De-identification methods for open health data: the case of the heritage health prize claims dataset

Background: there are many benefits to open datasets. however,privacy concerns have hampered the widespread creation of open health data. there is a dearth of documented methods and case studies for the creation of public-use health data. we describe a new methodology for creating a longitudinal public health dataset in the context of the heritage health prize (hhp). the hhp is a global data mining competition to predict,by using claims data,the number of days patients will be hospitalized in a subsequent year. the winner will be the team or individual with the most accurate model past a threshold accuracy,and will receive a us s3 million cash prize. hhp began on april 4,2011,and ends on april 3,2013. objective: to de-identify the claims data used in the hhp competition and ensure that it meets the requirements in the us health insurance portability and accountability act (hipaa) privacy rule. methods: we defined a threshold risk consistent with the hipaa privacy rule safe harbor standard for disclosing the competition dataset. three plausible re-identification attacks that can be executed on these data were identified. for each attack the re-identification probability was evaluated. if it was deemed too high then a new de-identification algorithm was applied to reduce the risk to an acceptable level. we performed an actual evaluation of re-identification risk using simulated attacks and matching experiments to confirm the results of the de-identification and to test sensitivity to assumptions. the main metric used to evaluate re-identification risk was the probability that a record in the hhp data can be re-identified given an attempted attack. results: an evaluation of the de-identified dataset estimated that the probability of re-identifying an individual was .0084,below the .05 probability threshold specified for the competition. the risk was robust to violations of our initial assumptions. conclusions: it was possible to ensure that the probability of re-identification for a large longitudinal dataset was acceptably low when it was released for a global user community in support of an analytics competition. this is an example of,and methodology for,achieving open data principles for longitudinal health data.