Evaluation of approximate comparison methods on Bloom filters for probabilistic linkage

INTRODUCTION

The need for increased privacy protection in data linkage has driven the development of privacy-preserving record linkage (PPRL) techniques. A popular technique using Bloom filters with cryptographic analyses, modifications, and hashing variations to optimise privacy has been the focus of much research in this area. With few applications of Bloom filters within a probabilistic framework, there is limited information on whether approximate matches between Bloom filtered fields can improve linkage quality.

OBJECTIVES

In this study, we evaluate the effectiveness of three approximate comparison methods for Bloom filters within the context of the Fellegi-Sunter model of recording linkage: Sørensen-Dice coefficient, Jaccard similarity and Hamming distance.

METHODS

Using synthetic datasets with introduced errors to simulate datasets with a range of data quality and a large real-world administrative health dataset, the research estimated partial weight curves for converting similarity scores (for each approximate comparison method) to partial weights at both field and dataset level. Deduplication linkages were run on each dataset using these partial weight curves. This was to compare the resulting quality of the approximate comparison techniques with linkages using simple cut-off similarity values and only exact matching.

RESULTS

Linkages using approximate comparisons produced significantly better quality results than those using exact comparisons only. Field level partial weight curves for a specific dataset produced the best quality results. The Sørensen-Dice coefficient and Jaccard similarity produced the most consistent results across a spectrum of synthetic and real-world datasets.

CONCLUSION

The use of Bloom filter similarity comparisons for probabilistic record linkage can produce linkage quality results which are comparable to Jaro-Winkler string similarities with unencrypted linkages. Probabilistic linkages using Bloom filters benefit significantly from the use of similarity comparisons, with partial weight curves producing the best results, even when not optimised for that particular dataset.

Privacy preserving linkage using multiple match-keys

Introduction

Available and practical methods for privacy preserving linkage have shortcomings: methods utilising anonymous linkage codes provide limited accuracy while methods based on Bloom filters have proven vulnerable to frequency-based attacks.

Objectives

In this paper, we present and evaluate a novel protocol that aims to meld both the accuracy of the Bloom filter method with the privacy achievable through the anonymous linkage code methodology.

Methods

The protocol involves creating multiple match-keys for each record, with the composition of each match-key depending on attributes of the underlying datasets being compared. The protocol was evaluated through de-duplication of four administrative datasets and two synthetic datasets; the ‘answers’ outlining which records belonged to the same individual were known for each dataset. The results were compared against results achieved with un-encoded linkage and other privacy preserving techniques on the same datasets.

Results

The multiple match-key protocol presented here achieved high quality across all datasets, performing better than record-level Bloom filters and the SLK, but worse than field-level Bloom filters.

Conclusion

The presented method provides high linkage quality while avoiding the frequency based attacks that have been demonstrated against the Bloom filter approach. The method appears promising for real world use.

Estimating parameters for probabilistic linkage of privacy-preserved datasets

Background

Probabilistic record linkage is a process used to bring together person-based records from within the same dataset (de-duplication) or from disparate datasets using pairwise comparisons and matching probabilities. The linkage strategy and associated match probabilities are often estimated through investigations into data quality and manual inspection. However, as privacy-preserved datasets comprise encrypted data, such methods are not possible. In this paper, we present a method for estimating the probabilities and threshold values for probabilistic privacy-preserved record linkage using Bloom filters.

Methods

Our method was tested through a simulation study using synthetic data, followed by an application using real-world administrative data. Synthetic datasets were generated with error rates from zero to 20% error. Our method was used to estimate parameters (probabilities and thresholds) for de-duplication linkages. Linkage quality was determined by F-measure. Each dataset was privacy-preserved using separate Bloom filters for each field. Match probabilities were estimated using the expectation-maximisation (EM) algorithm on the privacy-preserved data. Threshold cut-off values were determined by an extension to the EM algorithm allowing linkage quality to be estimated for each possible threshold. De-duplication linkages of each privacy-preserved dataset were performed using both estimated and calculated probabilities. Linkage quality using the F-measure at the estimated threshold values was also compared to the highest F-measure. Three large administrative datasets were used to demonstrate the applicability of the probability and threshold estimation technique on real-world data.

