Evaluation of Privacy Risks of Patients' Data in China: Case Study

Area of Science:

• Health Informatics
• Data Privacy
• Biomedical Data Security

Background:

• Patient privacy is a global concern, especially with the increasing need for biomedical data sharing and analysis.
• Existing studies highlight privacy risks in biomedical data sharing, necessitating robust privacy assessment methods.
• China lacks clear regulations for deidentifying health data, prompting an evaluation of privacy protection mechanisms.

Purpose of the Study:

• To pilot a study using Chinese patient data to quantify privacy risks.
• To assess the effectiveness of the Health Insurance Portability and Accountability Act (HIPAA) safe harbor policy in deidentifying Chinese patient data.
• To provide a foundation for future privacy risk studies concerning Chinese patient data.

Main Methods:

• Utilized g-distinct analysis to evaluate reidentification risks.
• Applied HIPAA safe harbor and limited dataset policies to Chinese patient data.
• Assumed an attacker possesses background knowledge from the public domain for risk estimation.

Main Results:

• Under the Limited Dataset policy, 19.58% of 0.83 million Chinese patients were uniquely identifiable.
• The HIPAA Safe Harbor policy reduced unique identifiability to 0.072%, with most individuals indistinguishable within groups of 3000.
• Results indicate varying reidentification risks based on data policies and geographic regions.

Conclusions:

• G-distinct analysis of Chinese patient data shows privacy risks comparable to US studies.
• The HIPAA Safe Harbor policy offers significant protection for Chinese patient data privacy.
• Findings offer a reference for Chinese healthcare entities to estimate and manage patient privacy risks during data sharing.