Privacy protection and aggregate health data: a review of tabular cell suppression methods (not) employed in public health data systems
Privacy protection and aggregate health data: a review of tabular cell suppression methods (not) employed in public health data systems
复制标题
DOI：
10.1007/s10742-016-0162-8
复制
发表时间：
2016-12-01
影响因子：
1.5
通讯作者：
Aseltine, Robert H., Jr.
中科院分区：
文献类型：
--
作者：
Matthews, Gregory J.;Harel, Ofer;Aseltine, Robert H., Jr.
公共卫生研究往往依赖于个人的机密医疗数据。因此，数据收集实体，如国家，寻求尽可能广泛地传播这些医疗数据，同时出于法律和道德原因仍保持个人隐私。发布这些医疗数据的一种常见方式是使用基于Web的数据查询系统(WDQS)。在本文中，我们检查了国家公共卫生统计和信息系统协会(NAPHSIS)中列出的WDQ，并专门审查了它们如何在产生表格响应的查询中防止统计信息泄露。对抗这种类型的泄漏的最常见方法之一是通过使用抑制，即如果表中的单元格计数低于特定阈值，则抑制真值。这项技术确实可以防止小单元格计数的直接泄露，然而，主要抑制本身并不总是足以保护表格数据中的隐私。在这里，我们提供了几个使用隐藏的表格响应查询的真实示例，但我们能够推断被隐藏的单元格的值，包括计数为1的单元格，这些单元格可以链接到辅助数据源，从而有可能创建身份泄露。我们力求提高人们对个人可能希望通过在线查询系统保密的信息的披露潜力的认识。这项研究是希望能够先发制人地处理隐私问题，而不是只有在重大披露发生后才进行。在发生这样的事件后，一个主要的担忧是，州和地方官员会对此做出永久关闭这些网站的反应，并切断一个宝贵的研究数据来源。
Public health research often relies on individuals' confidential medical data. Therefore, data collecting entities, such as states, seek to disseminate this medical data as widely as possible while still maintaining the privacy of the individual for legal and ethical reasons. One common way in which this medical data is released is through the use of Web-based Data Query Systems (WDQS). In this article, we examined WDQS listed in the National Association for Public Health Statistics and Information Systems (NAPHSIS) specifically reviewing them for how they prevent statistical disclosure in queries that produce a tabular response. One of the most common methods to combat this type of disclosure is through the use of suppression, that is, if a cell count in a table is below a certain threshhold, the true value is suppressed. This technique does work to prevent the direct disclosure of small cell counts, however, primary suppression by itself is not always enough to preserve privacy in tabular data. Here, we present several real examples of tabular response queries that employ suppression, but we are able to infer the values of the suppressed cells, including cells with 1 counts, which could be linked to auxiliary data sources and thus has the possibility to create an identity disclosure. We seek to stimulate awareness of the potential for disclosure of information that individuals may wish to keep private through an online query system. This research is undertaken in the hope that privacy concerns can be dealt with preemptively rather than only after a major disclosure has taken place. In the wake of a such an event, a major concern is that state and local officials would react to this by permanently shutting down these sites and cutting off a valuable source of research data.