A tutorial in assessing disclosure risk in microdata

An electronic health record cohort of Veterans with amyotrophic lateral sclerosis

Objective: To assemble and characterize an electronic health record (EHR) dataset for a large cohort of US military Veterans diagnosed with ALS (Amyotrophic Lateral Sclerosis). Methods: An EHR dataset for 19,662 Veterans diagnosed with ALS between January 1, 2000 to December 31, 2020 was compiled from the Veterans Health Administration (VHA) EHR database by a query for ICD9 diagnosis (335.20) or ICD10 diagnosis (G12.21) for Amyotrophic Lateral Sclerosis. Results: The cohort is predominantly male (98.94%) and white (72.37%) with a median age at disease onset of 68 years and median survival from the date of diagnosis of 590 days. With the designation of ALS as a compensable illness in 2009, there was a subsequent increase in the number of Veterans diagnosed per year in the VHA, but no change in median survival. The cohort included a greater-than-expected proportion of individuals whose branch of service at the time of separation was the Army. Conclusions: The composition of the cohort reflects the VHA population who are at greatest risk for ALS. The greater than expected proportion of individuals whose branch of service at the time of separation was the Army suggests the possibility of a branch-specific risk factor for ALS.

A Vulnerability Assessment Framework for Privacy-Preserving Record Linkage

The linkage of records to identify common entities across multiple data sources has gained increasing interest over the last few decades. In the absence of unique entity identifiers, quasi-identifying attributes such as personal names and addresses are generally used to link records. Due to privacy concerns that arise when such sensitive information is used, privacy-preserving record linkage (PPRL) methods have been proposed to link records without revealing any sensitive or confidential information about these records. Popular PPRL methods such as Bloom filter encoding, however, are known to be susceptible to various privacy attacks. Therefore, a systematic analysis of the privacy risks associated with sensitive databases as well as PPRL methods used in linkage projects is of great importance. In this paper we present a novel framework to assess the vulnerabilities of sensitive databases and existing PPRL encoding methods. We discuss five types of vulnerabilities: frequency, length, co-occurrence, similarity, and similarity neighbourhood, of both plaintext and encoded values that an adversary can exploit in order to reidentify sensitive plaintext values from encoded data. In an experimental evaluation we assess the vulnerabilities of two databases using five existing PPRL encoding methods. This evaluation shows that our proposed framework can be used in real-world linkage applications to assess the vulnerabilities associated with sensitive databases to be linked, as well as with PPRL encoding methods.

Differential privacy in health research: A scoping review

OBJECTIVE

Differential privacy is a relatively new method for data privacy that has seen growing use due its strong protections that rely on added noise. This study assesses the extent of its awareness, development, and usage in health research.

MATERIALS AND METHODS

A scoping review was conducted by searching for ["differential privacy" AND "health"] in major health science databases, with additional articles obtained via expert consultation. Relevant articles were classified according to subject area and focus.

RESULTS

A total of 54 articles met the inclusion criteria. Nine articles provided descriptive overviews, 31 focused on algorithm development, 9 presented novel data sharing systems, and 8 discussed appraisals of the privacy-utility tradeoff. The most common areas of health research where differential privacy has been discussed are genomics, neuroimaging studies, and health surveillance with personal devices. Algorithms were most commonly developed for the purposes of data release and predictive modeling. Studies on privacy-utility appraisals have considered economic cost-benefit analysis, low-utility situations, personal attitudes toward sharing health data, and mathematical interpretations of privacy risk.

DISCUSSION

Differential privacy remains at an early stage of development for applications in health research, and accounts of real-world implementations are scant. There are few algorithms for explanatory modeling and statistical inference, particularly with correlated data. Furthermore, diminished accuracy in small datasets is problematic. Some encouraging work has been done on decision making with regard to epsilon. The dissemination of future case studies can inform successful appraisals of privacy and utility.

CONCLUSIONS

More development, case studies, and evaluations are needed before differential privacy can see widespread use in health research.

Privacy Preserving Data Publishing with Multiple Sensitive Attributes based on Overlapped Slicing

Investigation into privacy preserving data publishing with multiple sensitive attributes is performed to reduce probability of adversaries to guess the sensitive values. Masking the sensitive values is usually performed by anonymizing data by using generalization and suppression techniques. A successful anonymization technique should reduce information loss due to the generalization and suppression. This research attempts to solve both problems in microdata with multiple sensitive attributes. We propose a novel overlapped slicing method for privacy preserving data publishing with multiple sensitive attributes. We used discernibility metrics to measure information loss. The experiment result shows that our method obtained a lower discernibility value than other methods.