Evaluating the risk of patient re-identification from adverse drug event reports

BMC Medical Informatics and Decision Making

Research Article

Angelica Neisa¹  Fida K Dankar¹  Elizabeth Jonker¹  Khaled El Emam² 

[1] Children’s Hospital of Eastern Ontario Research Institute, 401 Smyth Road, K1J 8 L1, Ottawa, Ontario, Canada;Children’s Hospital of Eastern Ontario Research Institute, 401 Smyth Road, K1J 8 L1, Ottawa, Ontario, Canada;Pediatrics, Faculty of Medicine, University of Ottawa, Ottawa, Ontario, Canada;

关键词: Equivalence Class;    Adverse Drug Event;    Correct Match;    Random Match;    Personal Health Information;   

DOI  :  10.1186/1472-6947-13-114

 received in 2013-04-29, accepted in 2013-09-25,  发布年份 2013

来源: Springer

【 摘 要 】

BackgroundOur objective was to develop a model for measuring re-identification risk that more closely mimics the behaviour of an adversary by accounting for repeated attempts at matching and verification of matches, and apply it to evaluate the risk of re-identification for Canada’s post-marketing adverse drug event database (ADE).Re-identification is only demonstrably plausible for deaths in ADE. A matching experiment between ADE records and virtual obituaries constructed from Statistics Canada vital statistics was simulated. A new re-identification risk is considered, it assumes that after gathering all the potential matches for a patient record (all records in the obituaries that are potential matches for an ADE record), an adversary tries to verify these potential matches. Two adversary scenarios were considered: (a) a mildly motivated adversary who will stop after one verification attempt, and (b) a highly motivated adversary who will attempt to verify all the potential matches and is only limited by practical or financial considerations.MethodsThe mean percentage of records in ADE that had a high probability of being re-identified was computed.ResultsUnder scenario (a), the risk of re-identification from disclosing the province, age at death, gender, and exact date of the report is quite high, but the removal of province brings down the risk significantly. By only generalizing the date of reporting to month and year and including all other variables, the risk is always low. All ADE records have a high risk of re-identification under scenario (b), but the plausibility of that scenario is limited because of the financial and practical deterrent even for highly motivated adversaries.ConclusionsIt is possible to disclose Canada’s adverse drug event database while ensuring that plausible re-identification risks are acceptably low. Our new re-identification risk model is suitable for such risk assessments.

【 授权许可】

CC BY   
© El Emam et al.; licensee BioMed Central Ltd. 2013