Abstract:Objective: Electronic medical records (EMRs) are increasingly repurposed for activities beyond clinical care, such as to support translational research and public policy analysis. To mitigate privacy risks, healthcare organizations (HCOs) aim to remove potentially identifying patient information. A substantial quantity of EMR data is in natural language form and there are concerns that automated tools for detecting identifiers are imperfect and leak information that can be exploited by ill-intentioned data recipients. Thus, HCOs have been encouraged to invest as much effort as possible to find and detect potential identifiers, but such a strategy assumes the recipients are sufficiently incentivized and capable of exploiting leaked identifiers. In practice, such an assumption may not hold true and HCOs may overinvest in de-identification technology. The goal of this study is to design a natural language de-identification framework, rooted in game theory, which enables an HCO to optimize their investments given the expected capabilities of an adversarial recipient. Methods: We introduce a Stackelberg game to balance risk and utility in natural language de-identification. This game represents a cost-benefit model that enables an HCO with a fixed budget to minimize their investment in the de-identification process. We evaluate this model by assessing the overall payoff to the HCO and the adversary using 2100 clinical notes from Vanderbilt University Medical Center. We simulate several policy alternatives using a range of parameters, including the cost of training a de-identification model and the loss in data utility due to the removal of terms that are not identifiers. In addition, we compare policy options where, when an attacker is fined for misuse, a monetary penalty is paid to the publishing HCO as opposed to a third party (e.g., a federal regulator). Results: Our results show that when an HCO is forced to exhaust a limited budget (set to $2000 in the study), the precision and recall of the de-identification of the HCO are 0.86 and 0.8, respectively. A game-based approach enables a more refined cost-benefit tradeoff, improving both privacy and utility for the HCO. For example, our investigation shows that it is possible for an HCO to release the data without spending all their budget on de-identification and still deter the attacker, with a precision of 0.77 and a recall of 0.61 for the de-identification. There also exist scenarios in which the model indicates an HCO should not release any data because the risk is too great. In addition, we find that the practice of paying fines back to a HCO (an artifact of suing for breach of contract), as opposed to a third party such as a federal regulator, can induce an elevated level of data sharing risk, where the HCO is incentivized to bait the attacker to elicit compensation. Conclusions: A game theoretic framework can be applied in leading HCO's to optimized decision making in natural language de-identification investments before sharing EMR data.

Exploring the tradeoff between data privacy and utility with a clinical data analysis use case

On the Tradeoff Between Privacy and Utility in Data Publishing.

Efficient Discovery of De-Identification Policy Options Through a Risk-Utility Frontier

Enhanced Utility-Driven Data Anonymization: Leveraging AI and Machine Learning for Sensitive Data Privacy

The Costs of Anonymization: Case Study Using Clinical Data

Data Pseudonymization in a Range That Does Not Affect Data Quality: Correlation with the Degree of Participation of Clinicians

On the Trade-Off between Fidelity, Utility and Privacy of Synthetic Patient Data

Mapping the Privacy-Utility Tradeoff in Mobile Phone Data for Development

Exploring the Tradeoff Between Privacy and Utility of Complete‐count Census Data Using a Multiobjective Optimization Approach

Towards a Data Privacy-Predictive Performance Trade-off

Quantification of De-anonymization Risks in Social Networks

Optimizing Privacy and Utility Tradeoffs for Group Interests Through Harmonization

Utility-based Anonymization for Privacy Preservation with Less Information Loss

The Users' Perspective on the Privacy-Utility Trade-offs in Health Recommender Systems

Optimizing annotation resources for natural language de-identification via a game theoretic framework

The tradeoff between the utility and risk of location data and implications for public good

Anonymising Clinical Data for Secondary Use

Optimizing Privacy in Set-Valued Data: Comparing Certainty Penalty and Information Gain

Anonymously Analyzing Clinical Datasets

Synthetic Data: Revisiting the Privacy-Utility Trade-off

Comparison of personal information de-identification policies and laws within the EU, the US, Japan, and South Korea