Privacy and de-identification
Three kinds of field
- DIRECT identifiers: name, record number, full address, contact details. Removed, always.
- QUASI-identifiers: dates, ages over 89, small geographies, rare diagnoses, occupation, admission and discharge dates. Individually unremarkable, jointly identifying.
- SENSITIVE attributes: the clinical content, which is what the data are for and what a re-identification would expose.
- The usual treatments are generalisation (year instead of date, region instead of postcode), suppression of rare values, and date shifting by a per-patient offset that preserves intervals.
- Free text is the hardest case: clinical notes carry identifiers in unpredictable places and automated redaction is imperfect, so text usually needs review or exclusion.
Judging the risk honestly
The published re-identification demonstrations are dominated by data that were not de-identified to any standard, and the evidence about properly de-identified health data is thinner than either side of the debate suggests. The practical response is a risk assessment against the plausible attacker and the release context, rather than a claim of anonymity or a refusal to share.
Context is part of the protection
The same dataset carries very different risk released publicly and released to a named researcher under an agreement in a secure environment. Controlled access, data-use agreements and analysis-in-place are legitimate answers when the data cannot be safely opened.
What this means for a study
Say in the protocol what will be collected, what identifiers are needed and why, where the linkage key is held and by whom, when it will be destroyed, and who has access. Collect the minimum that answers the question. Consent should reflect the actual plan, including secondary use and sharing.
What to watch out for
The risk lives in combinations, not in individual fields. A date of birth, a postcode and a sex identify a large fraction of a population between them, none of which looks like an identifier on its own. Removing direct identifiers is therefore the beginning of de-identification rather than the whole of it, and a dataset described as anonymised without a stated risk assessment has not been assessed.
Clinical example
A dataset for sharing keeps admission date, discharge date, five-digit postcode and a rare diagnosis. No names appear anywhere, and the combination is likely to identify individuals in a small area. Shifting the dates per patient, generalising the geography and suppressing the rare category addresses it.
- A systematic review of re-identification attacks on health data (opens in a new tab) · PLoS One · doi 10.1371/journal.pone.0028071
- World Medical Association Declaration of Helsinki: ethical principles for medical research involving human subjects (opens in a new tab) · JAMA · doi 10.1001/jama.2013.281053