Preserving confidentiality when sharing medical database with the Cellsecu system

Abstract

We propose a computer system called Cellsecu that maintains the anonymity and the confidentiality of each cell containing sensitive information in medical database. Cellsecu attains this by automatically removing, generalizing, and expanding information. It is designed to enhance data privacy protection so a data warehouse can automatically handle queries. In most cases, health organizations collect medical data with explicit identifiers, such as name, address and phone number. Simply removing all explicit identifiers prior to release of the data is not enough to preserve the data confidentiality. Remaining data can be used to re-identify individuals by linking or matching the data to other database, or by looking at unique characteristics found in the database. A formal model based on Modal logic is the theoretical foundation of Cellsecu. As well, a new confidentiality criteria called “non-uniqueness” is defined and implemented. We believe modeling this problem formally can clarify the issue as well as clearly identify the boundary of current technology. Base on our preliminary performance evaluation, the confidentiality check module and the confidentiality enhancing module only slightly degrade system performance.

Introduction

In Taiwan, almost all citizens are covered by the national health insurance plan. The National Health Insurance Bureau (NHIB) collects and maintains a huge database containing high-quality health related data. It is a gold mine for many researchers working in the health care related areas, as sharing data can significantly benefit the public. The existence of such database would enable researchers to track certain diseases and patient's responses to certain drugs. However, with the rapid advances in the medical data computerization, the question of protecting privacy has begun to arise. Storing a large amount of sensitive information in a central databases “could open the door to privacy invasion”. In order to better utilize medical data, NHIB has authorized the National Health Research Institute (NHRI) to handle the release of the database. Currently, NHRI accepts applications from researchers requesting data contained in the databases. A review committee grants access based on the purpose and relevance of the research. The process takes some time and may fail to distinguish requests for highly sensitive data from those for general statistical data.

How to publish a database while preserving confidentiality is far-reaching problem. The United States Social Security Administration employs bin size as the measurement for anonymity [2]. Two recent systems, Datafly [19] and μ-argus [16] also use bin size as an anonymity measurement. By anonymity we mean that a record cannot be connected to any individual. Data confidentiality assures that a field value cannot be connected to an individual. Data confidentiality is a fine-grain method to insure privacy protection and secure anonymity. It corresponds fluidly to Modal logic [6], [8], a mathematical framework that defines the idea of “knowing”. A formal framework for the data confidentiality is developed in [14]. Cellsecu system development is based on that framework. Once confidentiality criteria are defined, the question is how to assure the confidentiality if releasing certain data violates confidentiality criteria. We follow the idea of using generalization to enhance the confidentiality proposed in Datafly system. A lattice framework is developed to facilitate a search for the least generalized yet confidential data set. Cellsecu is a web-based prototype system developed based on the above-mentioned framework. We envision Cellsecu as a gate-keeper (Fig. 1) such that users can freely query a data center, while confidentiality is preserved. The rest of the paper is organized as follows. In Section 2 we give a brief review of previous work in database confidentiality. In Section 3 we present the system architecture of Cellsecu. Section 4 contains performance evaluation. Section 5 discusses practical issues. We conclude with future research directions in Section 6.