blindfolded record linkage
Post on 15-Feb-2016
48 Views
Preview:
DESCRIPTION
TRANSCRIPT
Blindfolded Record Linkage
Presented by Gautam Sanka
Susan C. Weber, Henry Lowe, Amar Das, Todd Ferris
Introduction and Objectives Challenges
Patient Privacy vs. Building Cross-Site records Solutions
Mandate that identifiers be disclosed Privacy officers find this unacceptable
Keep only de-identified information in the registry but share an algorithm to Third Parties for generating an anonymous identifier
De-identification Explained This anonymous identifier will be
created in such a way that: Probability of same identifier generated at
two different sites is high for the same person
And low for different people
What can be used? Using SSN – Bad Idea Using names and DOB may seem best
but: Nicknames at one site and full name at
another Misspellings Different Titles (Mr. Ms. Mrs.)
Goal of Project Breast Cancer Patients at PAMF (Palo Alto Medical
Foundation) and Stanford University Medical Center Merge the Data with de-identification under HIPAA
and IRB approval
Interesting Approaches Bigrams
For the names Ann and Anne [AN, NN] [AN, NN, NE] The Dice Co-efficient is 2 * (2/5) = 4/5
Bloom Filter Both were not implemented due to the
complexities
A single SHA-1 string was constructed based on Gender DOB Zip Three letter Prefix of last name
In their case, only first two letters of patients’ first and last names were used
Composite Identifier Felt that a combination of DOB and the first
two letters of names would uniquely identify Most applicable when:
Compliance restrictions preclude the exchange of actual identifiers
Total number of comparisons is less than 10^8
Names and DOB are easily available DOB has a low error rate
Methods Measured Rate of false positives in data
Dropped name prefixes Dropped DOB stating 1/1/1900 and
1/1/1901 Performed a self-join on three sets of
1.5M rows, 0.5M rows and 10,000 rows
Specificity based on Data Set Size
Measure False Negative Both sites exchanged cryptographic
hashes based on SSNs The number of matches found by
matching SSNs and not composite identifiers became the Lower Bound for False Negatives
Removal of all False Positives based on real identifiers
Sensitivity: Specificity:
PAMF8,166
Stanford
10,939
2087 Common Patients
Total found by
Composite Identifier
2028
Exact Matches in Names +
DOB1824
Confirmed by Full
Identifiers Later204
“This was a very interesting result in that it provided us with a measure of how much better our approach is compared to using full names rather than two-letter prefixes.”
Reasons for False Negatives in Composite Identification
Found by SSN and later confirmed manually
Simply Using SSN SSNs found only 1806 out of 2028 Rate of false negatives is 10% higher
than a composite identifier Reasons
172 of the 222 with false negatives had a missing SSN
What about the other 50?
In conclusion, 57 False Positives for SSN matches3 False Positives for Composite Identifier20 times worse
Which identifiers are best?
When should we use this tool? Most useful where privacy policies preclude
the full exchange of the identifiers required by more sophisticated and sensitive linkage algorithms
For Data Sets of High quality, this approach (in comparison to complex algorithms) Easy to explain Adheres to minimum rules set by HIPAA Faster and less cumbersome
Suggestions
top related