Dynamically Adjusting Case Reporting Policy to Maximize Privacy and Utility in the Face of a Pandemic
Managing a pandemic requires continuous dissemination of infectious disease surveillance data. Legislation permits sharing de identified patient data; however, current de identification approaches are time consuming and do not flex with changes in infection rates or population demographics over time. In this paper, we introduce a framework to dynamically adapt de identification for near real time sharing of patientlevel surveillance data. The framework leverages a simulation mechanism, capable of being applied to any geographic level, to forecast and manage disclosure risks. We use data from Johns Hopkins University and the Centers for Disease Control and Prevention to demonstrate the framework's effectiveness in maintaining the privacy risk below a threshold based on public health standards for COVID 19 county level case data from August 2020 to April 2021. Across all US counties, the framework's approach meets the threshold for 95.2% of daily data releases, while a policy based on current deidentification techniques meets the threshold for only 24.6% INTRODUCTION The novel coronavirus 2019 (COVID 19) pandemic has put a spotlight on infectious disease surveillance systems and the importance of making such information widely accessible. It is evident that sharing surveillance data in a timely manner can support a wide variety of public health endeavors (e.g. from modeling disease transmissibility and severity to simulation of interventions) as well as enable the general public to gain situational awareness of outbreaks. In recognition of such benefits, over the past year, various organizations have worked to broaden access to large epidemiological datasets. Recent instantiations of COVID 19 initiatives include the National COVID Cohort Collaborative (N3C) of the U.S. National Institutes of Health, the Datavant COVID 19 Research Database, the Centers for Disease Control and Prevention's (CDC) COVID 19 Case Surveillance datasets, and the Global.health data science initiative, among others. While advances in surveillance have spurred rapid growth in the volume and diversity of epidemiological resources, data sharing on a wide scale remains limited. This is due to numerous social and political factors, but it is evident that privacy is a core driving factor. In the United States, for instance, much of the infectious disease data is captured by organizations who are subject to the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and related laws and policies. Under HIPAA, an organization is permitted to publicly share patient level data only when it is de identified, that is, when the data "does not identify an individual and there is no reasonable basis to believe that the information can be used to identify an individual." Even when organizations are not covered by HIPAA, they may be permitted to share data in a de identified form as well. For example, the California Consumer Protection Act (CCPA) which recently went into effect at the end of 2020, as well as the Virginia Consumer Data Protection Act (VCDPA) which goes into effect in 2023, both provide exemptions to de identified data sharing. However, transforming data into a de identified form is a non trivial endeavor. Numerous demonstration attacks have shown that, with the right background knowledge, a data recipient can leverage residual information in the records to reidentify the individuals to whom the data corresponds. Concerns over such intrusions to anonymity have discouraged organizations from sharing data, which raises the importance of the question of how organizations can best comply with regulatory requirements while facilitating infectious disease surveillance. While state laws such as CCPA and VCDPA are vague on the technical implementation of de identification, HIPAA enables this notion to be satisfied through two alternative mechanisms. The first is Safe Harbor, which requires the suppression of eighteen direct (e.g. patient name) and quasi identifying features (e.g. geocodes with populations smaller than 20,000 residents) However, Safe Harbor requires the suppression or alteration of epidemiologically critical factors, such as reducing dates of events to the year of event, rendering such a policy useless for continuous monitoring of infectious disease. The alternative mechanism is Expert Determination, which allows "[a] person with appropriate knowledge of and experience with generally accepted statistical and scientific principles and methods" to determine that "the risk is very small that the information could be used to identify an individual who is a subject of the information." Various methods have been developed to assess re identification risk and design deidentification policies under Expert Determination; however, these methods assume that data have already been collected and are ready for dissemination. In doing so, they also assume that the number of records in the dataset remains fixed. These assumptions differ from the requirements of case reporting in the face of a pandemic, motivating the need for methods that forecast surveillance data and account for the fact that reidentification risk will vary over time. Time is also a factor. Waiting to publish the data will hinder the ability to characterize the current state and evolution of an outbreak. Furthermore, several factors affect the privacy risk, including the demographics of the people infected, the geolocations to which the pandemic spreads, and the infection rate. In this paper, we introduce a computational approach to adaptively generate policies that support the sharing of patient level epidemiological data in a de identified form. The underlying framework simulates disease cases to estimate the longitudinal privacy risk of sharing infected individuals' quasi identifier information at different levels of granularity (i.e. under different data release policies) in the absence of actual patient data. The privacy risk estimates (i.e. measurements of how likely an individual in the dataset can be re identified) inform the data sharer in periodically selecting a data sharing policy, according to the expected number of new disease cases and the sharer's information priorities. Prospective risk estimation and policy selection will enable near real time data sharing to support disease monitoring. We specifically apply the framework to illustrate how policies could be developed to share patient health information in the COVID 19 pandemic, and compare such policies to a more traditional de identification approach that relies on a retrospective risk assessment. Acknowledging the potential for disparities in the privacy afforded to various subpopulations, we also briefly investigate the fairness of data sharing policies. It should be recognized that the framework generalizes to any type of epidemiological disease spread, adjusts for the demographic diversity of individual US counties, and relies on public data sources. The framework's approach can also be reused to address emerging data sharing needs, such as for vaccine registries. Dynamically adapting data sharing policies holds the potential to consistently share more data with the public in a timely and privacy preserving manner, fueling our data driven response to infectious disease. RESULTS Privacy risk estimation framework Our proposed framework provides longitudinal privacy risk estimates for a data sharing policy within a specified geographic region. In this research, we apply this framework to simulate disease spread on a county level to match the format of the COVID 19 surveillance data made accessible by the CDC. We provide a summary of the framework's features to contextualize the results, and reserve additional technical details for the Methods section. Figure 1 provides a summary of our framework. The framework begins by selecting a data sharing policy, which defines the generalization of each quasi identifying feature considered. In this paper, we consider the basic demographic features and the date of diagnosis as quasi identifiers, since these are the typical features that organizations have been requested to share (Table 1) However, we note the framework is sufficiently flexible to evaluate any quasi identifier. The second step in the framework generates the distribution of the county level population on the quasi identifying features according to the selected data sharing policy. We use data from the U.S. Census Bureau to calculate the number of people in the county that fall into each demographic group, where each group is defined by a unique combination of values for the features in Table 1, excluding date of diagnosis. The more granular the quasi identifying features, the greater the number of potential groups. Figure 1. Privacy risk estimation framework. The curved rectangles represent processes, the cylinders represent data, and the hexagons represent user defined parameters. The algorithm that performs the processes within the black box is in the core of the proposed framework, employs Monte Carlo random sampling, and is presented in greater detail in the Methods section. To obtain the privacy risk distributions, the simulation is repeated n times. The circled numbers denote the framework steps. The third step applies a Monte Carlo simulation (represented by the black box in Figure 1) to obtain the privacy risk distributions using the county level population distribution computed in the previous step and the time series of new disease case counts. To simulate the COVID 19 pandemic, we input the time series of new disease cases from the Johns Hopkins COVID 19 tracking data. The framework's algorithm initializes the full population in the county to be the uninfected population. For each time point, and given the disease case count, we randomly sample the same number of people without replacement from the uninfected population to form the newly reported patient dataset. The fr
ArXiv