Results

Linkage of the synthetic datasets using the estimated probabilities produced an F-measure that was comparable to the F-measure using calculated probabilities, even with up to 20% error. Linkage of the administrative datasets using estimated probabilities produced an F-measure that was higher than the F-measure using calculated probabilities. Further, the threshold estimation yielded results for F-measure that were only slightly below the highest possible for those probabilities.

Conclusions

The method appears highly accurate across a spectrum of datasets with varying degrees of error. As there are few alternatives for parameter estimation, the approach is a major step towards providing a complete operational approach for probabilistic linkage of privacy-preserved datasets.

Ensuring Privacy When Integrating Patient-Based Datasets: New Methods and Developments in Record Linkage

In an era where the volume of structured and unstructured digital data has exploded, there has been an enormous growth in the creation of data about individuals that can be used for understanding and treating disease. Joining these records together at an individual level provides a complete picture of a patient's interaction with health services and allows better assessment of patient outcomes and effectiveness of treatment and services. Record linkage techniques provide an efficient and cost-effective method to bring individual records together as patient profiles. These linkage procedures bring their own challenges, especially relating to the protection of privacy. The development and implementation of record linkage systems that do not require the release of personal information can reduce the risks associated with record linkage and overcome legal barriers to data sharing. Current conceptual and experimental privacy-preserving record linkage (PPRL) models show promise in addressing data integration challenges. Enhancing and operationalizing PPRL protocols can help address the dilemma faced by some custodians between using data to improve quality of life and dealing with the ethical, legal, and administrative issues associated with protecting an individual's privacy. These methods can reduce the risk to privacy, as they do not require personally identifying information to be shared. PPRL methods can improve the delivery of record linkage services to the health and broader research community.

Improving the Estimation of Risk-Adjusted Grouped Hospital Standardized Mortality Ratios Using Cross-Jurisdictional Linked Administrative Data: A Retrospective Cohort Study

Background

Hospitals and death registries in Australia are operated under individual state government jurisdictions. Some state borders are located in heavily populated areas or are located near to major capital cities. Mortality indicators for hospital located near state borders may not be estimated accurately if patients are lost as they cross state borders. The aim of this study was to evaluate how cross-jurisdictional linkage of state hospital and death records across state borders may improve estimation of the hospital standardized mortality ratio (HSMR), a tool used in Australia as a hospital performance indicator.

Method

Retrospective cohort study of 7.7 million hospital patients from July 2004 to June 2009. Inhospital deaths and deaths within 30 days of hospital discharge from four state jurisdictions were used to estimate the standardized mortality ratio of hospital groups defined by geography and type of hospital (grouped HSMR) under three record linkage scenarios, as follows: (1) cross-jurisdictional person-level linkage, (2) within-jurisdictional (state-based) person-level linkage, and (3) unlinked records. All public and private hospitals in New South Wales, Queensland, Western Australia, and public hospitals in South Australia were included in this study. Death registrations from all four states were obtained from state-based registries of births, deaths, and marriages.

Results

Cross-jurisdictional linkage identified 11,116 cross-border hospital transfers of which 170 resulted in a cross-border inhospital death. An additional 496 cross-border deaths occurred within 30 days of hospital discharge. The inclusion of cross-jurisdictional person-level links to unlinked hospital records reduced the coefficient of variation among the grouped HSMRs from 0.19 to 0.15; the inclusion of 30-day deaths reduced the coefficient of variation further to 0.11. There were minor changes in grouped HSMRs between cross-jurisdictional and within-jurisdictional linkages, although the impact of cross-jurisdictional linkage increased when restricted to regions with high cross-border hospital use.

Conclusion

Cross-jurisdictional linkage modified estimates of grouped HSMRs in hospital groups likely to receive a high proportion of cross-border users. Hospital identifiers will be required to confirm whether individual hospital performance indicators change.

Limited privacy protection and poor sensitivity: Is it time to move on from the statistical linkage key-581?

BACKGROUND

The statistical linkage key (SLK-581) is a common tool for record linkage in Australia, due to its ability to provide some privacy protection. However, newer privacy-preserving approaches may provide greater privacy protection, while allowing high-quality linkage.

