Abstract:BACKGROUND Data science offers an unparalleled opportunity to identify new insights into many aspects of human life with recent advances in health care. Using data science in digital health raises significant challenges regarding data privacy, transparency, and trustworthiness. Recent regulations enforce the need for a clear legal basis for collecting, processing, and sharing data, for example, the European Union’s General Data Protection Regulation (2016) and the United Kingdom’s Data Protection Act (2018). For health care providers, legal use of the electronic health record (EHR) is permitted only in clinical care cases. Any other use of the data requires thoughtful considerations of the legal context and direct patient consent. Identifiable personal and sensitive information must be sufficiently anonymized. Raw data are commonly anonymized to be used for research purposes, with risk assessment for reidentification and utility. Although health care organizations have internal policies defined for information governance, there is a significant lack of practical tools and intuitive guidance about the use of data for research and modeling. Off-the-shelf data anonymization tools are developed frequently, but privacy-related functionalities are often incomparable with regard to use in different problem domains. In addition, tools to support measuring the risk of the anonymized data with regard to reidentification against the usefulness of the data exist, but there are question marks over their efficacy. OBJECTIVE In this systematic literature mapping study, we aim to alleviate the aforementioned issues by reviewing the landscape of data anonymization for digital health care. METHODS We used Google Scholar, Web of Science, Elsevier Scopus, and PubMed to retrieve academic studies published in English up to June 2020. Noteworthy gray literature was also used to initialize the search. We focused on review questions covering 5 bottom-up aspects: basic anonymization operations, privacy models, reidentification risk and usability metrics, off-the-shelf anonymization tools, and the lawful basis for EHR data anonymization. RESULTS We identified 239 eligible studies, of which 60 were chosen for general background information; 16 were selected for 7 basic anonymization operations; 104 covered 72 conventional and machine learning–based privacy models; four and 19 papers included seven and 15 metrics, respectively, for measuring the reidentification risk and degree of usability; and 36 explored 20 data anonymization software tools. In addition, we also evaluated the practical feasibility of performing anonymization on EHR data with reference to their usability in medical decision-making. Furthermore, we summarized the lawful basis for delivering guidance on practical EHR data anonymization. CONCLUSIONS This systematic literature mapping study indicates that anonymization of EHR data is theoretically achievable; yet, it requires more research efforts in practical implementations to balance privacy preservation and usability to ensure more reliable health care applications.

Health Data Re-Identification: Assessing Adversaries and Potential Harms

Assessing the risk of re-identification arising from an attack on anonymised data

Using game theory to thwart multistage privacy intrusions when sharing data

ECG Unveiled: Analysis of Client Re-identification Risks in Real-World ECG Datasets

Safeguarding Privacy in Genome Research: A Comprehensive Framework for Authors

De-Health: All Your Online Health Information Are Belong to Us.

AI-based Re-identification of Behavioral Clickstream Data

DIRI: Adversarial Patient Reidentification with Large Language Models for Evaluating Clinical Text Anonymization

Data Anonymization for Pervasive Health Care: Systematic Literature Mapping Study (Preprint)

Evaluating the re-identification risk of a clinical study report anonymized under EMA Policy 0070 and Health Canada Regulations

Are You the Outlier? Identifying Targets for Privacy Attacks on Health Datasets

Dicing with data: the risks, benefits, tensions and tech of health data in the iToBoS project

Anonymising Clinical Data for Secondary Use

A survey on UK researchers' views regarding their experiences with the de-identification, anonymisation, release methods and re-identification risk estimation for clinical trial datasets

Data Anonymization for Pervasive Health Care: Systematic Literature Mapping Study

De-Identification of Medical Imaging Data: A Comprehensive Tool for Ensuring Patient Privacy

Slice it up: Unmasking User Identities in Smartwatch Health Data

Das Reidentifikationspotenzial von strukturierten Gesundheitsdaten

Privacy Risk Assessment for Synthetic Longitudinal Health Data

Privacy-preserving data sharing infrastructures for medical research: systematization and comparison

Adversarial Learning of Privacy-Preserving Text Representations for De-Identification of Medical Records