberg, (2002); 213-239.
109. Gouweleeuw J, Kooiman P, DeWolf LWPP, Post randomisation for statistical disclosure control: theory and implementation, Journal of Official Statistics (1998); 14:463-478.
110. Marley J, Leaver V. A method for confidentialising user-defined tables: statistical properties and a risk-utility analysis. Proceedings of the 58th Congress of the International Statistical Institute, ISI 2011, Dublin, Ireland, 21-26 August 2011.
111. ESSnet-project. τ-ARGUS website . http://neon.vb.cbs.nl/casc/tau.htm [Accessed on 23 October 2014].
112. Australian Bureau of Statistics, Census TableBuilder nd.http://www.abs.gov.au [Accessed on 23 October 2014].
113. Reiter J, Model diagnostics for remote-access regression systems, Statistics and Computing (2003); 13:371-380.
114. Reiter J, Kohnen C, Categorical data regression diagnostics for remote systems, Journal of Statistical Computation and Simulation (2005); 75:889-903.
115. Sparks R, Carter C, Donnelly J, Duncan J, O'Keefe CM, Ryan L. A framework for performing statistical analyses of unit record health data without violating either privacy or confidentiality of individuals, Proceedings of the 55th Session of the International Statistical Institute, Sydney, 2005; 4:(4pp).
116. O'Keefe CM, Chipperfield JO, A summary of attack methods and protective measures for fully automated remote analysis systems, International Statistical Review (2013); 81:426-455.
117. O'Keefe CM, Shlomo N, Applicability of confidentiality methods to personal and business data., in Privacy in Statistical Databases PSD2014, LNCS, vol.8744, edited by J Domingo-Ferrer, Springer, Heidelberg, (2014);350-363.
118. Reiter JP, Statistical approaches to protecting confidentiality for microdata and their effects on the quality of statistical inferences, Public Opinion Quarterly (2012); 76(1):163-181.
119. Kennickell A, Lane J, Measuring the impact of data protection techniques on data utility: evidence from the survey of consumer finances., in Privacy in Statistical Databases, Springer, Heidelberg, (2006); 291-303.
120. Drechsler J, Multiple imputation in practice-a case study using a complex German establishment survey, Advances in Statistical Analysis (2011); 95:1-26.
121. Reiter JP, Raghunathan TE, The multiple adaptations of multiple imputation, Journal of the American Statistical Association (2007);102(480):1462-1471.
122. Domingo-Ferrer J, Torra V, A critique of the sensitivity rules usually employed for statistical table protection, International Journal of Uncertainty, Fuzziness and Knowlege-Based Systems (2002); 10:545-556.
123. Cox L. Confidentiality issues for statistical database query systems. Invited Paper for Joint UNECE/Eurostat Seminar on Integrated Statistical Information Systems and Related Matters (ISIS2002), Geneva, Switzerland. http://www.unece.org/stats/documents/ces/sem.47/15.s.e.pdf [Accessed on 23 October 2014], April 2002; 17-19.
124. O'Keefe CM, Discussion, International Statistical Review (2011); 79(2); 191-194.
125. O'Keefe CM, Good N. Risk and utility of alternative regression diagnostics in remote analysis servers, (8pp). Proceedings of the 55th Session of the ISI International Statistical Institute, Lisbon, Portugal, 2007.
126. Yu F, Fienberg SE, Slavković AB, Uhler C, Scalable privacy-preserving data sharing methodology for genome-wide association studies, Journal of Biomedical Informatics (2014); 50:133-141.
127. Reiter J, Oganian A, Karr A, Verification servers: enabling analysts to assess the quality of inferences from public use data, Computational Statistics and Data Analysis (2009), 53:1475-1482.