OBJECTIVE

To evaluate the standard SLK-581, encrypted SLK-581 and a newer privacy-preserving approach using Bloom filters, in terms of both privacy and linkage quality.

METHOD

Linkage quality was compared by conducting linkages on Australian health datasets using these three techniques and examining results. Privacy was compared qualitatively in relation to a series of scenarios where privacy breaches may occur.

RESULTS

The Bloom filter technique offered greater privacy protection and linkage quality compared to the SLK-based method commonly used in Australia.

CONCLUSION

The adoption of new privacy-preserving methods would allow both greater confidence in research results, while significantly improving privacy protection.

A Simple Sampling Method for Estimating the Accuracy of Large Scale Record Linkage Projects

BACKGROUND

Record linkage techniques allow different data collections to be brought together to provide a wider picture of the health status of individuals. Ensuring high linkage quality is important to guarantee the quality and integrity of research. Current methods for measuring linkage quality typically focus on precision (the proportion of incorrect links), given the difficulty of measuring the proportion of false negatives.

OBJECTIVES

The aim of this work is to introduce and evaluate a sampling based method to estimate both precision and recall following record linkage.

METHODS

In the sampling based method, record-pairs from each threshold (including those below the identified cut-off for acceptance) are sampled and clerically reviewed. These results are then applied to the entire set of record-pairs, providing estimates of false positives and false negatives. This method was evaluated on a synthetically generated dataset, where the true match status (which records belonged to the same person) was known.

RESULTS

The sampled estimates of linkage quality were relatively close to actual linkage quality metrics calculated for the whole synthetic dataset. The precision and recall measures for seven reviewers were very consistent with little variation in the clerical assessment results (overall agreement using the Fleiss Kappa statistics was 0.601).

CONCLUSIONS

This method presents as a possible means of accurately estimating matching quality and refining linkages in population level linkage studies. The sampling approach is especially important for large project linkages where the number of record pairs produced may be very large often running into millions.

Cross border hospital use: analysis using data linkage across four Australian states

OBJECTIVE

To determine the quality and effectiveness of national data linkage capacity by performing a proof-of-concept project investigating cross-border hospital use and hospital-related deaths.

DESIGN, PARTICIPANTS AND SETTING

Analysis of person-level linked hospital separation and death registration data of all public and private hospital patients in New South Wales, Queensland and Western Australia and of public hospital patients in South Australia, totalling 7.7 million hospital patients from 1 July 2004 to 30 June 2009.

MAIN OUTCOME MEASURES

Counts and proportions of hospital stays and patient movement patterns.

RESULTS

223 262 patients (3.0%) travelled across a state border to attend hospitals, in particular, far northern and western NSW patients travelling to Queensland and SA hospitals, respectively. A further 48 575 patients (0.6%) moved their place of residence interstate between hospital visits, particularly to and from areas associated with major mining and tourism industries. Over 11 000 cross-border hospital transfers were also identified. Of patients who travelled across a state border to hospital, 2800 (1.3%) died in that hospital. An additional 496 deaths recorded in one jurisdiction occurred within 30 days of hospital separation from another jurisdiction.

CONCLUSIONS

Access to person-level data linked across jurisdictions identified geographical hot spots of cross-border hospital use and hospital-related deaths in Australia. This has implications for planning of health service delivery and for longitudinal follow-up studies, particularly those involving mobile populations.

Accuracy and completeness of patient pathways--the benefits of national data linkage in Australia

BACKGROUND

The technical challenges associated with national data linkage, and the extent of cross-border population movements, are explored as part of a pioneering research project. The project involved linking state-based hospital admission records and death registrations across Australia for a national study of hospital related deaths.

METHODS

The project linked over 44 million morbidity and mortality records from four Australian states between 1st July 1999 and 31st December 2009 using probabilistic methods. The accuracy of the linkage was measured through a comparison with jurisdictional keys sourced from individual states. The extent of cross-border population movement between these states was also assessed.

RESULTS

Data matching identified almost twelve million individuals across the four Australian states. The percentage of individuals from one state with records found in another ranged from 3-5%. Using jurisdictional keys to measure linkage quality, results indicate a high matching efficiency (F measure 97 to 99%), with linkage processing taking only a matter of days.

