4 ms·

What are your recommendations for anonymizing PHI data, for example? Saying there is no way to anonymize data isn't really a solution and beyond that, I don't t

What are your recommendations for anonymizing PHI data, for example? Saying there is no way to anonymize data isn't really a solution and beyond that, I don't think it's true. What practitioners need is a canonical reference or toolset that you could feed a csv file to, tell it which columns should be scrambled and out comes an anonymized data set. Yes, I realize the "tell it" part is of concern, well that could be mitigated by smarter tools and more knowledgable practitioners - knowledge gained from a canonical reference.

randomwalker 12y ago
Regardless of whether PHI can be anonymized in a fool-proof way, we can agree that careful anonymization is better than a superficial one, and so your question is valid and important. We can't automate the process (in part because the transformations necessary are much more complex than "scrambling"), but knowledgeable practitioners can go a long way. I'm knowledgeable but not a practitioner, so I'm not the best source. In #8 of our report (on the Heritage Health data), you'll notice that while I took Khaled El Emam to task for claims about quantifying risk, I do acknowledge that he did a very good job of de-identification. I don't think there's exactly a "canonical reference" (except HIPAA's superficial list of 18 identifiers), but reports written by practitioners like El Emam are probably useful documents.
jandrewrogers 12y ago
In order to have minimally robust anonymization you must strip out all implicit or explicit references to locations and times. Unfortunately, space and time values are material to the analysis of most non-trivial data models (it certainly is for health data) so stripping that out is not really an option. Few people appreciate the robustness and generalizability of spatiotemporal coincidence analysis for reconstructing relationships in anonymized data both within and across many unrelated sources of anonymized data, even sources that are identifying entities that are not people (like anonymous vehicle tracking). There are enough anonymous entity tracking data sources available to algorithmically reconstruct relationships to most other "anonymous" data sources. I've seen it done many times and the capabilities are jaw-dropping in part because it violates human intuition as to what it is possible with such data sets.
- siculars 12y ago
  Right, it seems to me that spatiotemporal shifting and id salt-hashing would go some way towards a viable de-identification scheme.
- aetherson 12y ago
  Do you have opinions on/is there research regarding how much "fuzzing" you have to do to get substantial rewards in making space/time data anonymous? That is, if my legitimate use for a space/time dataset can stand that data being handled at the resolution of "hours" and "within 100 meters," does it win me significant privacy benefits to scrub out more significant figures?
  - ProblemFactory 12y ago
    There is plenty of good work on anonymising and fuzzing location data. But unfortunately the results show that the amount of fuzzing required for anonymity is huge. "Hours and 100m" are far from enough, only something like "year and state" might work. Some of the notable results are: * Golle and Partridge 2009 (http://xenon.stanford.edu/~pgolle/papers/commute.pdf http://xenon.stanford.edu/~pgolle/papers/commute.pdf) - Just the home and work location at city block level is enough to uniquely identify 50% of the US population. Home and work at zip code level is enough to uniquely identify 5% of US population. Home and work county is still enough to identify 1% of people to a set of 6 candidates. * Montjoye et. al. 2013 (http://www.nature.com/srep/2013/130325/srep01376/full/srep01376.html http://www.nature.com/srep/2013/130325/srep01376/full/srep01...) - If you have a time-location dataset of people with hourly accuracy of time and cell tower accuracy for location (100m in cities, a few km in rural areas), then four randomly picked points for each person uniquely identify 95% of them. Just two randomly picked points for each person uniquely identify 50% of people. The main conclusion is that it is not possible to release an "anonymised" location dataset of people that is still useful for mobility research. The only realistic approach seems to be to have strict privacy regulations and NDAs with people who are given access to this data. But more generally, all research into anonymisation and preventing de-anonymisation is difficult because it's not known what other data sources the attacker has access to. If I have a time-location dataset of anonymous people, and if I see from Facebook when a friend visited Paris and Barcelona, then it becomes trivial to match these dates and cities against the location traces, and find their full movement trace. Similarly, if I can get an anonymous dataset of phone calls, then I can make 20 missed calls at 4am to a friend, and later look for that pattern in the data to find their other calls. The best example of this was from the Netflix dataset of anonymous movie ratings ( http://en.wikipedia.org/wiki/Differential_privacy#Netflix_Prize http://en.wikipedia.org/wiki/Differential_privacy#Netflix_Pr... ) - people were anonymous in their dataset, but some people also rated movies with visible identities on IMDB. Correlating the two datasets allowed researchers to discover the identities of people in the Netflix dataset.

