title: A multi-institution evaluation of clinical profile anonymization.
abstract: OBJECTIVE
  There is an increasing desire to share de-identified electronic health records (EHRs) for secondary uses, but there are concerns that clinical terms can be exploited to compromise patient identities. Anonymization algorithms mitigate such threats while enabling novel discoveries, but their evaluation has been limited to single institutions. Here, we study how an existing clinical profile anonymization fares at multiple medical centers.
  
  
  METHODS
  We apply a state-of-the-artk-anonymization algorithm, withkset to the standard value 5, to the International Classification of Disease, ninth edition codes for patients in a hypothyroidism association study at three medical centers: Marshfield Clinic, Northwestern University, and Vanderbilt University. We assess utility when anonymizing at three population levels: all patients in 1) the EHR system; 2) the biorepository; and 3) a hypothyroidism study. We evaluate utility using 1) changes to the number included in the dataset, 2) number of codes included, and 3) regions generalization and suppression were required.
  
  
  RESULTS
  Our findings yield several notable results. First, we show that anonymizing in the context of the entire EHR yields a significantly greater quantity of data by reducing the amount of generalized regions from ∼15% to ∼0.5%. Second, ∼70% of codes that needed generalization only generalized two or three codes in the largest anonymization.
  
  
  CONCLUSIONS
  Sharing large volumes of clinical data in support of phenome-wide association studies is possible while safeguarding privacy to the underlying individuals.
authors.affiliation: Department of Biomedical Informatics, Vanderbilt University, Nashville, TN, USA.
authors.forename: Raymond
authors.initials: R
authors.lastname: Heatherly
authors.affiliation: Feinberg School of Medicine, Northwestern University, Chicago, IL, USA.
authors.forename: Luke V
authors.initials: LV
authors.lastname: Rasmussen
authors.affiliation: Biomedical Informatics Research Center, Marshfield Clinic Research Foundation, Marshfield, WI, USA.
authors.forename: Peggy L
authors.initials: PL
authors.lastname: Peissig
authors.affiliation: Feinberg School of Medicine, Northwestern University, Chicago, IL, USA.
authors.forename: Jennifer A
authors.initials: JA
authors.lastname: Pacheco
authors.affiliation: Department of Biomedical Informatics, Vanderbilt University, Nashville, TN, USA Department of Biomedical Engineering, Vanderbilt University, Nashville, TN, USA.
authors.forename: Paul
authors.initials: P
authors.lastname: Harris
authors.affiliation: Department of Biomedical Informatics, Vanderbilt University, Nashville, TN, USA Department of Medicine, Vanderbilt University, Nashville, TN, USA.
authors.forename: Joshua C
authors.initials: JC
authors.lastname: Denny
authors.affiliation: Department of Biomedical Informatics, Vanderbilt University, Nashville, TN, USA Department of Electrical Engineering & Computer Science, Vanderbilt University, Nashville, TN, USA b.malin@vanderbilt.edu.
authors.forename: Bradley A
authors.initials: BA
authors.lastname: Malin
mesh_terms: D003219:Confidentiality; D000068240:Data Anonymization; D057286:Electronic Health Records; D006801:Humans; D007037:Hypothyroidism; D033181:Information Dissemination; D038801:International Classification of Diseases; D019982:Organizational Case Studies
keywords: anonymization; clinical codes; generalization; privacy; secondary use