A survey of automatic de-identification of longitudinal clinical narratives <s> De-identification -a general discussion <s> Regulations in various countries permit the reuse of health information without patient authorization provided the data is "de-identified". In the United States, for instance, the Privacy Rule of the Health Insurance Portability and Accountability Act defines two distinct approaches to achieve de-identification; the first is Safe Harbor, which requires the removal of a list of identifiers and the second is Expert Determination, which requires that an expert certify the re-identification risk inherent in the data is sufficiently low. In reality, most healthcare organizations eschew the expert route because there are no standardized approaches and Safe Harbor is much simpler to interpret. This, however, precludes a wide range of worthwhile endeavors that are dependent on features suppressed by Safe Harbor, such as gerontological studies requiring detailed ages over 89. In response, we propose a novel approach to automatically discover alternative de-identification policies that contain no more re-identification risk than Safe Harbor. We model this task as a lattice-search problem, introduce a measure to capture the re-identification risk, and develop an algorithm that efficiently discovers polices by exploring the lattice. Using a cohort of approximately 3000 patient records from the Vanderbilt University Medical Center, as well as the Adult dataset from the UCI Machine Learning Repository, we also experimentally verify that a large number of alternative policies can be discovered in an efficient manner. <s> BIB001 </s> A survey of automatic de-identification of longitudinal clinical narratives <s> De-identification -a general discussion <s> Abstract Objectives The aim of this study was to discover the public's attitude and views towards privacy in health care. This is a part of a larger project which aims to gain an insight into what kind of privacy is needed and develop technical measures to provide such privacy. Methods The study was a two-stage process which combined qualitative and quantitative research. Stage One of the study comprised arranging and facilitating focus groups while in Stage Two we conducted a social survey. Measurements We measured attitudes towards privacy, medical research and consent; privacy concern about sharing one's health information for research; privacy concern about the possibility that some specific information from medical records could be linked to the patient's name in a situation that was not related to medical treatment. Results The results of the study revealed both great support for medical research (98%), and concern about privacy of health information (66%). Participants prefer to be asked for their permission before their health information is used for any purpose other than medical treatment (92%), and they would like to know the organisation and details of the research before allowing the use of their health records (83%). Age, level of education, place of birth and employment status are most strongly associated with privacy concerns. The study showed that there are some particularly sensitive issues and there is a concern (42–60%) about any possibility of linking these kinds of data to the patient's name in a situation that is not related to medical treatment. Such issues include sexually transmitted diseases, abortions and infertility, family medical history/genetic disorders, mental illness, drug/alcohol related incidents, lists of previous operations/procedures/dates and current medications. Conclusions Participants believe they should be asked for permission before their health information is used for any purpose other than medical treatment. However, consent and privacy concerns are not necessary related. Assuring individuals that their personal health information is de-identified reduces their concern about the necessity of consent for releasing health information for research purposes, but many people are not aware that removing their names and other direct identifiers from medical records does not guarantee full privacy protection for their health information. Privacy concerns decrease as extra security measures are introduced to protect privacy. Therefore, instead of "tailoring concern" as proposed by Willison [1] we suggest improving privacy protection of personal information by introducing additional security measures in data publishing. <s> BIB002 </s> A survey of automatic de-identification of longitudinal clinical narratives <s> De-identification -a general discussion <s> In recent years, sharing electronic medical records (EMRs) for more researchers outside the associated institutions is significant. For privacy preservation of the corresponding patients and the associated institutions, a de-identification task on the EMRs to be shared is a must. Although the deidentification task has been considered with positive research outcomes worldwide, especially those from the i2b2 (Informatics for Integrating Biology and the Bedside) shared tasks in 2006 and 2014, the task has not yet been a solved problem and still needs more investigation realistically. In this paper, we propose an automatic de-identification solution in a multilevel hybrid semi-supervised learning paradigm with a key focus on correctly identifying protected health information (PHI) in the EMRs. Similar to the existing works, our work defines a hybrid approach by combining a machine learning-based method with a conditional random fields model and a rule-based method in a post-processing phase to handle the PHI types with disambiguity. Nevertheless, our work is more general and practical. First, it considers the structure complexity of each EMR so that each section can be treated properly for more correct PHI identification up to its structure complexity: structured, semi-structured, or un-structured. Second, each EMR is then examined in our approach at three different levels of granularity such as a token level in the supervised learning phase, an entity level in the rule-based post-processing phase, and a section level along with the structure complexity in the semi-supervised learning phase. Many various detail levels will give our approach a deeper look at each EMR for more effectiveness. Third, our solution is conducted in a self-training manner so that it can get started with a small annotated data set in practice and get more effective with new EMRs over time. Evaluated with the i2b2 data set in comparison with the related works, our solution is effective with better F-measure values for the AGE, LOCATION, and PHONE PHI types and comparable for the other PHI types. <s> BIB003
There is a great interest internationally in applying data-driven techniques to electronic health records BIB003 ). However, privacy laws in many jurisdictions require accurate de-identification of medical documents, such as discharge summaries and electronic health records, before they can be shared outside of their originating institutions. De-identification of data provides opportunities for researchers to use medical data without individual consent. The sharing of records is crucial for advancing health research. For example, in the 2014 competition, the Heart Disease Risk Factors Challenge involved participating research groups attempting to predict heart disease risk factors in diabetic patients from longitudinal clinical narratives. As noted above, such a challenge would not have been possible under United States law if the narratives, 1,304 medical records from 296 diabetic patients, were not de-identified first. In this case, the records were deidentified with great care by multiple experts. Since most institutions would not be able to afford the costs of such de-identification, automating the process is therefore crucial for sharing data and advancing health research. Accurate automatic de-identification systems also help gain public trust in accepting the use of medical data for research purposes. As noted above, patients may be very concerned about some elements of their records, such as sexual history or mental health being traced back to them BIB002 ). Patient privacy needs to be protected by both the data holder and the data user  ). The data holder needs to ensure that the data is correctly de-identified before releasing it, and the data user should only request the data they need and use if for the purpose it was issued for to minimise the risk of re-identification. On the other hand, the existing HIPAA Safe Harbor standard may already limit researchers ability to perform various studies by masking relevant information, such as restricting location to three-digit zip codes (applicable to many social and public health studies), which may limit accuracy in health research BIB001 ). However, the Safe Harbor method has the advantage of being set by law, which reduces legal liability and reputation risk BIB001  ). The alternative standard of de-identification allowed by HIPPA is Expert Determination, where a suitably qualified individual certifies that the record has been deidentified to the extent that the risk of re-identification is acceptably low. The level of de-identification needed under this standard depends on context and risk. This allows the data to have the maximum value for the research at hand while still maintaining privacy. However, Expert Determination requires enough people with the skills necessary to safely make these determinations, widely accepted industrial standards, and de-identification techniques that will meet these standards BIB001 ; Chester (2018b)).