Mapping health data: improved privacy protection with donut method geomasking

Abstract

A major challenge in mapping health data is protecting patient privacy while maintaining the spatial resolution necessary for spatial surveillance and outbreak identification. A new adaptive geomasking technique, referred to as the donut method, extends current methods of random displacement by ensuring a user-defined minimum level of geoprivacy. In donut method geomasking, each geocoded address is relocated in a random direction by at least a minimum distance, but less than a maximum distance. The authors compared the donut method with current methods of random perturbation and aggregation regarding measures of privacy protection and cluster detection performance by masking multiple disease field simulations under a range of parameters. Both the donut method and random perturbation performed better than aggregation in cluster detection measures. The performance of the donut method in geoprivacy measures was at least 42.7% higher and in cluster detection measures was less than 4.8% lower than that of random perturbation. Results show that the donut method provides a consistently higher level of privacy protection with a minimal decrease in cluster detection performance, especially in areas where the risk to individual geoprivacy is greatest.

Figure 1.

Comparison of random perturbation (left) and donut method (right) geomasks. For a given Max k geoprivacy level, the Euclidean distance R2 is calculated for each point from the underlying population density. The population within a circular region of radius R2 around a point is equal to Max k, with R2 being the maximum distance the point may be displaced from its original location. For the donut method (right), a Min k (dotted) is also given that defines the minimum displacement R1. The actual distance displaced, r, ranges in value from 0 to R2 for random perturbation (left) and from R1 to R2 for the donut method (right). The population within the circular region of radius r (striped) is the actual k achieved by the geomask.

Figure 2.

For a given geoprivacy level (Max k = 1,000), shown are density-scaled histograms of the A) distance displaced with random perturbation, B) distance displaced with the donut method, C) actual k achieved with random perturbation, and D) actual k achieved with the donut method (all iterations). With the donut method, points were perturbed at least a minimum distance from their original locations. Correspondingly, the donut method maintained a minimum level of k-anonymity with more points achieving higher actual k values.

Figure 3.

Average A) actual k, B) sensitivity, and C) specificity for random perturbation and the donut method as a function of Max k. At all levels, the donut method, compared with random perturbation, achieved higher average k-anonymity. Regarding sensitivity, both random perturbation and the donut method performed worse than baseline (no geomasking) and better than aggregation, with no significant difference in specificity.

Figure 4.

Average percent change between random perturbation and donut method values as a function of Max k. The percent change in mean actual k was significantly higher and increased at a faster rate than that of sensitivity and specificity.