CONCLUSIONS

The results demonstrate the feasibility and accuracy of undertaking cross jurisdictional linkage for national research. The benefits are substantial, particularly in relation to capturing the full complement of records in patient pathways as a result of cross-border population movements. The project identified a sizeable 'mobile' population with hospital records in more than one state. Research studies that focus on a single jurisdiction will under-enumerate the extent of hospital usage by individuals in the population. It is important that researchers understand and are aware of the impact of this missing hospital activity on their studies. The project highlights the need for an efficient and accurate data linkage system to support national research across Australia.

Use of graph theory measures to identify errors in record linkage

Ensuring high linkage quality is important in many record linkage applications. Current methods for ensuring quality are manual and resource intensive. This paper seeks to determine the effectiveness of graph theory techniques in identifying record linkage errors. A range of graph theory techniques was applied to two linked datasets, with known truth sets. The ability of graph theory techniques to identify groups containing errors was compared to a widely used threshold setting technique. This methodology shows promise; however, further investigations into graph theory techniques are required. The development of more efficient and effective methods of improving linkage quality will result in higher quality datasets that can be delivered to researchers in shorter timeframes.

Technical challenges of providing record linkage services for research

Background

Record linkage techniques are widely used to enable health researchers to gain event based longitudinal information for entire populations. The task of record linkage is increasingly being undertaken by specialised linkage units (SLUs). In addition to the complexity of undertaking probabilistic record linkage, these units face additional technical challenges in providing record linkage ‘as a service’ for research. The extent of this functionality, and approaches to solving these issues, has had little focus in the record linkage literature. Few, if any, of the record linkage packages or systems currently used by SLUs include the full range of functions required.

Methods

This paper identifies and discusses some of the functions that are required or undertaken by SLUs in the provision of record linkage services. These include managing routine, on-going linkage; storing and handling changing data; handling different linkage scenarios; accommodating ever increasing datasets. Automated linkage processes are one way of ensuring consistency of results and scalability of service.

Results

Alternative solutions to some of these challenges are presented. By maintaining a full history of links, and storing pairwise information, many of the challenges around handling ‘open’ records, and providing automated managed extractions are solved. A number of these solutions were implemented as part of the development of the National Linkage System (NLS) by the Centre for Data Linkage (part of the Population Health Research Network) in Australia.

Conclusions

The demand for, and complexity of, linkage services is growing. This presents as a challenge to SLUs as they seek to service the varying needs of dozens of research projects annually. Linkage units need to be both flexible and scalable to meet this demand. It is hoped the solutions presented here can help mitigate these difficulties.

An evaluation framework for comparing geocoding systems

BACKGROUND

Geocoding, the process of converting textual information describing a location into one or more digital geographic representations, is a routine task performed at large organizations and government agencies across the globe. In a health context, this task is often a fundamental first step performed prior to all operations that take place in a spatially-based health study. As such, the quality of the geocoding system used within these agencies is of paramount concern to the agency (the producer) and researchers or policy-makers who wish to use these data (consumers). However, geocoding systems are continually evolving with new products coming on the market continuously. Agencies must develop and use criteria across a number axes when faced with decisions about building, buying, or maintaining any particular geocoding systems. To date, published criteria have focused on one or more aspects of geocode quality without taking a holistic view of a geocoding system's role within a large organization. The primary purpose of this study is to develop and test an evaluation framework to assist a large organization in determining which geocoding systems will meet its operational needs.

METHODS

A geocoding platform evaluation framework is derived through an examination of prior literature on geocoding accuracy. The framework developed extends commonly used geocoding metrics to take into account the specific concerns of large organizations for which geocoding is a fundamental operational capability tightly-knit into its core mission of processing health data records. A case study is performed to evaluate the strengths and weaknesses of five geocoding platforms currently available in the Australian geospatial marketplace.

RESULTS

The evaluation framework developed in this research is proven successful in differentiating between key capabilities of geocoding systems that are important in the context of a large organization with significant investments in geocoding resources. Results from the proposed methodology highlight important differences across all axes of geocoding system comparisons including spatial data output accuracy, reference data coverage, system flexibility, the potential for tight integration, and the need for specialized staff and/or development time and funding. Such results can empower decisions-makers within large organizations as they make decisions and investments in geocoding systems.

