Balancing Disclosure Risk with Inferential Power: Software for Intervalized Data

描述（由申请人提供）：在医疗服务和公共卫生调查中收集的患者数据拥有大量可用于生物医学和流行病学研究的信息。然而，由于大多数个人健康记录的私密性，对这些数据的访问通常是有限的。在这些数据用于改善公共卫生之前，需要平衡研究数据的信息量与尽量减少披露风险所需的信息损失的方法。目前的方法主要侧重于保护隐私，但仅仅关注保护隐私是不够的。在统计披露控制技术中，信息的真实性没有得到很好的保护，因此可能会发布不可靠的结果。在基于泛化的匿名化方法中，由于属性泛化导致信息丢失，现有技术不能提供足够的控制来维护数据的实用性。目前需要的是既保护数据中所代表的个人隐私，又保护研究人员所研究关系的完整性的方法。问题在于，在保护个人隐私和保护数据集的信息量之间存在着一种内在的权衡。保护个人隐私总是会导致信息的丢失，而影响统计检验效力的正是数据集所包含的信息。然而，对于给定的匿名化策略，通常有多种方法可以掩盖符合所提供的披露风险标准的数据。可以利用这一点来选择最好地保留统计信息，同时满足所提供的披露风险标准的解决方案。该项目将开发第一个集成软件系统，为敏感医疗数据发布的三个阶段所面临的问题提供解决方案：2.通过对数据进行间隔化/泛化，使数据集匿名化，以满足当前可用的匿名化策略。2 .在匿名化过程中提供足够的控制，以满足对数据统计有用性的限制；为匿名数据间隔计算统计测试。这一努力面临两个主要挑战。首先，根据现有的研究结果，将我们提出的新控制过程集成到匿名化过程中预计在计算上是困难的。我们将通过开发高效且实用的贪婪算法、近似算法或适用于现实情况（如果不是一般情况）的算法来克服这一挑战。这项工作面临的另一个主要挑战是，已知区间数据集的统计计算在计算上很困难，而这些计算对于匿名化过程中的控制过程以及随后的统计计算和测试都是必要的。我们将利用有效的算法来克服这一挑战，这些算法利用了数据集中为隐私而间隔的结构。该软件将在各种大小和结构的医疗数据集上进行测试，以证明该方法的可行性，并表征算法随数据集大小的可扩展性。

DESCRIPTION (provided by applicant): Patient data collected during health care delivery and public health surveys possess a great deal of information that could be used in biomedical and epidemiological research. Access to these data, however, is usually limited because of the private nature of most personal health records. Methods of balancing the informativeness of data for research with the information loss required to minimize disclosure risk are needed before these data can be used to improve public health. Current methods are primarily focused on protecting privacy, but focusing on protecting privacy alone is inadequate. In statistical disclosure control techniques, information truthfulness is not well preserved so that unreliable results may be released. In generalization-based anonymization approaches, there is information loss due to attribute generalization and existing techniques do not provide sufficient control for maintaining data utility. What are currently needed are methods that protect both the privacy of individuals represented in the data as well as the integrity of relationships studied by researchers. The problem is that there is an inherent tradeoff between protecting the privacy of individuals and protecting the informativeness of the data set. Protecting the privacy of individuals always results in a loss of information and it is the information contained by the data set that affects the power of a statistical test. For a given anonymization strategy, however, there are often multiple ways of masking the data that meet the disclosure risk criteria provided. This can be taken advantage of to choose the solution that best preserves statistical information while meeting the disclosure risk criteria provided. This project will develop the first integrated software system that provides solutions for problems faced in all three stages in the release of sensitive health care data: 1. anonymize a data set by intervalizing/generalizing data to satisfy currently available anonymization strategies, 2. provide sufficient controls within anonymization procedures to satisfy constraints on statistical usefulness of the data, and 3. compute statistical tests for the anonymized data intervals. There are two main challenges facing this effort. The first is that, based on existing research results, integrating our proposed new control processes into anonymization procedures is expected to be computationally difficult. We will overcome this challenge by developing efficient and practically useful greedy algorithms, approximation algorithms, or algorithms working for realistic situations (if not for general cases). The other primary challenge facing this effort is the fact that statistical calculations with interval data sets are known to be computationally difficult, and these calculations are necessary both for control processes within anonymization procedures and for subsequent statistical computation and tests. We will overcome this challenge with efficient algorithms that exploit the structure present in data sets intervalized for privacy. The software will be tested on medical data sets of various sizes and structures to demonstrate the feasibility of the approach and to characterize the scalability of the algorithms with data set size. PUBLIC HEALTH RELEVANCE: Patient health records possess a great deal of information that is useful in medical research, but access to these data is usually limited because of the private nature of most personal health records. Methods of balancing the informativeness of data for research with the information loss required to minimize disclosure risk are needed before these data can be used to improve public health. This project will develop the first integrated software system that provides solutions for intervalizing/generalizing data, controlling data utility, and performing analyses using interval statistics.