Kelly Broen1,2, Rob Trangucci3, Jon Zelner4,5. 1. Department of Epidemiology, University of Michigan School of Public Health, Ann Arbor, MI, 48109, USA. broenk@umich.edu. 2. Center for Social Epidemiology and Population Health, University of Michigan School of Public Health, Ann Arbor, MI, 48109, USA. broenk@umich.edu. 3. Dept. of Statistics, University of Michigan, Ann Arbor, MI, 48109, USA. 4. Department of Epidemiology, University of Michigan School of Public Health, Ann Arbor, MI, 48109, USA. 5. Center for Social Epidemiology and Population Health, University of Michigan School of Public Health, Ann Arbor, MI, 48109, USA.
Abstract
BACKGROUND: Like many scientific fields, epidemiology is addressing issues of research reproducibility. Spatial epidemiology, which often uses the inherently identifiable variable of participant address, must balance reproducibility with participant privacy. In this study, we assess the impact of several different data perturbation methods on key spatial statistics and patient privacy. METHODS: We analyzed the impact of perturbation on spatial patterns in the full set of address-level mortality data from Lawrence, MA during the period from 1911 to 1913. The original death locations were perturbed using seven different published approaches to stochastic and deterministic spatial data anonymization. Key spatial descriptive statistics were calculated for each perturbation, including changes in spatial pattern center, Global Moran's I, Local Moran's I, distance to the k-th nearest neighbors, and the L-function (a normalized form of Ripley's K). A spatially adapted form of k-anonymity was used to measure the privacy protection conferred by each method, and its compliance with HIPAA and GDPR privacy standards. RESULTS: Random perturbation at 50 m, donut masking between 5 and 50 m, and Voronoi masking maintain the validity of descriptive spatial statistics better than other perturbations. Grid center masking with both 100 × 100 and 250 × 250 m cells led to large changes in descriptive spatial statistics. None of the perturbation methods adhered to the HIPAA standard that all points have a k-anonymity > 10. All other perturbation methods employed had at least 265 points, or over 6%, not adhering to the HIPAA standard. CONCLUSIONS: Using the set of published perturbation methods applied in this analysis, HIPAA and GDPR compliant de-identification was not compatible with maintaining key spatial patterns as measured by our chosen summary statistics. Further research should investigate alternate methods to balancing tradeoffs between spatial data privacy and preservation of key patterns in public health data that are of scientific and medical importance.
BACKGROUND: Like many scientific fields, epidemiology is addressing issues of research reproducibility. Spatial epidemiology, which often uses the inherently identifiable variable of participant address, must balance reproducibility with participant privacy. In this study, we assess the impact of several different data perturbation methods on key spatial statistics and patient privacy. METHODS: We analyzed the impact of perturbation on spatial patterns in the full set of address-level mortality data from Lawrence, MA during the period from 1911 to 1913. The original death locations were perturbed using seven different published approaches to stochastic and deterministic spatial data anonymization. Key spatial descriptive statistics were calculated for each perturbation, including changes in spatial pattern center, Global Moran's I, Local Moran's I, distance to the k-th nearest neighbors, and the L-function (a normalized form of Ripley's K). A spatially adapted form of k-anonymity was used to measure the privacy protection conferred by each method, and its compliance with HIPAA and GDPR privacy standards. RESULTS: Random perturbation at 50 m, donut masking between 5 and 50 m, and Voronoi masking maintain the validity of descriptive spatial statistics better than other perturbations. Grid center masking with both 100 × 100 and 250 × 250 m cells led to large changes in descriptive spatial statistics. None of the perturbation methods adhered to the HIPAA standard that all points have a k-anonymity > 10. All other perturbation methods employed had at least 265 points, or over 6%, not adhering to the HIPAA standard. CONCLUSIONS: Using the set of published perturbation methods applied in this analysis, HIPAA and GDPR compliant de-identification was not compatible with maintaining key spatial patterns as measured by our chosen summary statistics. Further research should investigate alternate methods to balancing tradeoffs between spatial data privacy and preservation of key patterns in public health data that are of scientific and medical importance.
Authors: Kristen H Hampton; Molly K Fitch; William B Allshouse; Irene A Doherty; Dionne C Gesink; Peter A Leone; Marc L Serre; William C Miller Journal: Am J Epidemiol Date: 2010-09-03 Impact factor: 4.897
Authors: Jelte M Wicherts; Coosje L S Veldkamp; Hilde E M Augusteijn; Marjan Bakker; Robbie C M van Aert; Marcel A L M van Assen Journal: Front Psychol Date: 2016-11-25
Authors: Jon Zelner; Rob Trangucci; Ramya Naraharisetti; Alex Cao; Ryan Malosh; Kelly Broen; Nina Masters; Paul Delamater Journal: Clin Infect Dis Date: 2021-03-01 Impact factor: 9.079