Assessing gender and ethnic differences in developmental trajectories of offending

Research on diversity in offending patterns is crucial given ongoing polemical debates concerning the relationship between gender, ethnicity and crime. Competing theoretical perspectives, limited supporting evidence and inconclusive or contradictory findings from prior research point to the need for more empirically-grounded, generalizable research which compares and contrasts offending patterns across and within gender and ethnic groups. The current study applies a semi-parametric group-based modelling approach to a large, longitudinal dataset of offenders to determine if, and how, offending trajectories vary across gender and ethnic sub-groups. Findings suggest that some trajectory attributes (e.g. number and shape) are shared across gender/ethnic groups, while other trajectory attributes (height, peak age) are not. An exploratory investigation of the risk factors associated with trajectory group membership finds that few of the available factors discriminate between trajectories either within or across gender/ethnic offender groups. The findings fill a knowledge gap, particularly in relation to offending patterns in Australia. Invariance in trajectory risk factors present a challenge to taxonomic theories of offending.

The effect of data cleaning on record linkage quality

Background

Within the field of record linkage, numerous data cleaning and standardisation techniques are employed to ensure the highest quality of links. While these facilities are common in record linkage software packages and are regularly deployed across record linkage units, little work has been published demonstrating the impact of data cleaning on linkage quality.

Methods

A range of cleaning techniques was applied to both a synthetically generated dataset and a large administrative dataset previously linked to a high standard. The effect of these changes on linkage quality was investigated using pairwise F-measure to determine quality.

Results

Data cleaning made little difference to the overall linkage quality, with heavy cleaning leading to a decrease in quality. Further examination showed that decreases in linkage quality were due to cleaning techniques typically reducing the variability – although correct records were now more likely to match, incorrect records were also more likely to match, and these incorrect matches outweighed the correct matches, reducing quality overall.

Conclusions

Data cleaning techniques have minimal effect on linkage quality. Care should be taken during the data cleaning process.

Data linkage infrastructure for cross-jurisdictional health-related research in Australia

BACKGROUND

The Centre for Data Linkage (CDL) has been established to enable national and cross-jurisdictional health-related research in Australia. It has been funded through the Population Health Research Network (PHRN), a national initiative established under the National Collaborative Research Infrastructure Strategy (NCRIS). This paper describes the development of the processes and methodology required to create cross-jurisdictional research infrastructure and enable aggregation of State and Territory linkages into a single linkage "map".

METHODS

The CDL has implemented a linkage model which incorporates best practice in data linkage and adheres to data integration principles set down by the Australian Government. Working closely with data custodians and State-based data linkage facilities, the CDL has designed and implemented a linkage system to enable research at national or cross-jurisdictional level. A secure operational environment has also been established with strong governance arrangements to maximise privacy and the confidentiality of data.

RESULTS

The development and implementation of a cross-jurisdictional linkage model overcomes a number of challenges associated with the federated nature of health data collections in Australia. The infrastructure expands Australia's data linkage capability and provides opportunities for population-level research. The CDL linkage model, infrastructure architecture and governance arrangements are presented. The quality and capability of the new infrastructure is demonstrated through the conduct of data linkage for the first PHRN Proof of Concept Collaboration project, where more than 25 million records were successfully linked to a very high quality.

CONCLUSIONS

This infrastructure provides researchers and policy-makers with the ability to undertake linkage-based research that extends across jurisdictional boundaries. It represents an advance in Australia's national data linkage capabilities and sets the scene for stronger government-research collaboration.

A linkage study of Western Australian drink driving arrests and road crash records

Records of drivers in all reported road crashes occurring in Western Australia between 1987 and 1995 were linked with records of all drink driving arrests in the same period. About 7% of all drink driving arrests occurred because of a road crash. Differences were observed between these drink-driving crashes and other types of road crashes. Drink driving crashes tended to be more severe than those not involving alcohol. Serious crashes (involving fatalities or hospitalisations) accounted for 20% of alcohol-related crashes, but only 6% of all crashes reported over the study period. From another perspective, crash-related drink-driving arrests were more likely than routine enforcement arrests to involve younger (18-35 years) and older (65 years and over) drink drivers. Routine enforcement arrests, on the other hand, were likely to involve a greater proportion of Aboriginal drivers.

