Never too old for anonymity: a statistical standard for demographic data sharing via the HIPAA Privacy Rule
Never too old for anonymity: a statistical standard for demographic data sharing via the HIPAA Privacy Rule
复制标题
DOI：
10.1136/jamia.2010.004622
复制
发表时间：
2011-01-01
影响因子：
6.4
通讯作者：
Masys, Daniel
中科院分区：
文献类型：
--
作者：
Malin, Bradley;Benitez, Kathleen;Masys, Daniel
医疗保健组织在共享数据之前必须去识别患者记录。许多组织依赖于HIPAA隐私规则的安全港标准，它列举了18个必须被抑制的标识符（例如，年龄超过89岁）。隐私规则中的另一种模型，被称为统计标准，可以促进更详细数据的共享，但由于缺乏公开的方法，很少应用。作者提出了一种直观的方法来根据统计标准去识别患者人口统计学。作者针对美国人口普查，对美国国立卫生研究院赞助的电子医疗记录和基因组学网络开发的五个医疗中心的患者队列进行了人口统计分析。他们报告了根据安全港政策披露的患者人口统计数据的重新识别风险，以及通过其他政策共享此类信息的相对风险率。安全港人群的再识别风险范围为0.01% ~ 0.19%。研究结果表明，可以创建替代的去识别模型，其风险不大于安全港。作者说明，当其他特征在粒度上减少时，披露年龄超过89岁的患者是可能的。本文中描述的去识别方法仅用人口统计数据进行了评估，应该与其他潜在的标识符一起进行评估。结论：安全港模型的替代去识别策略可以为患者人口统计数据导出，使以前被压制的价值得以披露。该方法可推广到任何有人口统计数据的环境。
Objective Healthcare organizations must de-identify patient records before sharing data. Many organizations rely on the Safe Harbor Standard of the HIPAA Privacy Rule, which enumerates 18 identifiers that must be suppressed (eg, ages over 89). An alternative model in the Privacy Rule, known as the Statistical Standard, can facilitate the sharing of more detailed data, but is rarely applied because of a lack of published methodologies. The authors propose an intuitive approach to de-identifying patient demographics in accordance with the Statistical Standard.Design The authors conduct an analysis of the demographics of patient cohorts in five medical centers developed for the NIH-sponsored Electronic Medical Records and Genomics network, with respect to the US census. They report the re-identification risk of patient demographics disclosed according to the Safe Harbor policy and the relative risk rate for sharing such information via alternative policies.Measurements The re-identification risk of Safe Harbor demographics ranged from 0.01% to 0.19%. The findings show alternative de-identification models can be created with risks no greater than Safe Harbor. The authors illustrate that the disclosure of patient ages over the age of 89 is possible when other features are reduced in granularity.Limitations The de-identification approach described in this paper was evaluated with demographic data only and should be evaluated with other potential identifiers.Conclusion Alternative de-identification policies to the Safe Harbor model can be derived for patient demographics to enable the disclosure of values that were previously suppressed. The method is generalizable to any environment in which population statistics are available.