A multi-institution evaluation of clinical profile anonymization. (13th November 2015)

• Record Type: Journal Article
• Authors: Heatherly, Raymond; Rasmussen, Luke V; Peissig, Peggy L; Pacheco, Jennifer A; Harris, Paul; Denny, Joshua C; Malin, Bradley A
• Is Part Of: Journal of the American Medical Informatics Association. Volume 23:Number e1(2016:Apr.)
• Page Start: e131
• Page End: e137
• Publication Date: 2015-11-13
• Subjects: privacy -- generalization -- secondary use -- anonymization -- clinical codes; Medical informatics -- Periodicals; Information Services -- Periodicals; Medical Informatics -- Periodicals; Médecine -- Informatique -- Périodiques; Informatica; Geneeskunde; Informatique médicale; Computer network resources; Electronic journals; 610.285
• DOI: 10.1093/jamia/ocv154
• Languages: English
• ISSNs: 1067-5027

Abstract

Abstract: Background and objective: There is an increasing desire to share de-identified electronic health records (EHRs) for secondary uses, but there are concerns that clinical terms can be exploited to compromise patient identities. Anonymization algorithms mitigate such threats while enabling novel discoveries, but their evaluation has been limited to single institutions. Here, we study how an existing clinical profile anonymization fares at multiple medical centers. Methods: We apply a state-of-the-art k -anonymization algorithm, with k set to the standard value 5, to the International Classification of Disease, ninth edition codes for patients in a hypothyroidism association study at three medical centers: Marshfield Clinic, Northwestern University, and Vanderbilt University. We assess utility when anonymizing at three population levels: all patients in 1) the EHR system; 2) the biorepository; and 3) a hypothyroidism study. We evaluate utility using 1) changes to the number included in the dataset, 2) number of codes included, and 3) regions generalization and suppression were required. Results: Our findings yield several notable results. First, we show that anonymizing in the context of the entire EHR yields a significantly greater quantity of data by reducing the amount of generalized regions from ∼15% to ∼0.5%. Second, ∼70% of codes that needed generalization only generalized two or three codes in the largest anonymization. Conclusions: Sharing large volumes of clinical data in support of phenome-wide association studies is possible while safeguarding privacy to the underlying individuals.