A multi-institution evaluation of clinical profile anonymization

Area of Science:

• Health Informatics
• Biomedical Data Science
• Privacy-Preserving Technologies

Background:

• Growing need to share de-identified electronic health records (EHRs) for secondary research.
• Concerns exist regarding patient identity compromise from clinical terms in EHRs.
• Existing anonymization algorithm evaluations are limited to single institutions.

Purpose of the Study:

• To evaluate the performance of a k-anonymization algorithm across multiple medical centers.
• To assess the impact of anonymization context (entire EHR, biorepository, specific study) on data utility.
• To determine the effectiveness of anonymization in safeguarding patient privacy while enabling data sharing.

Main Methods:

• Applied a state-of-the-art k-anonymization algorithm (k=5) to International Classification of Disease, ninth edition codes.
• Utilized patient data from three medical centers: Marshfield Clinic, Northwestern University, and Vanderbilt University.
• Assessed anonymization utility by examining dataset size, code inclusion, and required generalization/suppression levels across different population contexts.

Main Results:

• Anonymizing within the entire EHR system significantly increased data quantity by reducing generalized regions from ~15% to ~0.5%.
• Approximately 70% of codes requiring generalization were only generalized to two or three codes in the largest anonymization context.
• The k-anonymization approach demonstrated effectiveness across different population levels and institutions.

Conclusions:

• Sharing large volumes of clinical data for phenome-wide association studies is achievable.
• The implemented anonymization strategy effectively safeguards individual patient privacy.
• Multi-institutional evaluation confirms the robustness of the anonymization approach for EHR data.