Dataset Information

Mapping health data: improved privacy protection with donut method geomasking.

ABSTRACT: A major challenge in mapping health data is protecting patient privacy while maintaining the spatial resolution necessary for spatial surveillance and outbreak identification. A new adaptive geomasking technique, referred to as the donut method, extends current methods of random displacement by ensuring a user-defined minimum level of geoprivacy. In donut method geomasking, each geocoded address is relocated in a random direction by at least a minimum distance, but less than a maximum distance. The authors compared the donut method with current methods of random perturbation and aggregation regarding measures of privacy protection and cluster detection performance by masking multiple disease field simulations under a range of parameters. Both the donut method and random perturbation performed better than aggregation in cluster detection measures. The performance of the donut method in geoprivacy measures was at least 42.7% higher and in cluster detection measures was less than 4.8% lower than that of random perturbation. Results show that the donut method provides a consistently higher level of privacy protection with a minimal decrease in cluster detection performance, especially in areas where the risk to individual geoprivacy is greatest.

SUBMITTER: Hampton KH

PROVIDER: S-EPMC2984253 | biostudies-literature | 2010 Nov

REPOSITORIES: biostudies-literature

ACCESS DATA

Publications

Mapping health data: improved privacy protection with donut method geomasking.

Hampton Kristen H KH Fitch Molly K MK Allshouse William B WB Doherty Irene A IA Gesink Dionne C DC Leone Peter A PA Serre Marc L ML Miller William C WC

American journal of epidemiology 20100903 9

A major challenge in mapping health data is protecting patient privacy while maintaining the spatial resolution necessary for spatial surveillance and outbreak identification. A new adaptive geomasking technique, referred to as the donut method, extends current methods of random displacement by ensuring a user-defined minimum level of geoprivacy. In donut method geomasking, each geocoded address is relocated in a random direction by at least a minimum distance, but less than a maximum distance. ...[more]

PMID: 20817785

Similar Datasets

Project description:BACKGROUND:An online health community (OHC) is a novel sharing channel through which doctors share professional health care knowledge with patients. While doctors have the authority to protect their patients' privacy in OHCs, we have limited information on how doctors' privacy protection choices affect their professional health care knowledge sharing with patients. OBJECTIVE:We examined the relationship between privacy protection and professional health care knowledge sharing in OHCs. Specifically, we examined the effects of privacy protection settings in an OHC on doctors' interactive professional health care knowledge sharing and searching professional health care knowledge sharing (two dimensions of professional health care knowledge sharing). Moreover, we explored how such effects differ across different levels of disease stigma. METHODS:We collected the monthly panel data of 19,456 doctors from Good Doctor, one of the largest OHCs in China, from January 2008 to April 2016. A natural experimental empirical study with difference-in-difference analysis was conducted to test our hypotheses. The time fixed effect and the individual fixed effect were both considered to better identify the effects of a privacy protection setting on professional health care knowledge sharing. Additionally, a cross-sectional analysis was performed for a robust check. RESULTS:The results indicate that the privacy protection setting has a significant positive effect on interactive professional health care knowledge sharing (?=.123, P<.001). However, the privacy protection setting has a significant negative effect on searching professional health care knowledge sharing (?=-.225, P=.05). Moreover, we found that high disease stigma positively impacts the effect of privacy protection on interactive professional health care knowledge sharing (coefficients are in the same valence) and negatively impacts the effects of privacy protection on searching professional health care knowledge sharing (coefficients are in the reverse valence). CONCLUSIONS:Privacy protection has a bilateral effect on professional health care knowledge sharing (ie, a positive effect on interactive professional health care knowledge sharing and a negative effect on searching professional health care knowledge sharing). Such bilateral switches of professional health care knowledge sharing call for a balanced state in conjunction with practical implications. This research also identifies a moderate effect of disease stigma on privacy protection settings and professional health care knowledge sharing.

Project description:BACKGROUND:Sharing research data uses resources effectively; enables large, diverse data sets; and supports rigor and reproducibility. However, sharing such data increases privacy risks for participants who may be re-identified by linking study data to outside data sets. These risks have been investigated for genetic and medical records but rarely for environmental data. OBJECTIVES:We evaluated how data in environmental health (EH) studies may be vulnerable to linkage and we investigated, in a case study, whether environmental measurements could contribute to inferring latent categories (e.g., geographic location), which increases privacy risks. METHODS:We identified 12 prominent EH studies, reviewed the data types collected, and evaluated the availability of outside data sets that overlap with study data. With data from the Household Exposure Study in California and Massachusetts and the Green Housing Study in Boston, Massachusetts, and Cincinnati, Ohio, we used k-means clustering and principal component analysis to investigate whether participants' region of residence could be inferred from measurements of chemicals in household air and dust. RESULTS:All 12 studies included at least two of five data types that overlap with outside data sets: geographic location (9 studies), medical data (9 studies), occupation (10 studies), housing characteristics (10 studies), and genetic data (7 studies). In our cluster analysis, participants' region of residence could be inferred with 80%-98% accuracy using environmental measurements with original laboratory reporting limits. DISCUSSION:EH studies frequently include data that are vulnerable to linkage with voter lists, tax and real estate data, professional licensing lists, and ancestry websites, and exposure measurements may be used to identify subgroup membership, increasing likelihood of linkage. Thus, unsupervised sharing of EH research data potentially raises substantial privacy risks. Empirical research can help characterize risks and evaluate technical solutions. Our findings reinforce the need for legal and policy protections to shield participants from potential harms of re-identification from data sharing. https://doi.org/10.1289/EHP4817.

Project description:Genomic data is increasingly collected by a wide array of organizations. As such, there is a growing demand to make summary information about such collections available more widely. However, over the past decade, a series of investigations have shown that attacks, rooted in statistical inference methods, can be applied to discern the presence of a known individual's DNA sequence in the pool of subjects. Recently, it was shown that the Beacon Project of the Global Alliance for Genomics and Health, a web service for querying about the presence (or absence) of a specific allele, was vulnerable. The Integrating Data for Analysis, Anonymization, and Sharing (iDASH) Center modeled a track in their third Privacy Protection Challenge on how to mitigate the Beacon vulnerability. We developed the winning solution for this track.This paper describes our computational method to optimize the tradeoff between the utility and the privacy of the Beacon service. We generalize the genomic data sharing problem beyond that which was introduced in the iDASH Challenge to be more representative of real world scenarios to allow for a more comprehensive evaluation. We then conduct a sensitivity analysis of our method with respect to several state-of-the-art methods using a dataset of 400,000 positions in Chromosome 10 for 500 individuals from Phase 3 of the 1000 Genomes Project. All methods are evaluated for utility, privacy and efficiency.Our method achieves better performance than all state-of-the-art methods, irrespective of how key factors (e.g., the allele frequency in the population, the size of the pool and utility weights) change from the original parameters of the problem. We further illustrate that it is possible for our method to exhibit subpar performance under special cases of allele query sequences. However, we show our method can be extended to address this issue when the query sequence is fixed and known a priori to the data custodian, so that they may plan stage their responses accordingly.This research shows that it is possible to thwart the attack on Beacon services, without substantially altering the utility of the system, using computational methods. The method we initially developed is limited by the design of the scenario and evaluation protocol for the iDASH Challenge; however, it can be improved by allowing the data custodian to act in a staged manner.

Dataset Information

Mapping health data: improved privacy protection with donut method geomasking.

Publications

Mapping health data: improved privacy protection with donut method geomasking.

Similar Datasets

OmicsDI is part of the ELIXIR infrastructure

Tweets