Anonymization of longitudinal electronic medical records

Abstract

Electronic medical record (EMR) systems have enabled healthcare providers to collect detailed patient information from the primary care domain. At the same time, longitudinal data from EMRs are increasingly combined with biorepositories to generate personalized clinical decision support protocols. Emerging policies encourage investigators to disseminate such data in a deidentified form for reuse and collaboration, but organizations are hesitant to do so because they fear such actions will jeopardize patient privacy. In particular, there are concerns that residual demographic and clinical features could be exploited for reidentification purposes. Various approaches have been developed to anonymize clinical data, but they neglect temporal information and are, thus, insufficient for emerging biomedical research paradigms. This paper proposes a novel approach to share patient-specific longitudinal data that offers robust privacy guarantees, while preserving data utility for many biomedical investigations. Our approach aggregates temporal and diagnostic information using heuristics inspired from sequence alignment and clustering methods. We demonstrate that the proposed approach can generate anonymized data that permit effective biomedical analysis using several patient cohorts derived from the EMR system of the Vanderbilt University Medical Center.

Fig. 1

Longitudinal data privacy problem. (a) Longitudinal research data. (b) Identified EMR. (c) 2-anonymization based on the proposed approach.

Fig. 2

General architecture of the longitudinal data anonymization process.

Fig. 3

Example of the DGH structure for Age.

Fig. 4

Example of the hypertension subtree in the ICD DGH.

Fig. 5

Matrices i, a, and r for the subset of records from Fig. 1. This alignment uses the DGHs in Figs. 3 and 4 and assumes that w_ICD = w_Age = 0.5.

Fig. 6

Comparison of information loss for $D_{50}^{\text{Pop}}$ using various k values.

Fig. 7

Comparison of query answering accuracy for $D_{50}^{\text{Pop}},D_4^{\text{Pop}}$, and $D_4^{\text{Smp}}$ using various k values.

Fig. 8

A comparison of information loss for $D_{50}^{\text{Pop}}$ using various w_ICD and w_Age values.