Sharing Confidential Datasets With Geographic Identifiers Via Multiple Imputation

描述（由申请人提供）：地理数据对分析非常有益。例如，在老龄化研究中，它们可以揭示老年人高密度居住的地区；它们可以阐明环境因素如何影响老年人的健康和生活质量；而且，通过背景数据，它们可以洞察老年人的社会和经济状况以及生活方式选择。然而，在向他人提供主要数据源时，地理变量是最具挑战性的数据之一。精细的地理位置使心怀不轨的用户能够精确定位共享文件中个人的身份。因此，数据收集器通常在共享数据之前删除或聚合地理位置到非常高的级别。例如，在健康和退休研究的公共使用文件中，对地理采用了删除和汇总两种方法；《健康保险流通与责任法案》要求共享文件的任何地理单位至少包括2万人。这些行为降低了基于精细地理细节的分析的质量，从而牺牲了在分析中使用地理的好处。我们开发了新的方法来保护地理标识符数据的机密性。我们的方法是从统计模型中模拟地理和其他识别属性（如年龄）的值，这些模型捕获了收集数据中的空间依赖性。在共享数据时，这些模拟值将替换收集到的值。部分模拟数据集可以保持机密性，因为当发布数据中的地理位置和其他准标识符不是收集值时，很难识别单元及其敏感数据。当模拟模型忠实地反映了收集数据中的关系时，共享数据保留了空间关联，避免了生态推理问题，并提供了分布尾部的详细信息。我们在这项建议中有三个具体目标。首先，利用空间建模技术，我们开发了以属性为条件的地理变量模拟方法和以地理为条件的地理属性模拟方法。其次，我们将我们的方法应用于真实数据集，在三种情况下评估部分模拟数据的机密性保护和分析效用：仅模拟地理、仅模拟非地理标识符、同时模拟地理和其他标识符。第三，我们将我们的方法与真实数据集上的聚合技术进行比较。我们的长期目标是开发通用的方法和公开可用的软件，用于共享有效的、安全的数据，这些数据包括比目前发布的更详细的地理信息。这将为统计机构、研究人员和其他数据生产者提供比目前更多更好的数据共享选择。公共卫生相关性：这项研究有可能改善统计机构、研究中心、个人研究人员和其他数据生产者共享老龄化数据的方式，更广泛地说，包括地理在内的任何健康或人口统计学数据。与现有的删除和高层次聚合等方法不同，我们的方法承诺在保护机密性的同时保留良好的地理和空间关系。最终，这使二手数据分析师能够做出更多更好的推断，从而更深入地了解公共卫生。

DESCRIPTION (provided by applicant): Geographic data can be enormously beneficial for analyses. In studies of aging, for example, they can reveal areas where elderly people live in high densities; they can illuminate how environmental factors impact the health and quality of life of elderly people; and, through contextual data, they can yield insights into the social and economic conditions and lifestyle choices of the elderly. However, geographic variables are among the most challenging data to share when making a primary data source available to others. Fine geography enables ill-intentioned users to pinpoint the identities of individuals in the shared file. Thus, data collectors typically delete or aggregate geographies to very high levels before sharing data. As examples, both deletion and aggregation are employed on geography in the public use files of the Health and Retirement Study; and, the Health Insurance Portability and Accountability Act requires that any geographic units on shared files comprise at least 20,000 people. These actions reduce the quality of analyses based on finer geographic detail, thereby sacrificing the benefits of using geography in analysis. We develop new methods to protect confidentiality in data with geographic identifiers. Our approach is to simulate values of geography and other identifying attributes, such as age, from statistical models that capture the spatial dependencies in the collected data. These simulated values replace the collected ones when sharing data. Partially simulated datasets can preserve confidentiality, since identification of units and their sensitive data is difficult when the geographies and other quasi-identifiers in the released data are not collected values. And, when the simulation models faithfully reflect the relationships in the collected data, the shared data preserve spatial associations, avoid ecological inference problems, and provide details about the tails of distributions. We have three specific aims in this proposal. First, using techniques from spatial modeling, we develop methods for simulating geographic variables conditional on attributes and for simulating at- tributes conditional on geography. Second, we apply our approach on a genuine dataset to evaluate the confidentiality protection and analytic utility of partially simulated data under three scenarios: only geography simulated, only non-geographic identifiers simulated, and both geographic and other identifiers simulated. Third, we compare our approach against aggregation techniques on the genuine dataset. Our long term goal is to develop general-purpose methodology and publicly available software for sharing inference-valid, safe data that includes finer details about geography than are currently released. This will provide statistical agencies, researchers, and other data producers with more and better options for data sharing than exist at present. PUBLIC HEALTH RELEVANCE: This research has the potential to improve the way statistical agencies, research centers, individual researchers, and other data producers share data on aging, and more broadly any health or de- mographic data containing geography. Unlike existing approaches such as deletion and high level aggregation, our approach promises to preserve fine geography and spatial relationships while pro- tecting confidentiality. Ultimately, this enables secondary data analysts to make more and better inferences, leading to deeper understanding of public health.