randomwalker 12y ago

Regardless of whether PHI can be anonymized in a fool-proof way, we can agree that careful anonymization is better than a superficial one, and so your question is valid and important. We can't automate the process (in part because the transformations necessary are much more complex than "scrambling"), but knowledgeable practitioners can go a long way. I'm knowledgeable but not a practitioner, so I'm not the best source. In #8 of our report (on the Heritage Health data), you'll notice that while I took Khaled El Emam to task for claims about quantifying risk, I do acknowledge that he did a very good job of de-identification. I don't think there's exactly a "canonical reference" (except HIPAA's superficial list of 18 identifiers), but reports written by practitioners like El Emam are probably useful documents.

jandrewrogers 12y ago

In order to have minimally robust anonymization you must strip out all implicit or explicit references to locations and times. Unfortunately, space and time values are material to the analysis of most non-trivial data models (it certainly is for health data) so stripping that out is not really an option. Few people appreciate the robustness and generalizability of spatiotemporal coincidence analysis for reconstructing relationships in anonymized data both within and across many unrelated sources of anonymized data, even sources that are identifying entities that are not people (like anonymous vehicle tracking). There are enough anonymous entity tracking data sources available to algorithmically reconstruct relationships to most other "anonymous" data sources. I've seen it done many times and the capabilities are jaw-dropping in part because it violates human intuition as to what it is possible with such data sets.

siculars 12y ago
Right, it seems to me that spatiotemporal shifting and id salt-hashing would go some way towards a viable de-identification scheme.
aetherson 12y ago
Do you have opinions on/is there research regarding how much "fuzzing" you have to do to get substantial rewards in making space/time data anonymous? That is, if my legitimate use for a space/time dataset can stand that data being handled at the resolution of "hours" and "within 100 meters," does it win me significant privacy benefits to scrub out more significant figures?
- ProblemFactory 12y ago
  There is plenty of good work on anonymising and fuzzing location data. But unfortunately the results show that the amount of fuzzing required for anonymity is huge. "Hours and 100m" are far from enough, only something like "year and state" might work. Some of the notable results are: * Golle and Partridge 2009 (http://xenon.stanford.edu/~pgolle/papers/commute.pdf http://xenon.stanford.edu/~pgolle/papers/commute.pdf) - Just the home and work location at city block level is enough to uniquely identify 50% of the US population. Home and work at zip code level is enough to uniquely identify 5% of US population. Home and work county is still enough to identify 1% of people to a set of 6 candidates. * Montjoye et. al. 2013 (http://www.nature.com/srep/2013/130325/srep01376/full/srep01376.html http://www.nature.com/srep/2013/130325/srep01376/full/srep01...) - If you have a time-location dataset of people with hourly accuracy of time and cell tower accuracy for location (100m in cities, a few km in rural areas), then four randomly picked points for each person uniquely identify 95% of them. Just two randomly picked points for each person uniquely identify 50% of people. The main conclusion is that it is not possible to release an "anonymised" location dataset of people that is still useful for mobility research. The only realistic approach seems to be to have strict privacy regulations and NDAs with people who are given access to this data. But more generally, all research into anonymisation and preventing de-anonymisation is difficult because it's not known what other data sources the attacker has access to. If I have a time-location dataset of anonymous people, and if I see from Facebook when a friend visited Paris and Barcelona, then it becomes trivial to match these dates and cities against the location traces, and find their full movement trace. Similarly, if I can get an anonymous dataset of phone calls, then I can make 20 missed calls at 4am to a friend, and later look for that pattern in the data to find their other calls. The best example of this was from the Netflix dataset of anonymous movie ratings ( http://en.wikipedia.org/wiki/Differential_privacy#Netflix_Prize http://en.wikipedia.org/wiki/Differential_privacy#Netflix_Pr... ) - people were anonymous in their dataset, but some people also rated movies with visible identities on IMDB. Correlating the two datasets allowed researchers to discover the identities of people in the Netflix dataset.