Novice drink drivers, recidivism and crash involvement

A group of drink drivers with no prior arrest for drink driving was selected from drink driving arrest records originating in Western Australia between 1987 and 1995. These drink-driving records were linked to road crash records for the same period. The analysis of these combined records focussed on the sequence of driving events (i.e., arrests, crashes and arrests resulting from crashes) and the present article explores the relationship in time between known drink driving incidents and crash involvement. Using multi-variate survival analysis, it was found that if a driver's first drink driving offence resulted from a road crash, especially if this occurred at a younger age, he/she was significantly more likely to drink, drive and crash again.

Syphilitic aneurysm of the abdominal aorta

A case of syphilitic aneurysm of the abdominal aorta is described. This unusual finding may be misdiagnosed as "inflammatory" abdominal aortic aneurysm, another condition associated with an intense periaortic inflammatory reaction. The authors discuss the differential diagnostic problems and the surgical technique advisable in these cases.

Digestive and nutritional consequences of pancreatic resections. The classical vs the pylorus-sparing procedure

Digestive and nutritional alterations are a common occurrence after pancreatic resections. The authors report the results of a multiparametric evaluation performed in a group of 26 patients submitted to total or cephalic pancreatectomy. Patients were divided into two groups according to the surgical procedure; group A (n = 13) included gastroresected patients and group B (n = 13) included those submitted to pylorus-sparing pancreatic resection. Subclinical digestive and absorptive impairment has been found in 61.5% of group A patients; the nutritional status was clinically poor in four cases from the same group. Digestive alterations have also been found in 69.2% of group B cases, but nutritional status was always satisfactory in the whole group. The more positive results obtained with the pylorus-sparing technique encourage wider adoption of this procedure.

The construction of a road injury database

In order to effectively examine possible causes and determinants of road trauma, reliable information on the participants, circumstances, and resultant injuries and deaths must be available. Characteristics of participants (persons and vehicles) and the circumstances of road accidents are routinely collected by police and road authorities, whereas details of the injuries and medical care provided to casualties are collected by hospital and ambulance services. A road injury database, linking data collected by the Health, Police, and Main Roads Departments of the Government of Western Australia with records of the St. John Ambulance Association and the Death Register, has been established. This paper describes the procedures used to link the various sources of data and discusses the design, construction, and quality of the resultant relational database.

Carcinoma of the pancreas: a personal experience with 100 cases

One hundred patients with pancreatic cancer were evaluated between March 1981 and December 1989. This study showed that 61 were not candidates for definitive surgery because of nonoperability (28 patients) or nonresectability (33 patients). An additional 25 patients had cancers that were unresectable because of metastases (13 patients) or local spread of disease (12 patients) discovered at laparotomy. Fourteen patients had resectable cancers. Ten were treated by total pancreatectomy, three by distal pancreatectomy and one by pancreatoduodenectomy (Whipple). There were two operative mortalities. The median patient survival time was 20.5 months. Two patients survived 5 years. Five patients are alive at 3, 14, 18, and 47 months. Palliative surgical procedures performed in 18 patients included 10 biliary bypasses, 9 gastrojejunostomies, and 6 T-tube placements. This was associated with an operative mortality rate of 11%. The median survival time was 5 months. Other palliative measures included endoscopic placement of biliary and pancreatic stents (47 patients, 2.7% mortality rate), endoluminal radiation therapy, interstitial radiation therapy and external beam radiation therapy. The median survival time of patients so treated was 4.5 months.

Urokinase and AT-III concentrate treatment in inferior vena cava thrombosis associated with nephrotic syndrome

A patient with an inferior vena cava thrombosis in nephrotic syndrome was treated with heparin, AT-III concentrates and urokinase. After a few days on treatment he showed a complete resolution of the thrombosis. We suggest that this therapeutic combination may be a good approach to the treatment of thrombosis in nephrotic syndrome.