A globally optimal k-anonymity method for the de-identification of health data.
BACKGROUND
Explicit patient consent requirements in privacy laws can have a negative impact on health research, leading to selection bias and reduced recruitment. Often legislative requirements to obtain consent are waived if the information collected or disclosed is de-identified.


OBJECTIVE
The authors developed and empirically evaluated a new globally optimal de-identification algorithm that satisfies the k-anonymity criterion and that is suitable for health datasets.


METHODS
Authors compared OLA (Optimal Lattice Anonymization) empirically to three existing k-anonymity algorithms, Datafly, Samarati, and Incognito, on six public, hospital, and registry datasets for different values of k and suppression limits. Measurement Three information loss metrics were used for the comparison: precision, discernability metric, and non-uniform entropy. Each algorithm's performance speed was also evaluated.


RESULTS
The Datafly and Samarati algorithms had higher information loss than OLA and Incognito; OLA was consistently faster than Incognito in finding the globally optimal de-identification solution.


CONCLUSIONS
For the de-identification of health datasets, OLA is an improvement on existing k-anonymity algorithms in terms of information loss and performance.
El Emam
Khaled
K
CHEO Research Institute, 401 Smyth Road, Ott, ON K1H8L1, Canada. kelemam@uottawa.ca
Dankar
Fida Kamal
FK
Issa
Romeo
R
Jonker
Elizabeth
E
Amyot
Daniel
D
Cogo
Elise
E
Corriveau
Jean-Pierre
JP
Walker
Mark
M
Chowdhury
Sadrul
S
Vaillancourt
Regis
R
Roffey
Tyson
T
Bottomley
Jim
J
D000293:Adolescent; D000328:Adult; D000465:Algorithms; D003219:Confidentiality; D005260:Female; D006801:Humans; D016247:Information Storage and Retrieval; D008297:Male; D016347:Medical Records Systems, Computerized